External Audit Expectations About AI in Finance Processes
External auditors have developed standardised expectations about how AI should be managed in finance functions that produce auditable financial statements. These expectations are now written into auditing standards, particularly where AI systems support material financial reporting processes. Understanding what auditors expect makes it easier to build controls that will pass audit.
The International Auditing and Assurance Standards Board has issued guidance specific to AI auditing. ISA 315 (Identifying and Assessing the Risks of Material Misstatement) now requires auditors to identify processes that involve AI and to assess risk differently for AI-supported processes. ISA 330 (Performing Audit Procedures in Response to Assessed Risks) requires auditors to design specific audit procedures for AI systems.
The practical implication is this: if a material figure in your financial statements is derived from an AI process, your auditor will test that process before forming an opinion. They will expect to see evidence that you designed the process correctly, tested it before deployment and monitor its accuracy in production. They will want to see documentation of model training, testing, validation and any changes made after deployment.
Auditors typically focus on five questions about AI processes. First, is the model deterministic or probabilistic? A deterministic system produces the same output every time it sees the same input. A probabilistic system (machine learning) produces different outputs because it relies on random initialisation and sampling. Auditors are more comfortable with deterministic systems because they can be tested exhaustively.
Probabilistic systems require evidence that the model was trained on representative data and performs well on hold-out test sets. Second, who owns the model? If it is an internal model your team built, your organisation owns the risk. If it is a vendor model that you fine-tuned, risk is shared with the vendor. Third, was the model validated on data representative of your environment? A model trained on generic invoice extraction data might not perform well on your vendor’s unique invoicing formats.
Auditors expect evidence that you tested the model on your data before using it. Fourth, are there exception cases the model struggles with? Most models have a distribution of performance. They might be 99 per cent accurate on standard invoices but 85 per cent accurate on amended invoices or invoices with handwritten additions. Auditors expect you to identify these exception cases and to have controls that flag them for human review.
Fifth, how is model performance monitored in production? Is accuracy tracked weekly? What happens if accuracy drops? Auditors expect a documented monitoring process.
Auditors also examine your governance around AI. Who approved the decision to use AI in this process? What is the basis for that decision (was it tested first, or was it deployed without evaluation)? Who owns the model going forward? Is there a documented process for updating or retraining it? If a model makes an error that affects a financial statement figure, what is the escalation process? These governance questions matter as much as technical questions.
Documentation is critical for audit. Keep records of: model development and training; performance testing before deployment; testing results; the decision to deploy; parameters of deployment (version number, date deployed); production monitoring metrics; any incidents where model accuracy was below expected levels; any retraining or model updates; validation that the new version performs as expected. This documentation is not for auditors alone; it is for your own investigation if something goes wrong.
Auditors expect proportionate controls. For a low-risk AI application (for example, an agent that categorises non-material expense claims), light controls are acceptable. For a high-risk application (for example, a model that determines revenue recognition treatment), heavy controls are required. Do not apply the same testing rigour to every AI application; match controls to risk.
Your auditor will also want to understand limitations. What does this model not do? If you are using AI to extract contract terms but a human accountant still determines performance obligations, be explicit about this boundary. Auditors want to know what decisions remain with humans. They also want to know what happens if the model fails or its accuracy degrades. Is there a manual fallback process? Can you complete the close if the AI system is down?
The relationship between you and your auditor should include discussion of AI before systems are deployed. The ideal conversation happens before implementation: “We are planning to use an AI system for this process. Here is what the system does, here is our planned control environment, here is how we will monitor it. Does this align with your audit approach?” This conversation prevents surprises later.