Workpapers and AI confidentiality: what a review note gives away in ChatGPT or Claude.

Workpapers are where an accounting firm thinks out loud. A review note records what the ledger shows, what the reviewer could not explain, and what the client said when asked. That makes it the document with the most AI data leakage per line: pasted into ChatGPT or Claude to tidy up the wording, it carries the firm’s internal doubts about a client along with the client’s figures. This page marks every item a reviewer’s note exposes, and shows how the same note is drafted on Ermos inside the practice.

The workpaper review note

Written by the reviewing manager during year-end, for the partner and the preparer, before the file is signed off.

Review note, , FY2026 file
Reviewer: · Preparer: · 14 October 2026

  1. Bank reconciliation. Preparer to obtain written confirmation.
  2. Related-party loan. Raise with partner before client meeting.
  3. Journals.
  4. Payroll.
  5. Revenue.
  6. Client contact.

An invented review note. Hover or tap any highlighted item for the analysis; the full list is below.

What leaves the firm

  1. 1
    The client

    The entity under review, which turns everything below from an example into a disclosure. APES 110 confidentiality guide.

  2. 2
    An unexplained deposit

    A transaction the client could not document, with the client’s explanation. Confidential information acquired in the professional relationship under APES 110 R114.2, and the kind of detail that is damaging out of context. APES 110 confidentiality guide.

  3. 3
    A Division 7A exposure

    The firm’s preliminary view that the client faces a deemed dividend. The TPB Code requires reasonable care in advice; a preliminary view on a third party’s servers is neither advice nor confidential. TPB Code guide.

  4. 4
    Questionable deductions

    A journal the reviewer suspects reclassifies private spending. Details that could be read as alleging something about the client, before anyone has decided whether they do. APES 110 confidentiality guide.

  5. 5
    The reviewer’s own judgement

    “I am not comfortable with this.” Internal professional judgement, written for a partner and never meant for the client, now outside the firm. Checking AI output guide.

  6. 6
    A compliance failure

    Late superannuation, a charge statement, and a note that the client was warned before. A record of the client’s repeated non-compliance. TPB Code guide.

  7. 7
    A third company’s administration and a going-concern question

    Coastline Developments is nobody’s client here, and the going-concern doubt about Harbourline is the most market-sensitive sentence on the page. APES 110 confidentiality guide.

  8. 8
    Contact details and a family matter

    A personal phone number and the client’s mother’s aged care arrangements, including how they are funded. Two people’s personal information under the Privacy Act. Privacy Act guide.

  9. 9
    The reviewer and the graduate

    Names that tie the note to the people who wrote it. Under R113.2 of APES 110 the reviewer is responsible for the graduate’s supervision, and the note is evidence of how that was done. Checking AI output guide.

What happens in Frontier Models (ChatGPT, Claude)

  • The whole document is transmitted to the provider’s servers. On personal plans the user cannot choose where it is stored or processed, and for the major providers that has generally meant outside Australia, under that country’s legal process. Some business plans offer storage in Australia, but the provider still receives the content.
  • On consumer tiers, prompts can be retained and used to train future models.
  • The provider’s staff and systems can reach the content under the provider’s own policies.
  • Once sent, the firm no longer controls it. Retention and deletion happen on the provider’s terms.

The same document on Ermos

Ermos Dominion

The document is drafted on a unit in your office, from your own templates and the client file. Every marked item stays on the unit, which keeps working with the internet switched off. Nothing in it is transmitted to an AI provider, so there is no disclosure to analyse: the confidentiality work is the same as for your file server.

Ermos Edge

Your documents, the index and your access boundaries stay on your own instance in an Australian data centre. When a staff member asks for this draft, only their question and the excerpts they are permitted to see go to a named Australian provider, who is contractually barred from keeping the content or training any model on it. Nothing is processed outside Australia.

Frontier Models (ChatGPT, Claude)Ermos EdgeErmos Dominion
Where the document is processedProvider servers, generally offshore on personal plansYour instance in an Australian data centre; answers generated in AustraliaThe unit in your office
Who can read itProvider staff and systems, under policyYour staff, within the boundaries you set. The named Australian provider processes only permitted excerpts, under contract, and keeps nothingYour staff only
Is it keptOn the provider’s termsKept on your instance; the provider is barred from retaining itStays on the unit
Can it train a modelOn consumer tiers, yesNo, by contractOnly your own unit learns from it, on your hardware

Part of AI data leakage in accounting firms. See how this works in practice: Workpaper review on Ermos.

Common questions

Do ChatGPT and Claude learn from a workpaper review note?
That depends on the account the user is on. As at October 2026, whether a conversation on a personal plan (ChatGPT Free, Plus or Pro; Claude Free, Pro or Max) can be used to train the models depends on a setting each user controls. Business plans (ChatGPT Business and Enterprise, Claude Team and Enterprise) and the developer APIs sit under commercial terms, and OpenAI and Anthropic each say they do not train on that content by default (OpenAI, Anthropic). On either product, the thumbs up and thumbs down buttons can send a whole conversation back for training. The note is also sent to the AI company to be processed. This note carries an unexplained deposit, a questioned deduction and the reviewer's written doubt.
Can we use ChatGPT or Claude to tidy a workpaper review note if we remove the client's name?
No, since the note still describes one company without the client's name. Removing names rarely makes a document anonymous. Information stays personal information while the person is reasonably identifiable, and the OAIC warns that information can be at risk of re-identification even when it has been de-identified or anonymised. A director's loan that grew from $21,000 to $89,000 and a customer in administration since July still identify the file. The reviewer's and graduate's names tie it to its authors. The Office of the Australian Information Commissioner (OAIC) recommends in its guidance on commercially available AI products that organisations do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because of the significant and complex privacy risks.
Is it safe to use an AI note-taker or meeting recorder for a workpaper review note?
Not until the practice has read the tool's terms and settings. A recording of a review discussion holds more than the finished note, because it captures the reviewer's spoken doubts about the unexplained deposit and the Division 7A loan word for word. Before using one, the practice needs to ask the vendor where the recording and transcript are stored, whether they train a model and who can review them. The OAIC's guidance also tells organisations to review carefully the terms and settings that will apply to their use of any AI product.
How can an accounting practice use AI for a workpaper review note without sending it to ChatGPT or Claude?
Ermos is built so the document stays under your control. On the Dominion AI unit it is drafted inside your office and none of it is sent to an AI provider. On Ermos Edge your documents and index stay on your own instance in an Australian data centre, and only the question and the excerpts the user is permitted to see go to a named Australian provider that is contractually barred from keeping them or training any model on them. Ermos writes the first draft from the ledger and the client file, using the practice's own review note template. The reviewing manager checks every item and signs the note.
Why is a workpaper riskier than the financial statements?
The financial statements are what the firm has decided to say. The workpaper is what the firm is unsure about: unexplained items, suspected private spending, a going-concern doubt. Pasted into a frontier model, those doubts leave the firm before anyone has resolved them.
Does APES 110 say anything about internal notes?
Subsection 114 covers information acquired in the course of professional and business relationships, which includes what the firm learns while reviewing a file. R320.11 also requires a decision about whether using a technology's output is appropriate for the purpose, which applies to a reviewer using AI to write up findings.
How does an Ermos unit help with review notes?
The unit works from the file on your own network, so a reviewer can ask it to summarise reconciliation items or draft a note from the ledger, and the answer carries the excerpts it drew on. Nothing in the file or the note leaves the practice.

See Dominion answering from your own documents.

A demonstration takes 30 minutes, uses no client data, and comes with no obligation.

Book a demo
Keep reading
AI data leakage in accounting firms AI for accountants APES 110 and AI All professions