The situation describes a scenario where a customer's personal information was shared with third parties without explicit consent, leading to unsolicited offers. This indicates a control weakness in data privacy and confidentiality, specifically the undue disclosure of information to external parties.

(A) Incorrect – Excessive collecting of information.

While collecting too much personal data can be a privacy concern, the issue here is not about data collection but how the data was shared.

(B) Incorrect – Application of social engineering.

Social engineering refers to deceptive tactics used to manipulate individuals into disclosing confidential information, which is not the case here.

(C) Incorrect – Retention of incomplete information.

The issue is not about missing or incomplete data but rather unauthorized sharing of data.

(D) Correct – Undue disclosure of information.

The retailer improperly shared the customer's personal data with other businesses, leading to unsolicited offers.

This represents a failure to comply with data privacy regulations (e.g., GDPR, CCPA).

IIA’s GTAG (Global Technology Audit Guide) – Data Privacy Risks and Controls

Highlights the risks associated with unauthorized data sharing.

NIST Cybersecurity Framework – Data Protection and Privacy

Emphasizes the importance of controlling access to customer information.

COSO’s ERM Framework – Information Governance and Compliance

Discusses the importance of data protection policies to prevent undue disclosure

Analysis of Answer Choices:IIA References and Internal Auditing Standards: