Gains:
- Ability to scan the entire population with AI and prioritize suspicious records according to anomaly rules
- Ability to conduct audits with the discipline of 'mark and justify' without passing judgment on the model
- Ability to keep an audit trail (data, prompt, date, verifier) for each AI output
Perhaps the most sensitive area of accounting and finance is auditing: independently verifying that records are accurate, complete and compliant. Artificial intelligence (AI) is a two-pronged tool here. On the one hand, it is very powerful in scanning large data stacks for anomalies (suspicious records that deviate from expectations) and detecting internal control vulnerabilities. On the other hand, due to the nature of the audit, the AI's own output must also be audited. In this unit, we will learn how to use AI as an "audit assistant" and maintain an audit trail.
The Role of AI in Internal Control and Audit
Internal control is the set of rules and processes established to prevent errors and abuse (such as separation of duties, approval thresholds, reconciliation). Auditing checks whether these are working or not. Where AI is most effective is when it can scan entire populations where traditional auditing involves sampling (examining a few records out of hundreds). Looking at all 10,000 records is difficult for a human, but possible for a model.
But the critical distinction is this: AI generates doubt, not judgment. “This record looks abnormal” is a starting point; The actual audit decision and evidence collection belongs to the human.
Tip: At audit prompts, say "just point and justify, don't conclude/judge". It would be both wrong and risky for the model to make definitive statements such as "this is an irregularity"; The matter is decided upon your review.
Step by Step: Anomaly Scanning with AI
- Define your rule set. What do you consider abnormal? Threshold, repetition, timing.
- Scan the entire population. Not just a sample, but all of them.
- Mark and justify. A "why it is suspicious" explanation for each finding.
- Prioritize. Sort by risk/impact magnitude.
- Refer to human review. Gather evidence, make a decision, document.
Weak Prompt / Strong Prompt
Weak prompt: Are there any irregularities in these expenses? [data]
This yields an answer that is either "none" or produces unfounded accusations that cannot be used in the audit.
Strong prompt:Your role: an internal audit assistant.Task: Scan the following expense records against the risk rule.Rules:1) Amounts just below the approval threshold (50,000) (split suspicion)2) Records entered on weekends or after hours3) Similar amounts repeated at short intervals to the same supplier4) Unusual frequency of round amountsOutput: record number | triggered rule | why is it suspicious (1 sentence) |priority (high/medium/low)Constraint: Just mark and justify. Making a judgment like "it is an irregularity"; these are candidates for human examination. Only use the information in the data.<records> ... </records>
This prompt; It prioritizes amounts stuck just below the approval threshold (the "split-off" sign) or records entered after hours and gives the auditor a clear review list.
AI's biggest contribution to auditing is its advantage of scale. In a traditional audit, sampling is done because it is not physically possible to look at all records: perhaps a hundred of thousands of invoices are examined and the result is generalized to the entire population. This means that an irregularity that is outside the sample is escaped. AI, on the other hand, can apply the rules you define to all tens of thousands of records in seconds. Thus, auditing evolves from “looking at a few examples and hoping” to “scanning every record and pulling out exceptions.” However, all that is found are candidates for investigation, not conclusions.
Anomaly Rules Frequently Used in Audit
rule
What does it indicate
example
subthreshold accumulation
Split to avoid approval
Amounts like 49,500, 49,800
out of hours registration
Uncontrolled entry
Saturday 23:40 bill
duplicate payment
Risk of double payment
Same invoice, two document numbers
Round-number frequency
Estimated/made up amount
Lots of exactly 10,000
New supplier + higher amount
Ghost supplier risk
200,000 in first transaction
Separation of Duties and Authority Control
One of the cornerstones of internal control is segregation of duties: the persons who initiate, approve and pay for a transaction are different. If the same person enters, approves and pays the invoice, the door is open for abuse. AI can find instances where this policy is violated by scanning user information in transaction records.
Scan for separation of duties violations in the following transaction records: - Transactions that the same user both enters and approves - Transactions that the same user both approves and initiates payment - Amounts approved by a single person above the authorization limit Output: transaction number | violation type | relevant user | priorityJust point and justify; list as a candidate for sentencing, review.
This type of scanning extracts patterns in seconds that the human eye could never capture in thousands of lines. But the same principle applies: the pattern shows a "pattern of rule violations"; It's up to one to decide whether this is a real problem or a legitimate exception (e.g. forced dual role in small team).
Audit Trail Obligation
If an AI output is to be used in an audit, it must be traceable: what data, what prompt, what model, what date, who verified it? Without this record, the printout has no evidence value in the audit.
Prepare an audit trail record for this analysis:- Data source and period used- Summary of prompts/rules applied- Date of model output- Blank fields for human verification steps (who, when, result) Export this as a reusable template.
Caution: Just because the AI says "this record is okay" does not prove that there are no issues there. The model may have missed a pattern. "AI said clean" is not an assurance in an audit; Always document the limits of scope and method.
Mini Cases
Case 1 — Subthreshold compartment. An internal auditor found three consecutive invoices of 49,200, 49,700, 49,500 TL from the same department through AI scanning in a company with an approval threshold of 50,000 TL. The investigation revealed that a single £145,000 purchase was split into three to avoid approval. The control gap has been closed.
Case 2 — Ghost supplier sign. AI marked high priority that 200,000 TL was paid to a newly added supplier in the system in the first transaction. The review showed that the supplier is genuine and under contract; The alarm was false but the control worked correctly. Lesson: not every sign is a crime, but every sign should be examined.
Case 3 — Collapse of undocumented output. A team submitted the AI anomaly list to the audit, but did not record the prompt and data with which it was generated. The external auditor did not accept the printout as evidence. Analysis rerun with audit trail. Lesson: There is no output that cannot be monitored in the audit.
Case 4 — Separation of duties violation. An internal controls scan found 37 transactions at a small branch where the same employee entered, approved, and initiated payment for the invoice. The investigation showed that the employee did not have malicious intent but took on these roles due to understaffing. Still, the risk was real; The company closed the gap by moving payment approval to the center. Lesson: control deficit is dangerous even without malevolence; AI finds the pattern, humans design the solution.
Common mistakes
- To judge the model. Saying "it is an irregularity" is both wrong and risky; Just mark it.
- "AI said it's clean" assurance. It may be that the model missed; A clean result is not proof.
- Not keeping an audit trail. If data, prompt, date and verifier are not recorded, the output will not be evidence.
- Thinking every sign is a crime. The anomaly is a candidate for investigation; Evidence determines the decision.
- Not documenting the scope. Which records were scanned and the limit of the method should be written.
In summary
- AI is powerful in finding anomalies by scanning the entire population in an audit; goes beyond sampling.
- The model produces doubt, not judgment; Use it with the "just point and justify" rule.
- Anomaly rules (below threshold backlog, out-of-hours registration, duplicate payment) should be defined in advance.
- It is mandatory to keep an audit trail (data, prompt, date, validator) for each AI output; Untraceable output is not evidence.
- "AI said clean" is not an assurance; Always document the limits of scope and method.
Application task
Prepare an expense record of 30-50 lines; knowingly subdivide into and place a duplicate payment. Get an anomaly scan with the powerful prompt template and check that the model catches and prioritizes your traps. Then fill out the audit trail template and list the findings as “candidates for review” (without passing judgment).
checklist
- [ ] I have predefined the anomaly rules (threshold, timing, repetition).
- [ ] I scanned the entire population, I did not stop with sampling.
- [ ] I prevented the model from passing judgment; I just had it marked and justified.
- [ ] I recorded an audit trail (data, prompt, date) for each finding.
- [ ] I left those marked as "review candidates" to human judgment.
- [ ] I documented the scope of the scan and the limitations of the method.