A decentralized structure distributes decision-making authority across different business units, divisions, or geographical locations. While decentralization provides flexibility and autonomy, the primary risk is inconsistency in decision-making, as different units may develop their own policies, processes, and priorities that are not aligned with the organization ' s strategic goals.
(A) Inability to adapt.
Incorrect. Decentralization typically enhances adaptability, as individual units can quickly respond to local market conditions, customer needs, and emerging risks without waiting for corporate approval.
(B) Greater costs of control function.
Partially correct but not the primary risk. While decentralization may increase oversight costs (e.g., more auditors and compliance personnel), the primary issue is lack of uniform decision-making rather than costs alone.
(C) Inconsistency in decision making. #
Correct. When decision-making authority is spread across various units, inconsistencies arise in areas such as risk management, compliance, operational procedures, and resource allocation. This can lead to conflicts, inefficiencies, and misalignment with corporate strategy.
IIA Standard 2120 - Risk Management emphasizes the need for consistent risk oversight in all business units.
IIA GTAG " Auditing the Control Environment " warns that inconsistent policies weaken internal controls and governance.
(D) Lack of resilience.
Incorrect. A decentralized structure often improves resilience because decision-making is spread out, reducing dependency on a central authority. This allows units to function independently if one area experiences disruption.
IIA Standard 2120 - Risk Management
IIA GTAG - " Auditing the Control Environment "
COSO Framework - Internal Control Principles
Analysis of Answer Choices:IIA References:Thus, the correct answer is C, as decentralization introduces decision-making inconsistencies, affecting governance and strategic alignment.

Comprehensive and Detailed In-Depth Explanation:
In data analytics, data cleaning involves identifying and correcting errors, inconsistencies, and redundancies in the dataset to ensure accuracy and reliability. By eliminating duplicate or irrelevant data, the internal auditor enhances the quality of the dataset, which is crucial for accurate analysis and risk assessment. This process is a preparatory step before analyzing the data to identify high-risk areas. Normalization (option A) refers to organizing data to reduce redundancy but is more specific to database design. Analyzing data (option B) and reviewing data prior to defining the question (option D) are steps that occur before and after data cleaning, respectively.

The discussion between the internal auditor and the database administrator is most likely centered around the security risk present in the period between account creation and password change. When a system generates a default password such as "123456," it introduces a temporary vulnerability until the user changes it.
Understanding Default Password Security Risks:
Default passwords, especially predictable ones (e.g., "123456"), pose a security threat because they are easy to guess.
If an unauthorized user gains access before the legitimate user changes the password, data confidentiality and integrity may be compromised (IIA GTAG - Global Technology Audit Guide).
Evaluating the Window of Exposure:
The primary concern is the time between account creation and password reset.
During this time, an attacker could exploit the default password to gain unauthorized access to sensitive systems.
Why Other Options Are Less Relevant:
Option A (Replacing numbers with characters) - While this improves security, it does not directly address the risk of an attacker exploiting the default password before the user resets it.
Option B (Users continuing to use the initial password) - This is a security issue, but it is mitigated by requiring a password reset upon first login. The primary concern is the time before the reset happens.
Option D (User training on password management) - While training is crucial for long-term security, it does not directly address the immediate vulnerability of default passwords before they are changed.
IIA Global Technology Audit Guide (GTAG) 16: Data Management and Security IIA Standard 2110 - Governance: Recommends addressing IT security risks, including credential management.
IIA Practice Advisory 2130.A1-1: Internal auditors should assess whether management has identified, assessed, and mitigated IT security risks, such as weak authentication practices.
Step-by-Step Analysis:Relevant IIA References:

Self-actualization needs involve personal growth, realizing potential, mastery, creativity, achievement, and meaningful challenge. Assigning the auditor to complex and challenging audits is the best motivator because it allows professional development, judgment, problem-solving, and higher-level contribution. Rotating the auditor to a multidisciplinary team may provide variety, but it is not as directly tied to self-actualization. Job security addresses safety needs, which are lower in Maslow's hierarchy. Increased benefits address compensation and security needs rather than growth and fulfillment. Internal audit leaders should align assignments with staff motivation, competence, and development goals to improve performance and retention.
Since complex audit work best supports self-actualization, Option B is correct.

Remote wipe is a security feature used in mobile device management (MDM) that allows an organization to erase data from a device remotely. This is critical in cases where a device is lost, stolen, or compromised, ensuring that sensitive corporate data is protected.
(A) It can restore default settings and lock encrypted data when necessary.
Partially correct but not the best answer. Remote wipe does erase data but does not necessarily lock encrypted data unless additional security features are enabled.
(B) It enables the erasure and reformatting of secure digital (SD) cards.
Incorrect. Many remote wipe solutions do not erase external SD cards due to hardware limitations. Users often need separate encryption for SD card data.
(C) It can delete data backed up to a desktop for complete protection if required.
Incorrect. Remote wipe only affects the device itself; it cannot erase backups stored on a desktop or local drives.
(D) It can wipe data that is backed up via cloud computing. #
Correct. Many MDM solutions offer the ability to remove access to corporate cloud data, revoke credentials, and remotely erase cloud-stored business files (such as OneDrive, Google Drive, or iCloud backups).
IIA GTAG " Auditing Cybersecurity Risk " emphasizes the importance of managing remote access and cloud- based data protection.
IIA GTAG - " Auditing Cybersecurity Risk "
IIA Practice Guide - " Assessing Mobile Device Security "
IIA Standard 2110 - Governance (IT security controls)
Analysis of Answer Choices:IIA References:Thus, the correct answer is D, as modern remote wipe features allow organizations to remove data from cloud backups, reducing data leakage risks.