CORAA
Log inRun your first audit free
Topic hub · AI in audit

AI in audit and assurance: tools, models, risks and controls

"AI in audit" has two meanings. One is using AI to do audit work: reading documents, testing populations, drafting observations. The other is auditing AI systems: checking whether an organisation's models and data are governed and safe. Both matter, and this hub covers both.

It gathers CORAA's guides on agentic AI, how to choose and test a model for audit tasks, the risks (hallucination, confidentiality, prompt injection), governance frameworks and policies, with templates and tools you can use today. We build on open-source models hosted in India and say so where it is relevant; the guides are written to be neutral and do not rank vendors.

Each guide states what its facts rest on and what we could not verify. Standards and laws change, so confirm dates and wording against the primary source before relying on them.

Guides

The essential guides: start here.

AI in Audit · 17 Oct 2026
What's Trending in AI for Audit Right Now: Seven Signals, With the Evidence (October 2026)
Seven signals shaping AI in audit this month: funding, benchmarks that expose limits, ICAI's AI push, what auditors search for, and governance. With sources.
AI in Audit · 4 Oct 2026
Agentic AI Explained for Finance and Audit Teams: What It Is, What It Can Do, What to Control
Agentic AI plans and acts toward a goal using tools, not just answers questions. What that means for finance and audit work, and the controls to set first.
AI in Audit · 28 Sept 2026
Choosing an AI Model for Audit Work: A Task-by-Task Guide That Does Not Pick a Winner
No AI model is best for every audit task. How to match a model to each task, what audit benchmarks show, and a bake-off to run on your own files.
AI in Audit · 29 May 2026
AI Hallucinations in Audit: How to Detect, Mitigate, and Document Them
AI hallucinations — when an LLM produces confidently-wrong output — are the single biggest defensibility risk for auditors using AI tools. The 7 hallucination patterns Indian CAs encounter most, the detection workflow, and SA 230 documentation when AI is used.
AI in Audit · 4 Oct 2026
AI Governance Framework for Finance and Audit Functions: What to Put in Place
A practical AI governance framework for finance and audit teams: owners, inventory, risk tiers, approvals, monitoring and an audit trail. What to set up first.
AI in Audit · 5 Oct 2026
AI Use Policy for CA and Audit Firms: What to Include
What an AI use policy for a CA or audit firm should say: approved tools, client data rules, human review, logging, training and engagement letter wording.
AI in Audit · 8 Oct 2026
How to Evaluate an LLM for Audit Work: A Test Plan
A practical plan to test an LLM on your own audit files: test set, scoring, human review, pass marks and the record to keep in the working paper.
All guides on this topic
Free templates and tools

Ready-to-use working papers, no sign-up to look around.

Word template
AI Use Policy Template for CA and Audit Firms
A draft policy covering approved tools, client data, human review, prohibited uses, incidents and review.
Word template
AI Model Change Log and Re-Test Record
Log every change to an AI model, prompt or setting, what was re-tested and the decision to accept or roll back.
Word template
Review Checklist for AI-Assisted Work
A reviewer checklist to complete before AI-assisted work goes into a file or to a client.
Word template
Control Checklist for AI Agents in Finance Workflows
Scope, access, approval gates, logging, limits, testing, change control, data and incident handling for AI agents.
Word template
LLM Evaluation Test Plan for Audit Tasks
Compare AI models on your own anonymised tasks with a prepared answer key, scoring and a decision record.
Word template
Privacy Impact Assessment (DPIA) Template
Describe the processing, test notice and basis, score risks to individuals, and record a go or no-go decision.
Word template
Journal Entry Testing Working Paper — SA 240 (Benford + Characteristics)
The full SA 240 management-override working paper: population profile, Benford’s-Law leading-digit table, the ten-characteristic screening battery, detailed-testing schedule and conclusion — editable in Word.
Word template
AI-Assisted Audit Use and Source Register
Document the tool, task, source evidence, data-handling decision, human review and disposition for AI-assisted tax-audit work.
Free tool
AI audit tool evaluation checklist
Score an AI tool before you adopt it.
Free tool
AI governance workpaper
Audit an organisation's use of AI.
Free tool
AI readiness assessment
See how ready your practice is for AI.
Free tool
Journal entry risk scorer
Score journal entries against red flags.
Frequently asked questions

AI in audit: in plain words.

It has two meanings. One is using AI to perform audit work, such as reading documents, testing populations and drafting reports. The other is auditing AI systems, meaning assessing whether an organisation's models, data and controls are governed and safe. This hub covers both.
AI can help with parts of audit work, such as extracting data, running tests on full populations and drafting. Current audit benchmarks show models still struggle with complex reasoning across many documents, so a person must stay responsible for judgements and conclusions. Read more: What is trending in AI for audit.
Agentic AI refers to systems that take steps toward a goal on their own, such as reading files, calling tools or posting entries, instead of only answering a question. That makes controls on access, approvals and logging as important as accuracy. Read more: Agentic AI explained.
No single model is best for every audit task. The right choice depends on the task, how sensitive the data is and how much evidence you need. The reliable method is to test a few models on your own anonymised files and record the version and date tested. Read more: Choosing an AI model.
Wrong answers stated with confidence (hallucination), exposure of confidential client data, prompt injection from untrusted documents, changes in model behaviour without notice, and over-reliance without review. Read more: AI hallucinations in audit.
Only if the tool is approved for that data, the vendor's terms on retention and training are acceptable, and your client contract and data protection duties allow it. India's DPDP Rules were notified on 14 November 2025 with an eighteen-month phase-in, so plan for them now. A written firm policy should set the rules. Read more: AI use policy for CA firms.
Commonly used ones are the NIST AI Risk Management Framework and ISO/IEC 42001, the standard for AI management systems. The EU AI Act applies to AI placed on the EU market and may matter to Indian companies with EU customers.
Journal entry testing looks for unusual or risky entries in the ledger, such as unusual timing, round amounts or unexpected accounts. Software and AI can screen the whole population and rank entries, but a person reviews and explains the flagged ones. Read more: Journal entry testing and AI.
Record the tool and version, the task, the source documents, the reviewer and what was checked. That lets another reviewer reproduce the work. Our review checklist and model change log are built for this.
Use your own anonymised tasks with answers prepared in advance, then score correctness, whether the answer cites its source, whether it says it cannot tell when it cannot, and whether repeat runs agree. Re-test whenever the version changes. Read more: How to evaluate an LLM.