Documenting AI Use for the Audit Committee

The audit committee is the board-level committee responsible for overseeing financial reporting, internal controls and risk management. In organisations where AI is used in material financial processes, the audit committee needs to understand what AI is being used and what controls exist around it. Documenting AI use in a way that is clear to a non-technical audience is a critical control in itself.

Audit committees are increasingly asking about AI in finance. They want to know what automated decisions are being made, what the risks are and what governance exists. They do not need to understand the mathematics of machine learning, but they do need to understand the business implications. A clear, honest conversation with the audit committee builds confidence that AI risks are being managed.

Start with a simple inventory. Catalogue every AI tool used in a financial process. Create a table with columns for: process name, AI tool used, what the AI does, whether it is material to financial reporting, whether it makes autonomous decisions or supports human decisions, when it was implemented and when it was last reviewed. This inventory is not complex; it is the starting point for audit committee discussion. If you cannot answer these basic questions about your own AI use, the audit committee will have low confidence in your governance.

For each material AI process, prepare a one-page summary for the audit committee. The summary should cover: what the AI system does, what decisions it makes, what risks have been identified, what controls have been designed to manage those risks and what metrics are tracked to ensure controls are working. Use plain language. Do not send the audit committee a technical model card; send them a business summary.

An example: “We use a language model to extract invoice data (vendor, amount, date) from scanned invoices before entry into the payables system. The model achieves 98 per cent accuracy on structured fields. Risk: extraction errors could lead to duplicate or misdirected payments. Controls: all extracted invoices are matched against purchase orders; any mismatch is escalated to a clerk for review; we sample-test 50 invoices per week to verify accuracy; if weekly accuracy falls below 95 per cent, we pause the system and investigate. Current performance: 99.2 per cent accuracy, zero false positives requiring payment correction in the last quarter.”

The audit committee does not need to understand how the language model works. It needs to know: the model works, you have measured its performance, you have identified and mitigated the specific risks, and you are monitoring it. That is sufficient.

Incident reporting is also important. If an AI system makes a material error, the audit committee should be informed. If an invoice extraction model produces nonsensical results for a particular vendor format, and you discover that 200 invoices were misprosessed, the audit committee should hear about it. This is not a failure of your audit committee communication; this is precisely what the audit committee is responsible for overseeing. Transparency builds confidence.

Governance structure matters. Ensure that someone owns AI governance. This might be your Chief Financial Officer, your Head of Finance Operations or a dedicated Data Governance Officer. This person should be responsible for keeping an inventory of AI tools, assessing new tools before they are adopted and escalating incidents. The audit committee should know who this person is and should be able to contact them if they have concerns.

Also be honest about limitations. If an AI system is used but not fully controlled (perhaps you know it makes errors but the errors are immaterial, or perhaps you are still working on controls), tell the audit committee. It is better to acknowledge limitations and explain how they are being managed than to overstate the maturity of your controls.

Training and awareness also belongs in audit committee communication. Tell the audit committee what training your finance team has received on AI risks and responsible AI use. If a finance team member understands that a forecasting model’s output can drift if business assumptions change, that reduces the risk that the model’s output will be blindly trusted. Training is a control, and the audit committee should know that it exists.