Question
When establishing physical and logical security protocols for internal audit workpapers and data repositories under US privacy laws (e.g., GLBA or HIPAA), what legal doctrine or operational principle dictates the access restrictions applied to internal auditors who are not assigned to that specific sensitive engagement?
Tap card to flipAnswer
The operational principle is the "Principle of Least Privilege" (or the Need-to-Know basis), underpinned by the regulatory mandates of safeguarding non-public personal information (NPI). Even within the internal audit function, workpapers containing highly confidential regulatory data must be logically segregated. Auditors not assigned to the specific engagement must be restricted from accessing those directories to mitigate the risk of unauthorized data exposure and to maintain compliance with stringent US data privacy laws.
Tap card to flip back