MENU
The internal audit department of a large global organization is evaluating the use of an AI-based voice-to-speech tool to document interviews during audits. The tool uploads all recordings to a cloud service provider for transcription. Which of the following is the GREATEST risk?
Audit interviews often contain highly sensitive, proprietary, or even non-public information. Uploading these recordings to a cloud provider introduces the 'Risk of unauthorized access' by the vendor's employees or through a security breach at the vendor's site. According to ISACA, the loss of 'Confidentiality' over audit workpapers is a critical failure of professional standards. While inaccurate transcriptions (Option D) are a nuisance, they can be corrected by the auditor; however, once sensitive data is compromised by a third party, the damage is irreversible. Auditors must ensure the vendor has rigorous 'encryption' and 'at-rest' security attestations.