An organization has an established bring-your-own-device policy.

In a bring-your-own-device environment, employees use personally owned devices for work activities. The most relevant privacy risk is that employees may believe the organization can intrusively monitor personal information, location data, browsing activity, personal applications, photos, or communications on their devices. Option B is a confidentiality and intellectual property risk, not the best privacy risk. Option A is a patching and security compliance risk. Option D is a malware and information security risk. Internal audit should verify that BYOD policies clearly define monitoring scope, employee consent, data separation, remote wipe rights, privacy protections, and acceptable use. Privacy risk is strongest when personal and business data coexist on the same device and monitoring controls are not transparent.