Understanding How IoT Impacts Data Attributes:
The Internet of Things (IoT) refers to connected devices that continuously collect and transmit data in real- time.
IoT generates massive amounts of data at high speeds, affecting the velocity of data processing and analysis.
Why Velocity is the Most Affected Attribute:
Velocity refers to the speed at which data is generated, processed, and transmitted.
IoT devices continuously stream data, requiring real-time or near-real-time processing.
Examples include:
Smart sensors in factories sending real-time equipment status.
Wearable devices tracking health metrics every second.
Smart cities using IoT for traffic monitoring and instant updates.
Why Other Options Are Incorrect:
A). Normalization - Incorrect.
Normalization refers to organizing database structures, but IoT deals with data transmission speed rather than database design.
C). Structuration - Incorrect.
Structuration relates to how data is formatted (structured vs. unstructured), but IoT's biggest challenge is real- time data flow.
D). Veracity - Incorrect.
Veracity concerns data accuracy and reliability, which is a challenge in IoT but not the most significant impact compared to velocity.
IIA's Perspective on IoT and Data Management:
IIA Standard 2110 - Governance emphasizes the need for robust data processing frameworks to handle IoT- generated data velocity.
IIA GTAG (Global Technology Audit Guide) on Big Data highlights real-time data analytics and IoT challenges.
ISO 27001 Information Security Standard recommends ensuring real-time data processing controls for IoT security and management.
IIA References:
IIA Standard 2110 - IT Governance & Data Management
IIA GTAG - IoT and Big Data Risks
ISO 27001 - Information Security and Real-Time Data Processing
Thus, the correct and verified answer is B. Velocity.

A business continuity and disaster recovery plan does not prevent natural disasters, predict when they will occur, or eliminate the threat. Its value is that it reduces the likelihood that such events will severely disrupt operating activities by preparing recovery strategies, alternate procedures, communication protocols, backup arrangements, and restoration priorities. Natural disasters may still occur, but an effective plan helps the organization continue critical services or recover them within acceptable timeframes. Option A is too absolute because economic impact may still occur. Option B is incorrect because continuity planning does not forecast disasters. Option D is also incorrect because threats cannot be eliminated. Internal audit should assess whether continuity and recovery plans align with business impact analysis, recovery time objectives, and recovery point objectives. Therefore, Option C is correct.

The internal audit procedures manual documents policies and procedures for conducting audit engagements, including steps to follow when issues arise, such as disputes with management regarding findings. It ensures consistency and standardization of audit practice.
Option A (strategic plan) and Option C (resources) are not part of audit procedures but rather part of planning or organizational documents. Option D (authority to collect data) belongs in the internal audit charter, not in the procedures manual.
Therefore, the correct answer is appropriate response options for disputes with management (Option B).
Reference:
IIA Practice Guide - Developing the Internal Audit Manual.

Data mining focuses on discovering patterns, correlations, statistical relationships, clusters, trends, and profiles within large data sets. It is commonly used to identify unusual behavior, customer profiles, fraud indicators, exception patterns, and risk relationships that may not be obvious through manual review. Process mining is different; it analyzes event logs to understand how business processes actually flow. Process analysis evaluates process design, controls, bottlenecks, and efficiency. Data analysis is broader and may include summarization, filtering, testing, or reporting, but it does not specifically describe creating profiles from statistical relationships. Internal auditors use data mining when searching for hidden risk patterns, vendor anomalies, duplicate transactions, behavioral indicators, or unusual population characteristics.
Therefore, Option C is correct.

A risk and control questionnaire (RCQ) is used during preliminary surveys to help the auditor ascertain the existence of controls in a specific process or program. It provides structured information about which controls are in place, which are missing, and how they are applied.
Option A refers to reconciliation, which is not the main purpose. Option C (testimonial information) suggests reliance on management statements, which is weaker than structured control identification. Option D involves external confirmation, which goes beyond the RCQ's purpose.
Reference:
IIA Practice Guide - Engagement Planning: Preliminary Survey and Risk Assessment.