In an assurance engagement involving smart devices, the first step is to obtain a comprehensive inventory of all devices in use. This ensures that the audit covers all relevant assets and allows the internal auditor to assess risks, controls, and policies effectively.
(A) Incorrect - Train all employees on bring-your-own-device (BYOD) policies.
While employee training is important, it is a control measure rather than the first step in an assurance engagement.
Without an inventory of devices, training effectiveness cannot be assessed.
(B) Incorrect - Understand what procedures are in place for locking lost devices.
This is a specific control measure but not the starting point for an engagement.
The first step should be to identify what devices exist before evaluating security measures.
(C) Correct - Obtain a list of all smart devices in use.
The foundation of an assurance engagement is identifying the scope, which includes listing all smart devices in use.
This allows the auditor to evaluate security risks, compliance, and control measures effectively.
(D) Incorrect - Test encryption of all smart devices.
Testing encryption is an audit procedure that should be performed after understanding the inventory and existing controls.
Without knowing which devices exist, encryption testing would not be effective.
IIA's Global Internal Audit Standards - Technology Assurance and Cybersecurity Audits Outlines steps for conducting technology-related assurance engagements.
IIA's GTAG (Global Technology Audit Guide) on Auditing Smart Devices
Recommends obtaining an inventory of devices as the first step in an audit.
COBIT Framework - IT Asset Management and Control
Emphasizes identifying assets as the foundation of IT governance and risk management.
Analysis of Answer Choices:IIA References and Internal Auditing Standards:

The retention and maintenance of internal audit engagement records, including the period of time they must be kept, is governed by the internal audit activity's policies and procedures. These policies provide guidance on record retention consistent with organizational requirements, legal and regulatory obligations, and professional standards.
The charter (Option A) defines purpose, authority, and responsibility but does not detail document retention.
The annual plan (Option B) outlines engagements but not recordkeeping. The quality assurance and improvement program (Option D) addresses continuous improvement and compliance with standards, not retention guidelines.
Therefore, the correct source for document retention requirements is internal audit policies (Option C).
Reference:
IIA Standards - Standard 2330: Documenting Information; Implementation Guide 2330.

A virtual private network is best for employees who need to authenticate and access organizational IT resources from outside the organization. A VPN creates an encrypted tunnel over a public or external network, allowing remote users to connect securely to internal resources. A local area network is limited to a specific physical site, such as an office. A wide area network connects geographically separated locations, but it is not specifically a secure remote-access mechanism for individual users. A metropolitan area network covers a city or metropolitan region. Internal auditors reviewing remote access should evaluate VPN authentication, encryption, logging, endpoint compliance, session timeout, access rights, and monitoring.
Therefore, Option D is correct.

Reference: IIA Business Knowledge for Internal Auditing, IT Controls and Monitoring section.

During an audit of IT change management, the internal auditor should validate whether only authorized personnel can migrate changes into production. This directly tests segregation of duties, authorization, and production environment protection. Option B may be relevant in a patch management review, but it is narrower and not the most direct change management audit action. Option C is a management activity, not an internal audit responsibility. Option D is also management's responsibility because internal audit should not update operating processes it may later audit. Effective change management requires proper request approval, testing, migration control, emergency change review, and post-implementation monitoring. Therefore, Option A is correct.