In light of well-publicized failures to maintain appropriate controls by the 'final four' audit firms, giving data to auditors without a clear and compelling business purpose is a bad idea. It's such a bad idea, even an auto body shop objects:
Auto body repair shops in British Columbia are complaining to the province's privacy commissioner about the public auto insurer requiring that the shops hand over customer credit card information in the course of routine audits.
The complaint, obtained by The Vancouver Sun, says the disclosure without written consent is "clearly unlawful."
"It's of concern to us," said Gerry Preddy, vice-president of the association. "We've had examples of files being lost [by ICBC]."
David Fraser, "BC auto body shops object to auto insurer's credit-card policy," quoting the Vancouver Sun.