When a model helped produce a working paper, the file should let a stranger answer four questions: what was asked, what came back, what the auditor checked, and who took responsibility. A short, standard note does this without turning documentation into a chore. The prompt and the model's reply are not the evidence. The checking is.
The general rules on what a file should hold are in audit documentation and SA 230. Tamper-evident logging at system level is in audit logs for AI. This post covers the human-readable layer that sits at the front of the working paper.
Why a note, not a transcript
Saving every chat is easy and unhelpful. A reviewer faced with forty pages of conversation cannot tell which answer was used. An inspection team wants to see how a conclusion was reached and that someone competent stood behind it.
A one-page note gives the route in a minute, with the full transcript attached for anyone who wants it.
The note, field by field
| Field | What to write |
|---|---|
| Working paper reference | Index number and title |
| Purpose | One line: what the AI was used for |
| Tool and model | Name and version as the tool shows it |
| Date and user | When and who |
| Data supplied | Which client documents, in what form, after what clean-up |
| Instruction used | The prompt, or a reference to the stored template |
| Output used | Which part of the output went into the working paper |
| Checks performed | What was compared with source, and with what result |
| Exceptions | Where the output was wrong or incomplete, and the correction |
| Conclusion owner | Name of the person who reached the conclusion |
| Reviewer | Name and date of review |
Keep each entry short. "Checked 10 of 10 flagged vouchers to source documents; 2 flags were false positives" says more than a paragraph.
What the checks must cover
The note is only as good as the checking behind it. Typical checks:
- Source tie-out. Each fact or figure traced to a client document or the ledger.
- Completeness. Did the model cover the full population, or only what fitted in the prompt? If the task was "find all", say how you know it found all.
- Recalculation. Numbers recomputed outside the model, in a spreadsheet or the accounting system.
- Reasonableness. Does the answer make sense given what the team knows of the client?
- Negative checks. Did you test something the model should have flagged, to see whether it did?
For tasks where the model reads text, ask it for quotes with page numbers so the tie-out is quick. See long audit files and AI context windows.
Treat AI output as a lead, not evidence
A model's statement is not audit evidence. It points you to evidence. The evidence is the invoice, the confirmation, the agreement or the ledger entry you then examine. Writing this plainly in the note, for example "AI used to locate candidate clauses; evidence is the agreement pages cited", keeps the file honest about where assurance comes from.
Where the model's output is used as an audit procedure itself, for instance an analytical test run through code it wrote, the reliability of that procedure needs support. Keep the code, run it again, and check it on a small sample you can verify by hand.
Model name and version
The same prompt can give different answers after a model update. Record the model name and version string the tool displays, and the date. If the tool does not show a version, note that, and ask the vendor how updates are announced. The practice is explained in model versioning and change control.
Confidentiality line
Add one line on data handling: which tool, which account type, and whether identifiers were removed. A firm that has reviewed its tool's terms can reference the policy instead of repeating the detail each time. See the AI use policy outline.
Who owns the conclusion
State a human name. A model cannot be responsible. The engagement partner remains accountable for the opinion, and the note makes it clear that the staff member who used AI also read, checked and owns the working paper's conclusion. A reviewer's sign-off then covers the checking, not only the final sentence.
Keep it light
A heavy form will be skipped. A good template:
- Fits on one page
- Has drop-down choices where possible
- Lives in the working paper tool, not in a separate folder
- Can be filled in under five minutes
Make a stricter version for high-risk uses, such as judgements on going concern or fraud risk, and a lighter one for low-risk uses such as formatting or drafting a letter.
What a reviewer should ask
- Is the AI-use note present for each AI-assisted paper?
- Do the checks match the risk? A material balance needs more than a glance.
- Is there evidence outside the model for every conclusion?
- Does the version and date match the firm's approved list?
- Were exceptions recorded, or does everything look suspiciously perfect?
The human-in-the-loop review post goes further on where the checkpoint sits.
Frequently Asked Questions
Do we need to disclose AI use to the client?
That depends on the engagement letter, the client's expectations and the firm's policy. Many firms mention technology use in the letter. Seek the firm's own guidance and ICAI communications.
Should the full chat be saved?
Save it where the tool allows and link it from the note. The note is the primary record.
Is the note needed for drafting letters?
A light version is enough for low-risk drafting. Use the full note where AI output feeds a conclusion or a number.
Last reviewed: 17 October 2026. Facts checked. No ICAI, NFRA or vendor page was opened in this session. The note template is a suggested practice, not a prescribed format, and the references to documentation duties are general. Confirm requirements against the Standards on Auditing and the firm's quality management policies.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error