The situation describes a scenario where a customer's personal information was shared with third parties without explicit consent, leading to unsolicited offers. This indicates a control weakness in data privacy and confidentiality, specifically the undue disclosure of information to external parties.
* (A) Incorrect - Excessive collecting of information.
* While collecting too much personal data can be a privacy concern, the issue here is not about data collection but how the data was shared.
* (B) Incorrect - Application of social engineering.
* Social engineering refers to deceptive tactics used to manipulate individuals into disclosing confidential information, which is not the case here.
* (C) Incorrect - Retention of incomplete information.
* The issue is not about missing or incomplete data but rather unauthorized sharing of data.
* (D) Correct - Undue disclosure of information.
* The retailer improperly shared the customer's personal data with other businesses, leading to unsolicited offers.
* This represents a failure to comply with data privacy regulations (e.g., GDPR, CCPA).
* IIA's GTAG (Global Technology Audit Guide) - Data Privacy Risks and Controls
* Highlights the risks associated with unauthorized data sharing.
* NIST Cybersecurity Framework - Data Protection and Privacy
* Emphasizes the importance of controlling access to customer information.
* COSO's ERM Framework - Information Governance and Compliance
* Discusses the importance of data protection policies to prevent undue disclosure Analysis of Answer Choices:IIA References and Internal Auditing Standards: