Under what circumstances should internal auditors coordinate with forensic investigators during cybersecurity engagements?

• A. When incidents involve potential wrongdoing or legal proceedings; IA should preserve evidence, coordinate with forensics, and ensure independence in reporting.
• B. In all cyber incidents regardless of severity.
• C. Only for external data leaks with no legal implications.
• D. Never coordinate with forensics to maintain independence.

Answer: (A)