Question $1$

For what type of engagements is it good practice to put an Information Protection Plan in place?

Any engagement which involves KPMG managing, processing, storing or using information as part of the service provided for a third party.

An Information Protection Plan is not necessary for any type of KPMG engagement.

Any engagement where there is an agreement between KPMG and a third party.

$$ All high$-$risk engagements.