Which of the following would present the most critical external risk to an organization?

Which of the following is not relevant when developing recommendations for inclusion in audit reports?

During a payroll audit of a large organization, an internal auditor noted that the assistant personnel director is responsible for many aspects of the computerized payroll system, including adding new employees in the system; entering direct-deposit information for employees; approving and entering all payroll changes; and providing training for system users. After discussions with the director of personnel, the auditor concluded that the director was not comfortable dealing with information technology issues and felt obliged to support all actions taken by the assistant director. The auditor should:

The chief audit executive established an internal audit activity (IAA) performance standard requiring all audit reports to be issued within 48 hours of the exit meeting with the client. Which of the following describes an exit meeting strategy that would best help the IAA meet this performance standard?

Which of the following items should be addressed in an organization's privacy statement?
I.
Intended use of collected information.
II.
Data storage and security.
III.
Network/infrastructure authentication controls.
IV.
Data retention policy of the organization.
Parties authorized to access information.