What Auditors and Commission Staff Will Ask About AI-Assisted Work
Most finance teams that use AI on recurring work have not yet been asked about it by an auditor, a lender, or commission staff. That will change, and the questions will not be about the technology. They will be the questions asked of any workpaper: what supports this number, who reviewed it, and can the work be reproduced.
If you can answer those for AI-assisted work the same way you answer them for a hand-built schedule, the conversation is short.
The Questions Don't Change
Expect some version of these four:
- What was the source data, and where did it come from?
- What was done to it?
- Who reviewed the result, and what did they check?
- Could someone else perform the same work and reach the same answer?
AI changes how step 2 is performed. It does not change what has to be shown.
The Support File: Four Items
| Item | What to keep | What it answers |
|---|---|---|
| Input | The exact extract or file provided, with date and source system | What was the source data? |
| Prompt, version, tool | The prompt as written, its version and date, and the tool and model used | What was done to it? |
| Original output | The agent's result, saved before any edits | What did the agent produce? |
| Review note | Reviewer, date, what was tied to what, what was changed | Who checked it, and how? |
The input. Save the file as it went in, not a reference to the report that produced it. A report re-run next month may reflect late postings or a changed export layout, and it will no longer match what the agent saw.
The prompt, version, and tool. If you maintain a prompt register, with a version, date, owner, and known-answer test for each prompt, this is a reference to the register entry. Add the tool and model name and the date of use. Providers update models, and the same wording can return different results afterward. The date lets you tell whether the prompt, the model, or the data changed.
The original output. This is the item most often skipped. If you open the agent's output and edit it in place, the only version that remains is your edited one. You can no longer show which numbers came from the agent and which came from you. Save the original, then make your changes in a copy and keep both.
The review note. See the next section.
Writing a Review Note That Means Something
A signature or initials show that someone looked. A review note shows what they looked at.
Compare two notes on the same workpaper:
- Weak: "Reviewed, agrees."
- Adequate: "Tied the six flagged items to subledger detail and the AP aging at 9/30. Four agree with the agent's explanation. Two reclassified: item 3 to account 232, item 5 to the project work order. Largest item (item 2) traced to the vendor invoice."
The second note tells an auditor what was tested and what changed. It also shows that the reviewer did not simply accept the agent's explanations, which is the point of the review.
Two practices make review notes stronger. Test at least the largest explained item against source documents, not only against other system data. And note anything the agent said it could not determine, along with how you resolved it.
Where Judgment Stays with You
An agent can narrow ninety line items to six. It does not know your posting calendar, your materiality thresholds, or the history behind an unusual vendor, and it will not decide which explanation is actually true.
That is why the review note matters. It is the record that a person made the judgment call, and it identifies who.
The same applies to anything going into a filing, a rate application, or a board packet. Preparer and reviewer sign-off belongs to people, and the support file should show that it happened.
Keeping the File Practical
The file does not need to be elaborate. One folder per workpaper per period, with consistent names:
- 01-input (the extract as pulled)
- 02-prompt-and-version (or a reference to the register entry, plus tool, model, and date)
- 03-output-original
- 04-output-final
- 05-review-note
A few points on handling:
- Retention. Follow your existing records retention policy for workpapers. If your policy doesn't address AI-assisted work, add it there rather than creating a separate schedule.
- Confidentiality. Know what data went into the tool. If you aren't sure whether your provider retains inputs, confirm that in writing for your plan before sending anything sensitive. See Establishing an AI Security Policy for the data classification side.
- Ask your auditor. Some auditors will want to see this file, some will ask only for the final workpaper. Ask early rather than assembling it after a request.
The added time is a few minutes per workpaper once the folder structure is in place.
A Reproducibility Test
The most useful check on whether the file is sufficient: could a staff accountant who wasn't involved pick up the folder, rerun the prompt on the saved input, and reach a result that ties?
Two cautions on how to apply this. AI output is not identical from run to run, so the test is whether the numbers and conclusions tie, not whether the wording matches. And if the model has been updated since the original run, expect differences and compare against the original output you saved. That is the reason the original output matters.
If the answer is yes, the file would stand up to a request. If the answer is no, find out which item is missing now rather than during fieldwork.
Bottom Line
AI-assisted work does not need a separate standard. It needs the same one: source data, what was done, who reviewed it, and whether it can be reproduced. Teams that keep those four items for each workpaper can answer the questions when they come, and they can tell which part of the process moved if a result looks off later.
Related Articles
