The arrangement described is a cold recovery plan because the organization has an agreement to obtain equipment and restore data from off-site tapes, but the recovery site is not already fully configured and operational. A hot site would have systems, infrastructure, and data ready for rapid failover, often with real- time or near-real-time synchronization. A warm site would typically have some configured hardware and infrastructure already available, although not fully current. "No recovery plan" is incorrect because management has at least arranged for equipment rental and off-site backup restoration. Internal auditors should evaluate whether the selected recovery approach meets recovery time objectives, recovery point objectives, and business impact analysis requirements. Therefore, Option C is correct.

Understanding Matrix Organizations:
A matrix organization is a hybrid structure that combines functional and project-based structures, where employees report to multiple managers (e.g., a functional manager and a project manager).
These organizations adapt to projects by adjusting authority, responsibility, and accountability based on the project ' s stage or the organization ' s culture.
Why Option C Is Correct?
In a matrix organization, roles and decision-making authority evolve based on the project ' s phase, size, or complexity.
Employees might report to different managers at different times, and accountability structures may change.
This aligns with IIA Standard 2110 - Governance, which emphasizes clear roles and responsibilities in dynamic organizational structures.
Why Other Options Are Incorrect?
Option A (Unity-of-command concept):
The unity-of-command principle states that employees should report to only one superior, which contradicts the nature of a matrix organization, where dual reporting exists.
Option B (Combination of product and functional departments allows management to utilize personnel from various functions):
While matrix organizations integrate product and functional departments, the key defining feature is the variable authority, responsibility, and accountability, making option C a better fit.
Option D (Best suited for firms with scattered locations or large-scale firms):
While matrix structures can be used in large firms, they are not limited to them and are often found in project- based industries (e.g., engineering, IT, consulting).
Matrix organizations adapt their authority structures based on project needs, making option C the best choice.
IIA Standard 2110 supports governance structures that evolve with organizational needs.
Final Justification:IIA References:
IPPF Standard 2110 - Governance (Organizational Structure & Accountability) COSO ERM - Governance & Decision-Making in Matrix Organizations

Identifying and prioritizing CSR issues that are important to the organization is a management responsibility because it involves strategy, stakeholder priorities, resource allocation, and risk appetite. Internal audit may advise, evaluate, or provide assurance, but it should not decide which CSR issues matter most. Consulting on design, advising on controls, and evaluating effectiveness can be appropriate if internal audit avoids assuming ownership. Option D is a classic assurance role. Option B is advisory but acceptable. Option A can be acceptable with safeguards, especially if internal audit later avoids auditing its own work or discloses impairment. The least appropriate role is making CSR priority decisions. Therefore, Option C is correct.

A Cold Site is a remote disaster recovery facility that provides physical space and basic utilities such as electricity, internet, and telecommunications but does not include pre-installed servers, networking equipment, or other IT infrastructure. It requires a longer recovery time since the organization must procure, install, and configure necessary hardware and software before resuming operations.
A). Frozen Site - This is not a recognized term in IT disaster recovery planning.
C). Warm Site - A warm site has some pre-installed hardware and infrastructure but requires additional setup before full operation.
D). Hot Site - A hot site is a fully functional duplicate of the original site, with real-time data replication, allowing for immediate recovery.
The IIA Global Technology Audit Guide (GTAG) 10: Business Continuity Management emphasizes that organizations should classify recovery sites based on risk tolerance and recovery time objectives (RTO).
The IIA's International Professional Practices Framework (IPPF) - Practice Advisory 2110-2 discusses IT continuity and disaster recovery as a critical element of internal audit assessments.
NIST Special Publication 800-34 (Contingency Planning Guide for Information Technology Systems) defines and categorizes disaster recovery sites, aligning with the cold site definition.
Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is B. Cold Site.

In advisory engagements, internal audit may provide consulting support that enhances processes while maintaining objectivity. In this case, the most appropriate value-adding activity is to facilitate development of a checklist for documenting asset transfers. This addresses the identified gap directly and supports management in strengthening controls.
Option A identifies risks but does not resolve the gap. Option C (root cause analysis) is not as practical in this advisory setting. Option D (resource allocation) is a management responsibility, not internal audit's role.
Reference:
IIA Implementation Guidance - Advisory Services; Standard 2120: Risk Management.