Your Auditor Is Going to Ask How You Used AI. Here's What the Working Paper Needs to Show.
Your Auditor Is Going to Ask How You Used AI. Here's What the Working Paper Needs to Show.
A reviewer who can't reproduce a step can't sign off on it. That test doesn't change because a tool was involved.
Thirty June audits are in the field. The ACNC's 2026 Annual Information Statement is opening for lodgement. Aged care providers have an Aged Care Financial Report, including audited general purpose financial statements, due on 31 October — a date with no extension provision attached to it. Self-assessing not-for-profits have their ATO self-review return due the same day.
For the first time, a material share of the reconciliations, schedules and variance explanations sitting in those files were produced with AI assistance. And almost nobody has decided what the working paper is supposed to say about that.
This is not a governance question. It's an evidence question, and it arrives after the fact.
Why the question is coming this year
The profession has been working through this for a while. The Auditing and Assurance Standards Board issued considerations on the impact of AI on auditors in July 2025, covering three things: using AI tools in audits, auditing information an entity has prepared using AI, and improving communications using AI. Internationally, the IAASB released exposure drafts in August 2026 on revised versions of ISA 330, ISA 500 Audit Evidence and ISA 520, with comments requested by 15 December 2026.
The second of those AUASB items is the one worth reading twice. It isn't about the auditor's tools. It's about yours — what an auditor should do when the information they've been handed was produced with AI assistance, and whether the data and logic behind it can be explained at all.
None of this creates a prescribed client-side form to complete, and nobody should tell you otherwise. What it does mean is that an auditor who has spent eighteen months documenting the provenance and reliability of their own AI-assisted procedures now has explicit professional guidance encouraging them to ask about yours. Expect the question. It will be polite, and it will be in writing.
|
31 October
Aged Care Financial Report due, with audited general purpose financial statements. No provision exists for a later date.
|
15 Dec 2026
Comments close on the IAASB's revised audit evidence exposure drafts. The definition of audit evidence is being actively rewritten.
|
"AI helped" is not a review note
The failure mode I'd expect to see most this season isn't a wrong number. It's a schedule that's correct but unexplainable — a variance analysis nobody can trace back, a reconciliation whose logic lives in a chat window that's since been closed, a note that says "prepared with AI assistance" and stops there.
That note tells a reviewer nothing they can act on. It doesn't tell them what data went in, what the tool actually did, what a person did afterwards, or what was checked. It converts a reviewable step into an unreviewable one, and the reviewer's only remaining options are to redo the work themselves or to accept it on faith. Neither is a good outcome for you.
The four things the paper needs to carry
1. What went in, and where it came from. Name the source, the extraction date, and the parameters. "The debtors listing" is not a source. "Debtors ageing as at 30 June 2026, exported from the ledger on 12 July 2026, all entities, unposted transactions excluded" is a source. If the input was itself a manipulated extract — de-identified, filtered, summarised — say so and say how, because the reviewer needs to know what the tool could not see.
2. What the tool produced versus what the preparer produced. This is the division of labour, and it's the field most often left blank. In practice most AI-assisted finance work is a handoff: the tool tabulates and the person interprets, or the tool drafts and the person corrects. Write down which. A single sentence is enough — "the tool grouped the 4,100 transactions into the eleven funding categories; the categorisation rules and the treatment of the 62 unmatched items were set and resolved by the preparer."
3. What was independently checked, and how. Not "reviewed." Checked against what. Casting agreed to the ledger control account. Six categories re-performed manually and agreed. Totals reconciled to the trial balance. The specific procedure, and its result. If the check was a sample, say what the sample was and how it was selected — a check with no stated method is not distinguishable from no check.
4. Who signed, and what they were signing for. The preparer's name against the judgement, not just against the file. The person signing is asserting that the output is right and that they understand why it's right. That assertion is unaffected by how the work was done, and it is the whole point of the exercise.
The test underneath all four
There is a single question that resolves almost every edge case here: could a competent person, holding only this working paper, reproduce the step and arrive at the same answer?
That has always been the standard. It didn't change when spreadsheets replaced ledger paper and it doesn't change now. What changed is that AI makes it much easier to produce output that looks reproducible and isn't — because the reasoning happened somewhere the file can't see, and because the same prompt run twice may not produce identical output.
That last point deserves emphasis. A formula in a cell is deterministic; you can re-run it in five years and get the same result. A prompt is not. Which means the reproducibility burden shifts onto the documentation in a way it never had to before. If the paper doesn't capture the logic, the logic is gone.
What this is, and what it isn't
Three related things get confused, so it's worth separating them cleanly.
An AI governance policy is what the organisation writes down in advance about what tools may be used, on what data, by whom. It's a control that operates before the work.
A verification habit is what an individual does at the moment of using the tool — the discipline of checking the output before acting on it. It operates during the work.
A working paper is what a third party will ask for afterwards, sometimes years afterwards, when the person who did the work has left. It operates after the work, and it's the only one of the three that has to survive without you in the room.
Most finance functions I speak to have started on the first and are working on the second. The third is the one that gets tested in October.
Could a reviewer reproduce your AI-assisted schedules from the file alone?
If the honest answer is "only if they ask me," the file isn't finished. PFL provides senior-level outsourced finance, management reporting, and AI automation for Australian NFP, NDIS, and SME organisations — including getting audit files into a state where they can be reviewed without their author present.
Talk to PFL →Auditing and Assurance Standards Board — Impact of AI on Auditors (14 July 2025)
IAASB — Proposed Revisions for Audit Evidence & Risk Response: ISA 330, ISA 500 & ISA 520
Department of Health, Disability and Ageing — Aged Care Financial Report Guidance and FAQs 2025-26
ACNC — The Annual Information Statement
ATO — NFP self-review return: due date of the return
Comments
Post a Comment