The internal audit team determines a software application is no longer in scope for external reporting requirements. Which of the following will confirm that the application is no longer applicable?

Question

Options

• AData inventory and retention
• BRight to be forgotten
• CDue care and due diligence
• DAcknowledgement and attestation

• A
  83% (43)
• B
  10% (5)
• C
  2% (1)
• D
  6% (3)

Explanation

Option A is correct because a data inventory and retention policy documents exactly what data an application processes, stores, or transmits - making it the authoritative record for determining regulatory scope. If the inventory confirms the application no longer handles the relevant data types (e.g., PII, financial records), that evidence directly validates its removal from external reporting requirements like SOX or GDPR audits.

Option B (Right to be forgotten) is a GDPR mechanism allowing individuals to request deletion of their personal data - it governs what happens to data, not whether an application is in regulatory scope. Option C (Due care and due diligence) describes general standards of professional conduct and reasonable precaution - guiding principles, not documentation artifacts that confirm scope. Option D (Acknowledgement and attestation) involves signing off to certify something was reviewed, but attestation alone doesn't establish what data an application handles or prove it's out of scope.

Memory tip: Think "inventory = evidence." Just as a warehouse inventory tells you what's on the shelf, a data inventory tells you what regulated data an application touches - if the regulated data isn't listed, the application isn't in scope.

No community discussion yet for this question.