AI-Enabled Audit Work: A Claim-to-Evidence Review Method

Anchor work to the audit objective

Write the assertion or control objective, relevant period, population, risk, materiality context, planned procedure, evidence criteria, and responsible reviewer. Do this before asking AI to summarize a file set. Otherwise the tool may organize information fluently without addressing the actual objective.

PCAOB AS 1105 defines audit evidence and distinguishes sufficiency, which concerns quantity, from appropriateness, which concerns relevance and reliability (PCAOB AS 1105). More generated analysis cannot compensate for poor-quality evidence. Applicable professional standards and engagement methodology remain controlling.

Sources: [1]

Create a claim-evidence register

For every material draft statement, record claim ID, assertion, source, source owner, date, original location, transformation, supporting evidence, contradictory evidence, reliability consideration, reviewer, and disposition. Link to the controlled source rather than relying on text copied into a model conversation.

When using company-produced data, test the accuracy and completeness relevant to the procedure or evaluate the controls over that information as required by the applicable standard. The GAO data-reliability guide similarly offers a risk-based approach centered on accuracy, completeness, and applicability for the intended purpose (GAO data reliability). These sources guide the evidence questions; they do not validate a specific AI workflow.

Sources: [2]

Worked example: expense-population exception review

Imagine a synthetic audit team analyzing a twelve-month expense export. An AI assistant groups descriptions and flags unusual transactions. The audit objective concerns authorization and classification, not whether the descriptions look unusual.

The team reconciles the export total and row count to the controlled ledger report, documents filters, and selects items using the approved procedure. One flagged item is a large software renewal. The source packet contains invoice, purchase approval, contract term, payment record, and classification. The assistant’s category is recorded as a lead, not evidence. The auditor inspects the underlying records and documents the conclusion.

Another item was not flagged because its description resembled routine travel, yet its amount exceeded the threshold. A deterministic test catches it. The exception log shows why model-assisted clustering cannot replace completeness-oriented procedures. Contradictory evidence remains attached even when the final disposition is no exception.

Verify transformations and generated text

Reperform material filters, joins, calculations, and classifications using an independent method. Test known-answer cases and boundary values. Compare the generated summary with the claim-evidence register. Search for omitted exceptions, unsupported causation, altered dates, and invented source details. Record model and workflow version when relevant to reproducibility.

Keep prompts only when permitted and useful to understand a material transformation. Do not retain unnecessary client information. Apply engagement-specific access, confidentiality, retention, and approved-tool rules.

Review the human decision path

The workpaper should identify who designed the procedure, who operated the tool, who investigated exceptions, who reviewed evidence, and who approved the conclusion. A reviewer should be able to distinguish automated suggestions, auditor observations, professional judgments, and unresolved limitations.

If a source is unavailable or a transformation cannot be reproduced, report the limitation and reconsider the procedure. Do not infer evidence from the quality of the prose.

Maintain an AI-use disposition log

For each proposed use, record the audit objective, permitted information class, tool and configuration, expected assistance, prohibited action, reviewer, evidence retained, and disposition. Distinguish approved, restricted, pilot-only, and held uses. Revisit the disposition after a material tool, policy, engagement, or data-flow change. A summarization use may be acceptable for one controlled document set while inappropriate for another containing restricted information. The log supports consistent routing; it does not replace engagement acceptance, independence, confidentiality, supervision, consultation, or other professional requirements.

Boundary

This page is educational guidance about reviewable AI-assisted audit work. It does not set an audit procedure, determine sample sufficiency, establish control effectiveness, replace professional standards, or conclude that a particular use complies with law, regulation, firm policy, or an engagement’s requirements.