IIA Updated IIA-CIA-Part2 Exam Questions and Answers by ziggy

When an internal auditor discovers an issue such as a programming error allowing multiple accounts for a single address, the auditor should ensure that the corrective actions are both adequate and effective. This includes scheduling a follow-up review (1) to verify that the program has been corrected and that the accounts have been consolidated. Additionally, evaluating the adequacy and effectiveness of the corrective action proposed by management (2) is essential to ensure the issue has been resolved properly. References: = IIA Standard 2500 - Monitoring Progress and IIA Standard 2320 - Analysis and Evaluation.

While aligning organizational activities to internal audit activities and measuring according to approved IAA performance measures is important, it adds the least direct value to achieving the IAA ' s objectives compared to the other strategies. Establishing periodic reviews, using engagement results to guide future activities, and ensuring the format and frequency of IAA reporting align with the organization ' s governance structure are all more directly impactful strategies. References: = IIA Standard 1300 - Quality Assurance and Improvement Program and IIA Standard 1320 - Reporting on the Quality Assurance and Improvement Program.

 CSR Policy Development: In developing a Corporate Social Responsibility (CSR) policy, it is important that the principles of CSR are communicated and understood throughout the organization.

 Integration into Decision-Making: Management’s responsibility includes ensuring that CSR principles are not only communicated but also integrated into the organization ' s decision-making processes at all levels. This ensures that CSR is part of the organizational culture and operational strategies.

 Board’s Role: While the board has a role in overseeing and ensuring that CSR objectives are established and risks are managed, the day-to-day responsibility for integrating CSR into business operations lies with management.

 IIA Guidance: According to IIA guidance, internal auditors should evaluate the design, implementation, and effectiveness of the organization’s ethics-related objectives, programs, and activities, which include CSR initiatives (Standard 2110 - Governance).

 References:

Effective communication and integration of CSR principles ensure that the organization operates in a socially responsible manner, aligning its business practices with societal expectations and contributing to sustainable development​​​​.

Comprehensive and Detailed Explanation:

Data privacy principles — particularly under GDPR and similar frameworks — emphasize data minimization, purpose limitation, and lawful processing. Once a customer closes an account and the statutory retention period ends, the organization should destroy personal information (A) to prevent misuse. Sharing data with affiliates (B) without explicit consent violates purpose limitation. Retaining data for convenience (C) is not legally justified. Using personal information for external research (D) is only valid if explicit consent was granted, but this is not described. Thus, the correct approach is Option A — delete data when it is no longer needed or legally required, ensuring compliance with privacy laws.