How should auditors handle confidential data in AI tools?

A good answer starts with data classification and tool approval. Internal audit should know what data is restricted, which tools are approved, whether inputs or outputs are retained, who can access them, and whether the data can be used for model training.

Auditors should avoid entering personal information, credentials, trade secrets, investigation details, legal advice, sensitive findings, or client-identifying information unless policy explicitly permits the tool and use case. Even then, the workpaper should document how sensitive inputs were protected.

The exam trap is to focus only on productivity. Faster drafting is not a control objective if it exposes restricted data or creates unsupported conclusions. The better answer balances efficiency with confidentiality, evidence traceability, and review.