A data privacy policy outlines how an organization collects, stores, processes, and protects personal data. It should comply with global data protection regulations such as GDPR, CCPA, and IIA guidelines on data security.
(1) Stipulations for deleting certain data after a specified period of time. # Correct. Many data protection laws (e.g., GDPR Article 5) require organizations to delete personal data after a defined retention period to reduce data breach risks.
(2) Guidance on acceptable methods for collecting personal data. #
Correct. A privacy policy must define legal and ethical ways to collect personal data (e.g., user consent, lawful processing).
(3) A requirement to retain personal data indefinitely to ensure a complete audit trail. # Incorrect. Retaining personal data indefinitely violates most data privacy regulations (e.g., GDPR Right to Be Forgotten). Data must be stored only for as long as necessary.
(4) A description of what constitutes appropriate use of personal data. # Correct. A privacy policy should clearly define how collected data can and cannot be used to prevent misuse and ensure compliance.
IIA GTAG - " Auditing Privacy Risks "
IIA Standard 2110 - Governance (Data Protection & Privacy)
GDPR (General Data Protection Regulation) - Articles 5 & 17 (Data Retention & Deletion) Analysis of Answer Choices:IIA References:Thus, the correct answer is C (1, 2, and 4 only) because data should not be retained indefinitely, and the policy must include data collection, retention, and appropriate usage guidelines.

The CAE must communicate the results of the quality assurance and improvement program (QAIP), including internal assessments, to senior management and the board at least annually. This ensures that oversight bodies remain informed about the internal audit activity's conformance with the Standards and opportunities for improvement.
Option A refers to external assessments, not internal quality reviews. Option C is too vague. Option D is incorrect, as validation is not required before reporting internal assessment results.
Reference:
IIA Standards - Standard 1320: Reporting on the Quality Assurance and Improvement Program.

If an organization does not establish a social media strategy, it is likely to react to events rather than proactively manage communication, brand reputation, customer engagement, compliance, and crisis response.
Option A is too restrictive because not every employee post must necessarily be vetted by a department.
Option B may occur in certain regulated contexts, but it is not the broad strategic risk described. Option C relates to internal communication and governance culture, not specifically social media strategy. Internal auditors reviewing social media governance should assess policies, ownership, approval processes, monitoring, escalation, employee guidance, legal compliance, and incident response. The key risk of lacking strategy is reactive and inconsistent use. Therefore, Option D is correct.

Understanding Data Recovery and Security Risks:
Data must be protected, recoverable, and accessible when needed while maintaining security.
The best practice is to store encrypted backups offsite while keeping encryption keys separate but accessible.
Why Option D is Correct?
Storing encrypted data offsite (a few hours away) ensures protection against disasters (e.g., fire, cyberattacks, physical damage).
Keeping encryption keys at the organization ensures that recovery is quick and controlled without risking unauthorized access.
This aligns with the IIA's IT Audit Practices and ISO 27001 (Information Security Management), which emphasize separate storage of encrypted data and encryption keys for security and recoverability.
IIA Standard 2110 - Governance requires internal auditors to assess whether IT governance ensures the availability and security of critical data.
Why Other Options Are Incorrect?
Option A (Encrypted physical copies and keys stored together at the organization):
If both data and keys are in the same location, a disaster or breach would make recovery impossible.
Option B (Encrypted copies and keys stored in separate locations far away):
While secure, if encryption keys are stored too far, recovery could be delayed, impacting business continuity.
Option C (Encrypted usage reports in a cloud database):
This does not ensure full data recovery; it only provides logs and structure changes, not the actual data.
Storing encrypted data offsite while keeping encryption keys accessible onsite follows best IT security and disaster recovery practices.
IIA Standard 2110 supports evaluating IT governance, including data security and recovery controls.
Final Justification:IIA References:
IPPF Standard 2110 - Governance
ISO 27001 - Information Security Management
NIST SP 800-34 - Contingency Planning Guide for IT Systems
COBIT Framework - Data Security & Recovery Controls

Data cleaning and normalization are essential steps in the data analytics process to ensure that data is accurate, complete, and useful for analysis. The primary purpose of these steps is to identify and correct anomalies, inconsistencies, and errors, making the data usable for decision-making.
(A) The auditor eliminated duplicate information. #
Incorrect. Removing duplicates is one part of data cleaning, but it does not encompass the full process of making data usable.
(B) The auditor organized data to minimize useless information. #
Incorrect. While organizing data helps improve efficiency, it does not necessarily involve error detection and correction, which is key to data cleaning.
(C) The auditor made data usable for a specific purpose by ensuring that anomalies were identified and corrected. # Correct. The primary goal of cleaning and normalizing data is to detect and fix anomalies (e.g., missing values, inconsistencies, formatting errors), ensuring that data is reliable for analysis.
IIA GTAG "Data Analytics: Elevating Internal Audit Performance" highlights that correcting data anomalies is a critical step in preparing data for effective use.
(D) The auditor ensured data fields were consistent and that data could be used for a specific purpose. # Incorrect. While consistency in data fields is part of normalization, it does not fully address the broader purpose of identifying and fixing errors.
IIA GTAG - "Data Analytics: Elevating Internal Audit Performance"
IIA Standard 2320 - Analysis and Evaluation
NIST Data Quality Framework - Data Cleaning and Normalization
Analysis of Answer Choices:IIA References:Thus, the correct answer is C, as data cleaning and normalization ensure that anomalies are detected and corrected, making the data usable for a specific purpose