Auditors work with privileged information in order to provide assurances to third-parties that the audited entity is operating in a legitimate way. Sometimes they receive a sampling of data to spot-check things, while other times their review necessitates more-broad access. Both of these approaches necessitate some level of access to what would otherwise be considered confidential information, but audits are performed with the understanding that the firm conducting the audit has as-much to lose by compromising the data privacy of a client as the client. It makes no sense for a reputable auditor to expose the information they're analyzing because it would destroy their firm's reputation, and put them out of business.