Which of the following is an IS auditor's MOST important course of action when determining whether source data should be entered into approved…

The fundamental principle of any audit is the reliance on sufficient, reliable, and relevant evidence. Before an IS auditor considers using any analytical tool, including generative AI, their primary and most critical responsibility is to ascertain the reliability of the source data itself. This aligns with the "Garbage In, Garbage Out" (GIGO) principle. If the input data is unreliable, any output generated by the AI tool will be inherently flawed, rendering the audit conclusions invalid. Therefore, validating the reliability of the information is the foundational prerequisite.

A. Validate that the tool is leveraging the latest model: While a newer model may offer improvements, it is not the most critical factor. An older, well-vetted model might be more appropriate than the "latest" unproven one.

B. Validate that the tool provides a privacy notice: A privacy notice is a legal disclosure of intended data handling practices, not a guarantee of security or, more importantly, a measure of the source data's reliability.

C. Determine whether any AI model hallucinations have occurred: Assessing the reliability of the AI's output (i.e., checking for hallucinations) is a crucial step, but it is secondary to first ensuring the reliability of the input data.

1. ISACA. (2023). Artificial Intelligence Auditing Framework: A Primer for Auditors. In the section "AI Risk Domains

" the framework identifies "Data" as a key domain. It emphasizes the need to "Verify that the data used by the AI system is accurate

complete

timely

and relevant for its intended purpose

" establishing data reliability as a primary audit concern.

2. ISACA. (2023). Auditing Artificial Intelligence White Paper. Page 11

under "Data Governance and Management

" states

"The quality of the data used to train and operate AI systems is paramount. Auditors must assess the processes for data collection

cleaning

labeling and management to ensure data are accurate

complete and relevant." This highlights that data quality precedes tool usage.

3. Sajid

M.

& Ali

M. (2023). Auditing in the Age of AI: Challenges

Opportunities

and the Role of the Auditor. International Journal of Auditing and Accounting Studies. This type of academic literature consistently reinforces that the principles of auditing

such as the evaluation of the quality and reliability of audit evidence

remain paramount regardless of the technology used. The GIGO principle is a central theme when discussing AI in auditing. (Conceptual reference

as specific page numbers vary).