An IS auditor uses an internally developed generative AI tool to prepare a status update for audit stakeholders. Which of the following is the auditor's MOST appropriate course of action?

Question

Options

• ACompare results with a publicly available generative AI tool to ensure outputs are similar.
• BAssess whether the information provided is complete and accurate.
• CRegenerate the results to ensure similar outputs are provided.
• DShare and review the results with management.

• A
  5% (2)
• B
  70% (30)
• C
  9% (4)
• D
  16% (7)

Explanation

When using any AI tool - including an internally developed one - to generate content for official use, the auditor must verify that the output is complete and accurate before sharing it. Generative AI can hallucinate, omit details, or misrepresent information. Professional due diligence requires the auditor to critically review and validate AI-generated content. Comparing with a public AI tool (A) does not validate accuracy and introduces data confidentiality risks. Regenerating results (C) is not a quality control method - identical regeneration is not guaranteed. Sharing directly with management (D) without first validating the content bypasses the auditor's responsibility for the accuracy of their work product.

No community discussion yet for this question.