Auditor and AI–How the Documentation Fixation will Blow Up in Our Faces

Auditors are all excited about the advancements in AI, and are scrambling to implement this tool in the enhancement of their procedures on the one hand, while trying to figure out policies to curtail its abuse, and guide its proper use, on the other. In the meantime, they don’t have a clue about where its boundaries are, and what it is capable of.

The intention is not to give you the solution to any of these mentioned dilemmas, but to pull you back to two basic audit and audit regulation principles.

The Oldest Principle: Auditors as Specialists

The oldest principle is auditors being specialists in their field, and continuously researching and investigating ways of improving themselves to become overall judges of all things business.

Although this principle has started to wane in recent years, the advent of AI has made it imperative to rigorously revive it, because, if auditors cease understanding the business principles and systems behind the data which their AI is disseminating for them, audits will be performed by AI, with the auditor a mere facilitator. The value to the auditee will be close to zero.

The Documentation Principle: “If It Is Not Documented, It Is Not Done”

One of the most recent principles, of a few decades, is the principle applied by our regulator, namely “If it is not documented, it is not done.”

This principle was applied by the regulator with so much excitement because no counterargument to regulatory findings needs to be entertained without documentary ‘evidence’.

The elephant in every room where findings are discussed, but which is never addressed, is whether “all that is documented, has actually been done.” The finest-looking working papers copied from other files, and tweaked for the current period and client, are accepted as compliant.

AI and the New Risks to Audit Evidence

Now, not only the documented procedures run the risk of being manipulated, but also the evidence produced by AI.

For example, if AI matches a population of 40 000 records to supporting evidence, is it evidence of the audit procedure having been performed by the auditor?

• If it were a fixed program which could not be manipulated, one could argue that it was.

• However, AI cannot only be manipulated, it can also make up its own mind on what to perform or not, and even create supporting evidence.

• There is no existing audit standard which prohibits this possibility.

Conclusion: A Future of More Documentation, Less Substance

In my view, audit documentation will only increase, with a larger proportion not representing the judgment applied, procedures performed, or evidence obtained by the auditor.