The first step in an audit is identifying where sensitive data is stored, such as databases of customer records or employee personnel files. Decide whether to look at all data or zero in on especially sensitive information such as Social Security numbers, drivers licenses, or credit card information.