The CAE must prioritize engagements based on risk assessment. A risk matrix (considering likelihood and impact of risks) provides the starting point to evaluate which areas of the audit universe present the highest exposure and should be included in the plan.
Option A (maturity model) helps evaluate risk management capability but is not the starting point. Option C (assurance map) supports coordination but follows the risk assessment. Option D (control framework) provides criteria but not prioritization.
Reference:
IIA Standards - Standard 2010: Planning.

The CAE should remain aware of emerging risks through ongoing communication and collaboration with senior management and other stakeholders. Building strong relationships allows the CAE to obtain early insights into new and developing risks.
Option B (building a risk management process) is management's responsibility, not internal audit's. Options C and D involve reviewing processes, but they do not directly expose the CAE to emerging risks in real time.
Reference:
IIA Standards - Standard 2010: Planning; Practice Guide - Developing a Risk-based Internal Audit Plan.

When executive compensation is tied to financial results, there is a strong incentive to manipulate financial reporting or focus solely on short-term performance at the expense of stakeholders' interests.
Potential for Unethical Behavior:
Executives may prioritize profit-driven decisions (e.g., cost-cutting, aggressive revenue recognition) over long-term sustainability.
As per IIA Standard 2110 - Governance, incentive structures should align with ethical business practices and stakeholder interests.
Increased Risk of Fraud and Misrepresentation:
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) Fraud Risk Management Guide highlights how executive incentives can lead to financial statement manipulation.
This could result in actions like aggressive revenue recognition, improper expense deferrals, or overstating earnings to boost compensation.
Misalignment with Stakeholder Interests:
Employees, customers, and investors suffer if executive compensation encourages short-term gains over long- term stability.
IIA GTAG 3: Continuous Auditing supports monitoring financial reporting risks to detect such inconsistencies.
A). The organization reports inappropriate estimates and accruals due to poor accounting controls. (Incorrect) Reason: While poor controls can contribute to misstatements, the root cause in this scenario is compensation structure, not control weakness.
B). The organization uses an unreliable process for gathering and reporting executive compensation data.
(Incorrect)
Reason: This issue relates to HR and payroll data integrity, not the impact of performance-based compensation on behavior.
C). The organization experiences increasing discontent of employees, if executives are eligible for compensation amounts that are deemed unreasonable. (Incorrect) Reason: While excessive executive pay may cause employee dissatisfaction, the question focuses on behavioral impacts on stakeholders, making D the more relevant choice.
IIA Standard 2110 - Governance - Ensures executive compensation aligns with organizational ethics and stakeholder interests.
IIA Standard 2120 - Risk Management - Covers the risks associated with incentive-based compensation.
COSO Fraud Risk Management Guide - Discusses financial fraud linked to executive compensation.
IIA GTAG 3: Continuous Auditing - Supports risk-based monitoring of financial statements.
Why is Answer D Correct?Analysis of Incorrect Answers:IIA References:Thus, the correct answer is D. The organization encourages employee behavior that is inconsistent with the interests of relevant stakeholders.

A false positive occurs when a system incorrectly identifies a legitimate item as a threat or an unwanted entity. In the case of a spam filter, a false positive happens when the filter mistakenly classifies a genuine email as spam, even though it is legitimate.
Option A: "The spam filter removed incoming communication that included certain keywords and domains." This describes a general filtering mechanism but does not indicate a mistake. If the filter was correctly configured, it is not necessarily a false positive. (Incorrect) Option B: "The spam filter deleted commercial ads automatically, as they were recognized as unwanted." If the ads were indeed unwanted, this is a true positive, meaning the system worked correctly. (Incorrect) Option C: "The spam filter routed to the 'junk' folder a newsletter that appeared to include links to fake websites." If the newsletter contained suspicious links, the filter was functioning as designed. This is not necessarily an error. (Incorrect) Option D: "The spam filter blocked a fitness club gift card that coworkers sent to an employee for her birthday." This is a clear example of a false positive because the email was not spam or malicious, yet the filter mistakenly blocked it. (Correct Answer) IIA GTAG (Global Technology Audit Guide) on Cybersecurity and IT Risks: Discusses false positives and negatives in automated security controls.
IIA's "Auditing IT Security Controls" Report: Emphasizes the need for tuning security filters to reduce false positives.
COBIT 2019 - DSS05.07 (Manage Security Services): Highlights the importance of minimizing false positives to ensure business communication is not disrupted.
Analysis of Each Option:IIA References:Thus, the correct answer is D. The spam filter blocked a fitness club gift card that coworkers sent to an employee for her birthday.

A disaster recovery plan (DRP) ensures that critical systems and data can be restored after an incident. If backup plans exist but no recovery and restore processes are defined, then the organization lacks a functional recovery plan altogether.
* (A) Hot recovery plan.
* Incorrect. A hot recovery plan includes real-time data replication and immediate failover systems, allowing for almost instant recovery in case of an outage. Since the scenario mentions that no restore process is defined, this cannot be a hot recovery plan.
* (B) Warm recovery plan.
* Incorrect. A warm recovery plan involves regular backups and a standby system that can be activated within hours or days. However, without defined restore procedures, the organization does not even have a warm recovery plan.
* (C) Cold recovery plan.
* Incorrect. A cold recovery plan means that backups exist but recovery takes significant time because systems and infrastructure need to be rebuilt. However, a cold plan still includes a recovery process, which the scenario lacks.
* (D) Absence of recovery plan. #
* Correct. If data backup plans exist but no restore processes are defined, then there is no functional recovery plan. Without a structured approach to data recovery, backups alone are useless in an actual disaster scenario.
* IIA GTAG "Business Continuity and Disaster Recovery" highlights the need for detailed recovery processes as part of an overall disaster recovery plan.
* IIA GTAG - "Business Continuity and Disaster Recovery"
* IIA Standard 2120 - Risk Management
* COBIT Framework - IT Disaster Recovery Controls
Analysis of Answer Choices:IIA References:Thus, the correct answer is D, as data backups without recovery procedures indicate the absence of a recovery plan.