What Auditors Will Ask About Your Use of AI

As finance teams increasingly use AI in their work, auditors are increasingly interested in how AI is used — because the use of AI in producing the financial information the auditor examines has implications for the reliability of that information and the controls around it. An auditor examining a finance function that uses AI will want to understand how AI is used, what controls govern it, and how the finance team ensures the AI-assisted work is sound — so that the auditor can assess the implications for the audit. For a finance team using AI, understanding what auditors will ask about AI, and being prepared to answer, helps the team demonstrate that its AI use is controlled and its work sound. This guide addresses what auditors will ask about your use of AI, helping a finance team anticipate and prepare for the auditor’s questions, and understand the controls and practices that good answers reflect.

This guide is written for finance teams and professionals whose work is audited and who use AI. It covers why auditors are interested in AI use, what auditors are likely to ask, what good answers and practices look like, how to prepare for the auditor’s questions on AI, and how using AI well positions the team for the audit. It also sets out the auditing standards that drive the questions, what the Financial Reporting Council (FRC) has published on AI in audit, a checklist of documents to have ready, and answers to common questions. The aim is a practical understanding of what auditors will ask about AI and how to be prepared, so a finance team can demonstrate that its AI use is controlled and its work sound, which good AI practices, as covered throughout this Knowledge Centre, support.

Why Auditors Are Interested in AI Use

Auditors are interested in a finance team’s use of AI because it bears on the reliability of the financial information and the controls the auditor assesses. The audit examines the financial statements and the controls around them, forming a view on whether the statements are reliable, and where AI is used in producing the financial information — in the analysis, the preparation, the processes — the auditor wants to understand how, because AI use bears on how the information is produced and whether it is reliable. If AI contributes to the financial information, its use and the controls around it are relevant to the auditor’s assessment of that information.

Auditors are interested in AI use particularly because AI can produce plausible but wrong output, so the auditor wants to understand how the finance team ensures the AI-assisted work is nonetheless sound — the verification, the controls, the human oversight — because these determine whether the AI use undermines or maintains the reliability of the information. An auditor will want assurance that AI use is controlled and the resulting information reliable, not that AI is producing unverified output that flows into the financial statements. Understanding why auditors are interested in AI use — because it bears on the reliability of the information and the controls, and AI can be wrong — helps a finance team see what the auditor’s interest is about. The auditor’s interest is in the reliability of the AI-assisted information and the controls around the AI use, and understanding this is the basis for anticipating and answering their questions.

There is also a formal basis for the interest. UK statutory auditors work to the International Standards on Auditing (UK) issued by the FRC, and three of them do most of the work here. ISA (UK) 315 (Revised July 2020), effective for audits of periods beginning on or after 15 December 2021, requires the auditor to understand the entity’s information system and IT environment and the risks arising from its use of IT. ISA (UK) 500, Audit Evidence, requires the auditor to evaluate whether information produced by the entity is sufficiently reliable. And ISA (UK) 230 (Revised June 2016), Audit Documentation, governs how the auditor records the work. None of these standards mentions AI by name, but an AI tool that touches the numbers is part of the IT environment, its outputs are information produced by the entity, and the auditor has to document how they gained comfort over both.

What Auditors Are Likely to Ask

An auditor examining a finance function that uses AI is likely to ask a range of questions about the AI use, and understanding them helps a finance team prepare. The auditor is likely to ask how AI is used — what AI is used for in the finance function, in which processes and tasks — to understand the extent and nature of the AI use and where it touches the financial information. The auditor will want a clear picture of how AI features in the work that produces the information they examine.

The auditor is likely to ask what controls govern the AI use — how the AI use is controlled, what safeguards apply, whether there is a policy — to assess whether the AI use is controlled or uncontrolled. The auditor is likely to ask how the finance team ensures the AI-assisted work is sound — how AI’s output is verified, how errors are guarded against, how the human oversight works — because this determines whether the AI-assisted information is reliable. The auditor may ask about the specific AI-assisted work that touches the financial statements, how particular figures or analyses involving AI were produced and verified. And the auditor may ask about data and the tools used. Understanding what auditors are likely to ask — how AI is used, what controls govern it, how the work is ensured sound, the specifics touching the statements — helps a finance team anticipate the questions. These questions centre on the extent, control, and soundness of the AI use, and anticipating them is the basis for being prepared.

Questions driven by ISA (UK) 315: your IT environment and general IT controls

Under ISA (UK) 315 the auditor identifies the IT applications and other aspects of the IT environment that are subject to risks arising from the use of IT, and then the general IT controls (GITCs) that address those risks. GITCs are usually grouped into access management (who can use or change a system), program change management (how changes are authorised, tested and moved into use) and IT operations (how jobs run, how failures are spotted). An AI tool or automation that posts journals, matches transactions, drafts estimates or transforms data feeding the accounts is treated the same way as any other application. Expect questions such as:

• Which AI tools, models or automations are used in processes that affect the financial statements, and who owns each one?
• Who can access the tool, change its configuration, prompts or rules, and approve its outputs? Are those people different?
• How are changes to a model, prompt template, matching rule or bot authorised and tested before use? Is there a record?
• If the tool is supplied by a third party, what assurance do you have over it — for example a service organisation controls report — and what controls do you operate on your side?
• What happens when the tool fails or produces an unusual result? How would you know?

Questions driven by ISA (UK) 500: reliability of information you produce

Paragraph 9 of ISA (UK) 500 requires the auditor, when using information produced by the entity, to evaluate whether it is sufficiently reliable for their purposes, including, as necessary, obtaining evidence about its accuracy and completeness and evaluating whether it is sufficiently precise and detailed. Reports, reconciliations, analyses and schedules produced with AI assistance are information produced by the entity, so the auditor will want to know how you know they are accurate and complete:

• What source data went in, and how do you show nothing was dropped or duplicated? Are there control totals?
• Can you reproduce the output, or explain how it was reached, if the auditor reperforms it?
• For AI-drafted estimates, provisions or commentary in the annual report, who checked the figures and assumptions, and against what?

What Good Answers and Practices Look Like

Good answers to the auditor’s questions reflect good AI practices, and understanding what they look like helps a finance team both answer well and use AI well. A good answer on how AI is used describes a considered, controlled use of AI — AI used deliberately for suitable tasks, within clear bounds — rather than an uncontrolled, ad hoc use, reflecting the controlled AI use that good practice involves. A good answer on the controls describes real controls governing the AI use — a policy, defined safeguards, clear responsibilities — reflecting the governed AI use that a policy and safeguards provide.

A good answer on ensuring the work is sound describes genuine verification and oversight — AI’s output verified, particularly anything consequential; the human firmly in the loop; errors guarded against — reflecting the verification and human oversight that safe AI use requires. A good answer on the specifics describes how particular AI-assisted work was produced and verified, showing the AI use was controlled and the output verified for the actual work touching the statements. These good answers — controlled use, real controls, genuine verification and oversight, verified specifics — reflect the good AI practices covered throughout this Knowledge Centre, which is why using AI well positions a team to answer the auditor well. Understanding what good answers and practices look like helps a finance team see that good AI practice and good audit answers go together. Good answers reflect good practices, and using AI well — controlled, governed, verified, with human oversight — is what enables a finance team to answer the auditor’s questions on AI well.

Model governance

For most finance teams “model governance” does not mean data science. It means keeping an inventory of the AI tools and automations in use, recording what each one is for and which balances or disclosures it affects, naming an owner, and deciding the level of review each needs according to risk. A tool that drafts internal commentary sits at the low end; one that suggests accrual or provision amounts, or classifies transactions directly into the ledger, sits at the high end and needs stronger controls and more evidence.

Change control

AI tools change in two ways: you change them (new prompts, rules, mappings or configuration) and the vendor changes them (model updates). Good practice is to record your own changes with who made them, why, what was tested and who approved them, and to have a way of spotting when vendor updates alter behaviour — for example re-running a small set of known test cases after an update and comparing results. This mirrors the program change controls auditors already test under ISA (UK) 315.

Logs

Where a tool’s output feeds the accounts, keep enough of a trail to show what went in and what came out: system logs of automated postings, retained prompts and outputs for material AI-assisted work, run histories for bots and scheduled refreshes, and exception reports. The aim is not to keep everything forever, but to be able to answer “how was this number produced?” for anything material.

Human review evidence

“We always check it” is an assertion; a signed-off reconciliation, a reviewed working paper with tick marks, or an approval recorded in the workflow tool is evidence. Auditors look for review controls that are precise enough to catch a material error and evidenced each time they operate. Our guide to human-in-the-loop AI controls covers how to design those review points, and designing financial controls covers control design more generally.

How to Prepare for the Auditor’s Questions on AI

A finance team can prepare for the auditor’s questions on AI, and doing so positions the team to demonstrate its AI use is sound. Preparing means being able to describe the team’s AI use clearly — what AI is used for, in what processes — so the team can answer how AI is used, which requires knowing and being able to articulate the team’s AI use. Preparing means having and being able to point to the controls governing the AI use — the policy, the safeguards, the responsibilities — so the team can demonstrate the AI use is controlled, which requires having those controls in place, as covered in the guidance on AI usage policies for finance teams.

Preparing means being able to show how the AI-assisted work is ensured sound — the verification, the oversight — so the team can demonstrate the work is reliable, which requires actually verifying and overseeing the AI-assisted work. And preparing means being able to address the specifics — how particular AI-assisted work touching the statements was produced and verified — which requires keeping track of how such work was done. A finance team that prepares this way — able to describe the use, point to the controls, show the verification, address the specifics — is positioned to answer the auditor’s questions on AI and demonstrate its AI use is sound. Preparing for the auditor’s questions on AI is largely a matter of using AI well and being able to describe and evidence it, and doing so is how a finance team demonstrates to the auditor that its AI use is controlled and its work sound. Understanding how to prepare for the auditor’s questions on AI helps a finance team be ready. Preparing for the auditor’s questions, by using AI well and being able to describe and evidence it, is how a finance team positions itself for the audit of its AI-assisted work.

In practice, raise AI at the audit planning meeting rather than waiting for it to come up in fieldwork. Telling the audit team early which processes use AI or automation lets them plan their IT work, involve IT audit specialists if needed and agree what evidence they will want — which avoids late requests and fee surprises. Our guides on managing the year-end audit relationship and financial controller audit preparation cover the wider timetable, and using AI to prepare for the year-end audit covers using the tools for the preparation itself.

How Using AI Well Positions the Team for the Audit

Using AI well positions a finance team for the audit of its AI use, because good AI practice is what the auditor’s questions are looking for. A finance team that uses AI well — in a controlled, governed way, with verification and human oversight, protecting its data — has, by virtue of that good practice, the good answers to the auditor’s questions and the sound AI-assisted work the auditor wants to see. Good AI practice and readiness for the auditor’s questions are therefore closely aligned: the team that uses AI well is the team prepared for the audit of its AI use.

This means that the best preparation for the auditor’s questions on AI is to use AI well throughout — establishing the controlled use, the governance, the verification, and the oversight that good practice involves — because this produces both the sound AI-assisted work and the good answers the auditor seeks. A finance team focused on using AI well, as this Knowledge Centre’s guidance describes, is thereby positioning itself for the audit, rather than needing separate preparation. Conversely, a team using AI poorly — uncontrolled, unverified — will struggle to answer the auditor well, because the good answers reflect good practice it lacks. Understanding how using AI well positions the team for the audit — because good practice provides the sound work and good answers the auditor seeks — reinforces the value of using AI well. Using AI well is the best preparation for the audit of AI use, because it produces the controlled, verified, sound AI-assisted work that the auditor’s questions are looking for, and a finance team that uses AI well is thereby ready to demonstrate it to the auditor. This connects to the guidance on AI usage policies and human-in-the-loop AI controls, and to protecting the data you put into AI tools, covered in AI data security in finance and connecting AI to finance data safely.

Documenting AI Use for the Audit

A practical aspect of being prepared for the auditor’s questions on AI is documenting the AI use, because documentation helps the team demonstrate its controlled, verified AI use to the auditor. Documentation of the AI use — recording what AI is used for, the controls and policy governing it, and how AI-assisted work is verified — gives the team evidence to show the auditor, demonstrating that the AI use is controlled and the work verified, rather than relying on assertion alone. For AI-assisted work touching the financial statements, documentation of how it was produced and verified is particularly valuable, showing the auditor how the specific work was done and checked.

Good documentation of AI use aligns with good practice generally — a team that uses AI in a controlled, governed, verified way naturally has the policy, the records, and the evidence that document the use — so documenting AI use is largely a matter of maintaining the records that good AI practice produces. The documentation need not be burdensome, but having a clear record of the AI use, the controls, and the verification positions the team to demonstrate its AI use to the auditor with evidence. A finance team that documents its AI use is better placed to answer the auditor’s questions with evidence than one that must rely on assertion; documentation supports the demonstration that the AI use is sound. Understanding the value of documenting AI use for the audit helps a finance team prepare to demonstrate its AI use. Documenting the AI use, the controls, and the verification is a practical way to be prepared for the auditor’s questions, providing the evidence that supports good answers, and it aligns with the good AI practice that produces sound, auditable work.

It helps to know what the auditor has to record on their side. ISA (UK) 230 requires audit documentation sufficient to enable an experienced auditor, with no previous connection with the audit, to understand the nature, timing and extent of the procedures performed, the results and evidence obtained, and significant matters and the judgements made on them. If your AI-assisted process is undocumented, the auditor has to reconstruct it themselves to meet that standard — which takes time, raises questions and can lead to more substantive testing. Clear process notes, an inventory of tools and retained review evidence make that job easier and the audit smoother.

What the FRC Has Said About AI in Audit

The FRC’s AI publications are written for audit firms using AI in their own audit work, not for the companies being audited, but they show how the regulator is thinking and therefore the mindset your auditor brings. On 26 June 2025 the FRC published AI in audit: illustrative example and documentation guidance. It uses a hypothetical AI-enabled tool for journal procedures as its worked example, sets principles for proportionate documentation of AI tools, adopts a broad definition of AI covering machine learning, deep learning and generative AI, and addresses tools obtained from third parties. The FRC describes it as not prescriptive and says it introduces no new regulatory requirements. Its documentation guidance is aligned with the UK government’s five AI regulatory principles, and it stresses proportionality — avoiding over-documentation — with explainability expectations depending on context and how a tool is used.

On 30 March 2026 the FRC followed with guidance on generative and agentic AI, with a companion factsheet. It discusses the audit quality risks of generative and agentic AI tools, possible mitigations, and principles for exercising professional judgement when seeking appropriate confidence in those tools’ outputs, with illustrative examples for two use cases. For a finance team the read-across is straightforward: if auditors are expected to show how they gained confidence in AI outputs, they will expect the companies they audit to be able to do the same. The ICAEW also maintains resources on artificial intelligence for members in practice and business.

Checklist: Documents to Have Ready

Scale this to how much AI you actually use. A team using an AI assistant only for internal commentary needs little more than a policy and review evidence; a team with automated postings or AI-suggested estimates needs the full set.

Frequently Asked Questions

Do we have to tell our auditor we use AI?

The auditor is required to understand your information system and IT environment, so they will ask about the systems and tools used in financial reporting. Being open about AI use, ideally at planning, is in your interest: it lets the audit team plan properly and avoids late surprises.

Is using ChatGPT or Copilot for commentary an audit issue?

Usually only a minor one, provided the figures in the commentary are checked back to the accounts and the narrative in the annual report is reviewed like any other draft. The higher-risk uses are those where AI output directly changes the numbers — postings, classifications, estimates.

Which auditing standards apply to our AI use?

There is no AI-specific ISA (UK). The relevant requirements come mainly from ISA (UK) 315 (Revised July 2020) on understanding the IT environment and general IT controls, ISA (UK) 500 on the reliability of information produced by the entity, and ISA (UK) 230 on audit documentation.

Does the FRC guidance on AI apply to us?

Not directly. The FRC’s June 2025 and March 2026 guidance is aimed at auditors’ own use of AI. It is still worth reading, because it shows the standard of evidence and judgement auditors are expected to apply to AI outputs, and they will look for similar discipline in your finance function.

Could AI use increase our audit fee?

Poorly controlled or undocumented AI use can, because the auditor may need more IT work or more substantive testing. Well-controlled, documented use is less likely to, and good automation with clear audit trails can make some testing easier.

Who in the finance team should own this?

Typically the Financial Controller, who owns the control environment and the audit relationship, with input from IT. In regulated firms, the senior manager responsible for finance will also want visibility; see SM&CR explained for finance teams.