The internal audit department of a large global organization is evaluating the use of an...

Audit interviews often contain highly sensitive, proprietary, or even non-public information. Uploading these recordings to a cloud provider introduces the " Risk of unauthorized access " by the vendor ' s employees or through a security breach at the vendor ' s site. According to ISACA, the loss of " Confidentiality " over audit workpapers is a critical failure of professional standards. While inaccurate transcriptions (Option D) are a nuisance, they can be corrected by the auditor; however, once sensitive data is compromised by a third party, the damage is irreversible. Auditors must ensure the vendor has rigorous " encryption " and " at-rest " security attestations.