When an IS auditor uses generative AI with external RAG (retrieval-augmented generation) to gather evidence...

The GREATEST risk is that sensitive internal content may be embedded in AI prompts and sent to an external system (A), exposing confidential or regulated information. Retrieval-augmented generation often involves sending queries or embeddings to third-party APIs, creating a significant data leakage risk if internal context is included.

Option B deals with training-data leakage, which is notable but less immediate. Option C is irrelevant to the core risk. Option D concerns operational reliability, not security. In AAIA, protection of internal audit evidence and sensitive data is paramount, and the primary threat is external disclosure through prompts .