The internal audit plan must be risk-based, as required by the IIA Standards. If cybersecurity has been identified as a high risk during the annual risk assessment, then it should be included in the audit plan to provide assurance over the adequacy of controls.
Including engagements simply to satisfy management (Option A) or for auditor learning purposes (Option B) does not align with risk-based planning principles. Likewise, management requests alone (Option D) do not dictate audit plan content; engagements must be prioritized based on risk to the organization.
Reference:
IIA Standards - Standard 2010: Planning; Implementation Guide 2010 - Risk-Based Planning.

In decentralized organizations, decision-making authority is dispersed to lower levels, regions, divisions, or operating units. This structure often relies on local managers' knowledge of markets, customers, regulations, and operational conditions. Option A is more characteristic of centralized or mechanistic structures, where formal rules and uniform procedures are emphasized. Option B is not generally true because centralized structures can slow decisions due to approval layers. Option C is incorrect because centralized organizations usually retain more control at top management level. Internal auditors evaluating organizational structure should consider whether authority, accountability, reporting lines, and control mechanisms are appropriate for the organization's strategy and risk profile. Therefore, Option D is correct.

According to the IIA Standards, the CAE must ensure that the internal audit activity is appropriately staffed with competent individuals to achieve the approved audit plan. While risk-based planning and collaboration with risk functions support effectiveness, the most direct way to ensure resources are adequate is by developing and maintaining the competencies of internal audit staff through training, recruitment, and professional development.
Mapping the audit risk assessment (Option B), collaboration with risk functions (Option C), or refining processes (Option D) may strengthen planning and alignment, but they do not directly address the resource requirement. Only enhancing and ensuring competencies ensures the internal audit activity has the skills necessary to execute the plan.
Reference:
IIA Standards - Standard 2030: Resource Management.

Veracity refers to the reliability, accuracy, trustworthiness, and quality of big data. Big data may be large, fast- moving, and varied, but it is not useful unless the organization can trust its accuracy and consistency. Variety refers to different forms and sources of data, such as structured, semi-structured, and unstructured data. Value refers to the usefulness or business benefit derived from data. Validity is a general data quality concept but is not one of the most common "V" dimensions used to describe big data in this context. Internal auditors should consider veracity when relying on analytics, because poor-quality data can lead to incorrect conclusions, false exceptions, and weak assurance. Therefore, Option A is correct.

* Understanding the Financing Section of a Cash Budget:
* A cash budget is a financial plan that outlines expected cash inflows and outflows over a specific period.
* The financing section records activities related to borrowing, repaying debt, issuing securities, and managing interest payments.
* Why Debt and Interest Payments Belong in the Financing Section:
* Debt repayment (principal and interest) is a financial activity rather than an operational or investing activity.
* Companies must plan for financing costs to ensure liquidity and compliance with loan agreements.
* Why Other Options Are Incorrect:
* A. Collections from customers - Incorrect.
* Customer payments belong in the operating section of the cash budget, as they represent core business activities.
* B. Sale of securities - Incorrect.
* The sale of securities is an investing activity unless related to issuing new debt or equity.
* C. Purchase of trucks - Incorrect.
* Buying trucks is a capital expenditure, which belongs in the investing section of the cash budget.
* IIA's Perspective on Financial Planning and Budgeting:
* IIA Standard 2120 - Risk Management requires organizations to assess financial risks, including debt repayment obligations.
* COSO ERM Framework highlights the importance of cash flow forecasting to maintain financial stability.
* GAAP and IFRS Financial Reporting Standards classify debt repayment and interest under financing activities.
IIA References:
* IIA Standard 2120 - Risk Management & Cash Flow Oversight
* COSO ERM - Financial Planning and Liquidity Management
* GAAP & IFRS - Cash Flow Statement Classifications
Thus, the correct and verified answer is D. Payment of debt, including interest.