Recovery Point Objective (RPO) Defined:
RPO is the maximum amount of data loss an organization can tolerate before it significantly impacts business operations.
It determines how frequently backups should be performed to minimize data loss in the event of a system failure, cyberattack, or disaster.
For example: If an organization has an RPO of 4 hours, backups must be performed at least every 4 hours to ensure minimal data loss.
IIA GTAG on Business Continuity Management states that RPO should align with business risk tolerance and data criticality.
A). The maximum tolerable downtime after the occurrence of an incident. (Incorrect) This defines the Recovery Time Objective (RTO), which refers to the time needed to restore operations.
RPO relates to data loss, not downtime.
C). The maximum tolerable risk related to the occurrence of an incident. (Incorrect) Risk tolerance is a separate concept related to risk management strategies, not data recovery.
D). The minimum recovery resources needed after the occurrence of an incident. (Incorrect) This refers to disaster recovery planning and resource allocation, not the specific metric of data loss tolerance.
Explanation of Incorrect Answers:Conclusion:The Recovery Point Objective (RPO) measures the maximum allowable data loss (Option B) before it significantly affects business continuity.
IIA References:
IIA GTAG - Business Continuity Management
IIA Standard 2120 - Risk Management

When examining risk management, internal audit must evaluate risk exposures relating to governance, operations, and information systems. Governance risks concern oversight, ethics, accountability, and decision- making. Operational risks concern efficiency, effectiveness, asset protection, and achievement of business objectives. Information systems risks concern confidentiality, integrity, availability, reliability, and security of information. Organizational structure may influence risk ownership and control accountability, but it is not listed here as one of the main required exposure categories in the same way as governance, operations, and information systems. Internal audit planning should therefore assess whether key risk exposures across governance, operations, and technology are identified, assessed, and managed within risk appetite. The correct combination is items 1, 2, and 3 only. Therefore, Option C is correct.

The auditor likely omitted the data normalization step, which is crucial when integrating multiple datasets from different sources (e.g., human resources (HR) and payroll). Without normalization, inconsistencies in formatting, naming conventions, or unique identifiers (e.g., employee ID vs. full name) can result in incorrect mismatches.
Standardization of Data Formats:
Employee names or IDs may be stored differently across systems (e.g., " John A. Doe " in HR vs. " Doe, John
" in payroll).
Normalization ensures uniform formatting to enable accurate comparisons.
Removal of Duplicates & Inconsistencies:
Employee records could have multiple variations due to typos, abbreviations, or missing fields.
Proper cleaning and transformation of data ensures better accuracy.
Use of Unique Identifiers:
Instead of matching by name, the auditor should have used a unique identifier (e.g., Employee ID), which remains constant across systems.
A). Data analysis (Incorrect)
Reason: The auditor did attempt data analysis (matching employee records) but without proper preparation (normalization), the results were flawed.
B). Data diagnostics (Incorrect)
Reason: Data diagnostics refers to evaluating data quality issues, but it does not involve transforming data to a common format, which was the missing step.
C). Data velocity (Incorrect)
Reason: Data velocity relates to the speed at which data is processed, which is not relevant to the issue of incorrect matching.
IIA Global Technology Audit Guide (GTAG) 16: Data Analysis Technologies - Covers data quality, normalization, and audit data preparation.
IIA GTAG 3: Continuous Auditing - Discusses the importance of accurate data extraction and transformation.
IIA Standard 2320 - Analysis and Evaluation - Ensures appropriate data validation before concluding audit findings.
Why is Data Normalization Important?Analysis of Incorrect Answers:IIA References:Thus, the correct answer is D. Data normalization.

A material efficiency variance measures whether the quantity of material used for actual output differs from the standard quantity allowed for that output. It is affected by waste, spoilage, poor production practices, inferior materials, equipment problems, weak supervision, or rushed work. Cutbacks in preventive maintenance can cause machine inefficiency and material waste. Poorly trained or supervised labor can also increase material usage. Rush orders may disrupt normal processes and increase errors or waste. However, producing more units than planned affects volume, not efficiency. The variance compares actual material usage with standard usage for the actual number of units produced, so higher production alone does not explain an unfavorable material efficiency variance. Therefore, Option D is the exception and the correct answer.

Comprehensive and Detailed In-Depth Explanation:
Job rotation involves periodically moving employees between different tasks, roles, or departments to increase engagement, reduce boredom, and enhance skill development.
Option A (Job specification) - Defines job responsibilities but does not address boredom.
Option B (Job objectives) - Focuses on performance goals rather than task variety.
Option D (Job description) - Simply documents job roles without changing daily tasks.
Thus, job rotation (Option C) is the most effective strategy for overcoming monotony and job-related boredom.
Reference: IIA Human Resource Management - Employee Motivation Techniques