Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Digital Auditing & Assurance

CA Priya's firm plans to use a third-party AI tool, hosted overseas, to analyse client ledger data of Lotus Foods Ltd for anomaly detection. The engagement letter does not mention this. Under the Code of Ethics, which action is most appropriate?

Priya should assess the tool's security and the legal and data-protection position, and obtain client consent or revise engagement terms before uploading data. Confidentiality does not ban technology, but client information cannot be sent to external tools without adequate safeguards.

  1. AUpload the data since the firm owns the working papers
  2. BEnsure confidentiality is safeguarded, consider client consent and applicable data-protection and legal requirements, and assess the tool's security before uploading client dataCorrect
  3. CUpload only the data after removing the auditor's name
  4. DAvoid all technology because confidentiality prevents any tool use

Explanation

The duty of confidentiality extends to data processed by third-party tools. The firm should evaluate the tool's security and the legal position on data transfer, and obtain client consent or amend the engagement terms where needed. Blanket avoidance of technology is not required, and merely removing the auditor's name does not protect client data.

Did you get it right without looking?

One question tells you little. A timed set on Digital Auditing & Assurance shows your real accuracy, how long you take and where you lose marks.

Practise Digital Auditing & AssuranceFree diagnostic mock

More Digital Auditing & Assurance questions