Most audit functions now have auditors drafting with a language model, whether or not a policy says so. The question is no longer whether AI belongs in report writing; it is which parts of the writing it can be trusted with, which parts it will quietly corrupt, and what the verification pass looks like when the drafting help is a system that produces fluent, confident text with no idea whether it is true. This guide sets out a working protocol: where drafting assistance improves audit writing, where it fabricates, how to structure the workflow so that verification is a built-in step rather than an afterthought, the confidentiality boundaries that cannot be crossed, and the disclosure norms that are settling in. It pairs with the AI usage policy for internal audit, which sets the rules, and the generative AI across the audit lifecycle guide, which covers the other phases.
In this guide
- Where drafting assistance actually works
- Where it fabricates, and why the failure is specific to audit
- The workflow: draft, verify, own
- The verification pass, step by step
- Prompt patterns for report writing
- Confidentiality boundaries
- Choosing and configuring the tool
- Disclosure and documentation norms
- Keeping the report in the auditor’s voice
- Worked example: Halberd Software’s quote-to-cash report
- Frequently asked questions
- Related guides
Where drafting assistance actually works
Language models are good at operations on text that already exists and weak at supplying facts that do not. That single distinction predicts almost everything about their usefulness in audit writing. Tasks that transform an auditor’s own material (restructure it, tighten it, change its register, find its inconsistencies) are reliably improved. Tasks that require the model to know something about the engagement, the criteria or the organisation are where the trouble starts.
| Task | Reliability | Why | How to use it |
|---|---|---|---|
| Restructuring a draft finding into condition, criteria, cause, effect, recommendation | High | The facts are supplied; the model reorganises them | Paste the fieldwork notes; ask for the five elements, each as one sentence, with gaps flagged |
| Tightening: cutting a 400-word finding to 150 without losing facts | High, with a check | Compression is a text operation; the check is that no number or qualifier was dropped | Ask for the cut version and a list of everything removed |
| Changing altitude: management-grade to board-grade | High | Register change on known content; see writing for the board | Supply the audience and the three numbers that must survive |
| Consistency checking across a report | High | Models are good at spotting the finding called “High” on page 2 and “Medium” on page 9 | Paste the full draft; ask for every inconsistency in ratings, numbers, names and dates |
| Drafting the executive summary from the findings | Medium-high | Synthesis of supplied material; the risk is invented emphasis | Draft it yourself first, then ask the model for a shorter alternative to compare against |
| Suggesting alternative phrasings for a sensitive sentence | Medium-high | The model produces options; the auditor chooses | Ask for five versions at different levels of directness |
| Writing recommendations | Medium | Recommendations require knowing what is feasible in this organisation | Use it to test your recommendation against the cause, not to generate the recommendation |
| Stating criteria (standards, regulations, policies) | Low | The model will supply a plausible clause number whether or not it exists | Never; criteria come from the source document, quoted |
| Quantifying impact | Low | The model does not have the population or the data | Never; the number comes from the workpaper |
| Describing what management said | Low | Paraphrase drifts into attribution management did not make | Never without the interview note in front of you |
The high-reliability tasks are not trivial. Restructuring, tightening and consistency checking consume a large share of a report’s drafting time and are the tasks reviewers most often send back. A function that uses drafting assistance only for these three gets most of the available benefit with little of the risk, and that is a reasonable place for a conservative function to stop. The auditor’s prompt library has worked prompts for each of them.
Where it fabricates, and why the failure is specific to audit
Fabrication is not an occasional glitch; it is what a language model does when asked for a fact it does not have. It produces the most plausible-looking answer, which in audit writing means a plausible clause number, a plausible dollar figure, a plausible quotation. Three features of audit reports make this failure mode more dangerous here than in most business writing.
- Reports cite criteria. Every finding rests on a standard, a regulation, a policy or a contract. A fabricated citation (a GIAS standard number that does not say what the report claims, an ASC paragraph that does not exist, a policy section misquoted) destroys the finding and the auditor’s credibility in a single sentence, and it is exactly the kind of detail a model produces fluently. The Halberd pilot caught a fabricated ASC 606 citation in a draft; a function without a verification gate would have sent it.
- Reports quantify. Impact statements carry numbers, and the numbers are traced to workpapers. A model asked to “estimate the exposure” will estimate it, with a confident figure and no population behind it.
- Reports attribute. Management responses, interview statements and agreed actions are attributed to named people. A model paraphrasing an interview note will tidy the statement into something clearer than what was said, which is a misattribution the auditee will notice at the closing meeting.
| Fabrication pattern | What it looks like | Why it slips through | Catch |
|---|---|---|---|
| Invented criteria | “Standard 13.4 requires the engagement work program to be approved before fieldwork” | Numbering is plausible and the requirement sounds right; here 13.6 is the approval standard and 13.4 is evaluation criteria | Quote criteria from the source document; verify every number against it |
| Confident quantification | “Approximately $1.2 million of duplicate payments” | The figure is specific enough to look computed | Every number traces to a workpaper reference in the draft |
| Smoothed attribution | “Management acknowledged the control had not operated” | Management said something weaker and more hedged | Compare against the interview note verbatim before any attributed sentence survives |
| Imported context | A sentence about “the organisation’s 2024 restructuring” that came from a different engagement or the model’s training data | It reads as institutional knowledge | Anything not in the supplied material is struck |
| Averaged conclusions | A rating softened or hardened to match the tone of the prose | The model matches tone, not evidence | Ratings are set by the rating rule, never by the drafting tool |
| Phantom precision in dates and names | A regulation dated to the wrong year; a bulletin number off by one | Plausible, specific, wrong | Dates and document numbers verified individually |
Two public cases anchor the point for anyone who thinks the risk is theoretical. In Mata v. Avianca (S.D.N.Y., June 2023) lawyers filed a brief with fabricated case citations produced by a chatbot and were sanctioned $5,000; in October 2025 Deloitte Australia partially refunded a government department for a report that contained fabricated references. Both were produced by capable professionals under time pressure who trusted fluent text. An audit report that cites a regulation that does not say what the report claims will not reach a court, but it will reach a regulator or an audit committee, and the recovery is slower.
The workflow: draft, verify, own
The protocol that works has three stages and a rule about who holds the pen at each one. The auditor writes the facts; the model works on the text; the auditor verifies and signs. The model never touches a stage it is unsuited to.
| Stage | Who holds the pen | Input | Output | Gate before the next stage |
|---|---|---|---|---|
| 1. Facts | Auditor | Workpapers, evidence, interview notes, criteria documents | A fact sheet per finding: condition with numbers and references; criteria quoted with source; cause as established; effect with its basis; management’s position verbatim | Every fact has a workpaper reference; criteria are quotations, not paraphrases |
| 2. Drafting assistance | Model, directed by the auditor | The fact sheet, the house format, the audience | Structured draft; alternatives for tone; a list of anything the model could not source from the inputs | The model has been told to flag, not fill, gaps; nothing in the output lacks a source in the input |
| 3. Verification | Auditor, then reviewer | The draft against the fact sheet and the sources | A marked-up draft: every number, citation, date, name and attribution ticked against its source | Zero unticked facts; ratings set by the rule; voice and judgment the auditor’s own |
| 4. Ownership | Auditor and reviewer | The verified draft | The report, with the AI-assistance record in the file where policy requires it | Reviewer sign-off; the drafting record retained per the usage policy |
The fact sheet in stage one is the control that makes the rest safe. If the model is given fieldwork notes with references and told that anything not in the notes must be flagged rather than filled, the output can be verified against a finite source. If the model is given a one-line request (“write a finding about weak access controls at the depot”) the output is unverifiable because there is nothing to verify it against, and every sentence is a potential fabrication. Functions that get into trouble almost always skipped stage one.
The verification pass, step by step
Verification is now part of writing, the way reperformance is part of testing. The pass below takes fifteen to thirty minutes per finding for a competent auditor, which is less than the time the drafting assistance saved, and it is non-negotiable.
- Numbers. Every figure in the draft is highlighted and traced to a workpaper reference. A figure without a reference is deleted, not estimated. Rounding is checked against the precision the evidence supports.
- Criteria. Every cited standard, regulation, policy clause or contract term is opened in its source and the quoted or paraphrased requirement is compared word for word. Standard numbers, article numbers and effective dates are verified individually; the GIAS reference map is the quickest check for the Standards.
- Attribution. Every sentence that says what management, a control owner or a third party said or agreed is compared with the interview note or the written response. Softened or sharpened paraphrase is restored to what was said.
- Imported content. Any sentence containing information that was not in the supplied material (background, context, prior-year facts, industry statements) is either sourced or struck.
- Ratings and conclusions. The rating is re-derived from the severity matrix and the report rating rule, independent of how the prose reads. Prose is adjusted to the rating, never the reverse.
- Causal logic. The cause statement is checked against the evidence of cause, not against plausibility; the cause statements guide sets the standard.
- Dropped qualifiers. The verified fact sheet is compared with the tightened draft for any qualifier the compression removed (“in the sample”, “at head office”, “since March”).
- Voice. The draft is read aloud once. Sentences that sound like nobody in the function would say them are rewritten by hand; see the section on voice below.
The reviewer repeats steps one, two and five on a sample, exactly as a reviewer would reperform a test. A function that documents the verification pass (a tick sheet per finding, retained in the file) has an answer when a regulator or an external quality assessor asks how AI-assisted drafts were controlled. A function that cannot show the pass has a draft it cannot defend.
A short calibration exercise settles most arguments inside a function about how much to trust the tool. Take five findings from a closed engagement, give the model the fieldwork notes with references, run the restructuring prompt, and verify the output against the file. Count the fabrications, the dropped qualifiers and the softened verdicts. Functions that run this exercise usually find one or two problems per five findings on first use, almost all of them caught by the verification pass, and almost none of them visible to a reader who did not have the file. That last point is the whole case for the pass: the errors are invisible to everyone except the person who checks.
Prompt patterns for report writing
The prompts that produce safe output share a structure: they supply the facts, name the format, state the audience, and instruct the model to flag gaps rather than fill them. The patterns below are reproduced from the prompt library with the guardrail language included.
Restructure (stage 2): “Below are my fieldwork notes for one finding, with workpaper references in square brackets. Rewrite them as a finding with five labelled elements: condition, criteria, cause, effect, recommendation. Use only facts present in the notes. Where an element cannot be completed from the notes, write [GAP: what is missing] instead of inventing content. Keep every number and every reference exactly as given. Do not add background, context or criteria that are not in the notes.”
Tighten: “Cut this finding to no more than 150 words. Preserve every number, date, name and qualifier. After the cut version, list every phrase you removed so I can check that nothing material was lost.”
Consistency check: “Here is a full draft report. List every inconsistency you can find in ratings, numbers, dates, names, control references and terminology. Quote both occurrences for each. Do not rewrite anything.”
Altitude change: “Rewrite this finding for an audit committee. The three facts that must survive are: [numbers]. Replace technical control names with what the control does. One deliberate qualifier per claim. Do not add any fact not present in the original.”
Tone options: “Give me five versions of this sentence, from most direct to most diplomatic, without changing its factual content or softening the rating.”
Prompt patterns with guardrails
Notice what the prompts never ask for: criteria, numbers, management’s position, context. Those come from stage one. A model given the restructuring prompt and complete notes produces a draft that can be verified in minutes; a model asked to “write a finding about X” produces a draft that cannot be verified at all. The discipline is in what you refuse to ask.
Confidentiality boundaries
Drafting assistance moves engagement material into a system, and the question of which system, under what terms, is the one most policies get wrong by being either absolute or silent. The boundaries below reflect what the better policies now say; the model usage policy sets them out clause by clause.
| Material | Public consumer tools | Enterprise tool under contract (no training on inputs, retention controls, access logging) | Notes |
|---|---|---|---|
| Fieldwork notes with names of individuals | Never | Pseudonymise before input unless the tool is inside the organisation’s own tenancy | Names add nothing to the drafting task |
| Customer, employee or patient data | Never | Never in raw form; aggregated figures only | Data protection law applies regardless of the drafting purpose; see the data privacy audit guide for the regimes |
| Findings about a listed company before publication | Never | Permitted inside the tenancy with access logging | Material non-public information rules can apply to audit findings |
| Regulator correspondence (MRAs, exam findings) | Never | Check the regulator’s confidentiality rules first; some supervisory information may not be shared with third-party systems at all | Confidential supervisory information in US banking is the clearest case |
| The function’s own templates, methodology, rating rules | Acceptable if no client data | Acceptable | This is where most of the drafting value is anyway |
| Draft report text with entity and figures | Never | Permitted under contract terms; retention and deletion verified | The draft is the engagement; treat it like the workpapers |
Two practical rules follow. First, the tool matters more than the task: the same prompt is acceptable in an enterprise tenancy with contractual protections and unacceptable in a consumer product that may train on inputs. Second, the function should know what it signed. The audit software due diligence guide covers the questions about data residency, AI data use and retention that apply to any tool handling engagement material, and the answers belong in the usage policy, not in each auditor’s memory.
Choosing and configuring the tool
The protocol assumes a tool the function has chosen deliberately. Four kinds are in use, and they carry different risks for the same task.
| Tool type | Typical examples | Confidentiality posture | Fit for report drafting | Configuration that matters |
|---|---|---|---|---|
| Consumer chat product | Free or personal-plan chatbots | Inputs may be retained or used for training; no contract with the organisation | Templates and methodology only; never engagement material | None available; the control is prohibition |
| Enterprise tenancy of a general model | Business or enterprise plans with a data processing agreement | No training on inputs, retention controls, access logging, admin controls | Suitable for all three stages with the verification pass | Retention set to minimum; logging on; model version pinned where possible; sharing of conversations disabled |
| Model embedded in audit management or SOX software | Drafting assistants inside the platforms the evaluating AI in audit software guide reviews | Governed by the platform contract; usually inside the platform’s security boundary | Convenient; check whether the assistant can see workpapers it should not | Role-based access to the assistant; audit trail of prompts; vendor’s sub-processor list reviewed |
| Self-hosted or private-cloud model | Open-weight models run in the organisation’s own environment | Strongest; data never leaves | Suitable, with weaker drafting quality in smaller models | Patch and version management; the model is now an IT asset in the audit universe |
Whichever type is chosen, three configuration facts should be written into the usage policy and verified annually: where inputs are stored and for how long, whether inputs are used to train or improve the model, and who in the organisation can read the conversation history. A function that cannot answer those three questions for its tool should not be putting engagement material into it, and a function that can answer them has most of what an external quality assessor will ask for.
Disclosure and documentation norms
Norms here are still forming, but three positions have become common enough to treat as the emerging standard.
| Question | Emerging norm | Reasoning |
|---|---|---|
| Should the report disclose that AI assisted the drafting? | Usually no, in the report itself; yes, in the audit file | The report is the function’s product and the function owns every word. Disclosure in the file supports quality assessment and regulator questions |
| What goes in the file? | Which tool, which stages, the prompts used (or the pattern reference), and the completed verification tick sheet | Replicates the standard for any other tool: enough to show how the work was controlled |
| Does the reviewer need to know? | Yes, always | The reviewer calibrates their review to the risk; AI-assisted drafts get the citation and number sample |
| Does the audit committee need to know? | At the policy level, yes; per report, no | The committee approves the usage policy and should see the function’s controls over it once a year |
| Does the auditee need to know? | No, unless their data was processed in a way that triggers a legal or contractual duty | The auditee receives the function’s conclusions, not its drafting process |
| What about external quality assessors? | Expect to be asked; have the policy, the tool contracts and the verification records ready | Assessors are starting to treat AI-assisted drafting as a conformance question under the Standards on due professional care and documentation |
The documentation requirement is lighter than it sounds. A one-page record per engagement (tool, stages, prompt patterns, verification sheet) is enough, and it is the same record a function would keep for a new analytics tool. What a function cannot afford is silence: a draft with a fabricated citation that reaches the committee, followed by the discovery that nobody knew AI had been used and nobody had verified it.
Keeping the report in the auditor’s voice
Model-drafted prose has a recognisable texture: balanced triads, tidy transitions, a tendency to summarise what it just said, and a politeness that rounds the edges off a finding. Readers who see a lot of it learn to discount it, which is the opposite of what an audit report needs. Keeping the voice is partly a style matter and partly a credibility matter.
- Write the first sentence of every finding yourself, before any assistance. It is the sentence that carries the judgment, and judgment is the thing the model does not have.
- Strip the connective tissue. Transitions the model adds (“In addition”, “It should be noted”, “Importantly”) are deleted on sight; findings move by fact, not by flourish.
- Keep the specific. A model will generalise “the depot manager approved his own overrides 1,412 times” into “approval controls were not consistently applied”. Restore the specific every time.
- Reject softened verdicts. “Could be strengthened” means “does not work” and the report should say so; the conditions and impact writing guides show the register.
- Read it aloud. The test for voice is whether a named person in the function would say the sentence in the closing meeting. If not, rewrite it by hand.
The most useful habit is to treat model output as a colleague’s suggestion rather than as a draft: something to argue with, take the good phrase from, and overrule. Auditors who paste model output into the report template and edit lightly produce reports that read like everyone else’s. Auditors who write the facts and the judgment themselves and use the model to tighten and check produce reports that read like theirs, faster.
Worked example: Halberd Software’s quote-to-cash report
Halberd Software is a B2B SaaS company with about $310 million of annual recurring revenue, listed in September 2026 as an emerging growth company, with an internal audit function that grew from four to six people in its first eighteen months. Its FY27 pilot of generative AI across the quote-to-cash audit saved 69 hours on a 420-hour budget and caught four near misses at its review gates; two of the four were in the report-writing phase, and they are instructive.
The function ran the three-stage protocol. Each of the eleven draft findings had a fact sheet with workpaper references; the model was used for restructuring, tightening and the consistency check; the senior auditor verified every number and citation before the manager’s review. The first near miss was a criteria fabrication: the restructured draft of a revenue-adjustment finding cited an ASC 606 paragraph for the requirement that manual adjustments above a threshold be approved by someone other than the preparer. No such paragraph exists; the requirement was the company’s own accounting policy, section 4.3. The verification pass caught it at step two because the auditor opened ASC 606 to compare the wording and found nothing to compare.
The second near miss was in quantification. The tightened draft of the finding on reissued credit memos stated that 2,100 manual revenue adjustments had been reviewed; the fact sheet said 2,100 adjustments existed in the period and 180 contracts had been sampled. The compression had merged two populations into a claim of complete review. Step seven of the verification pass (dropped qualifiers) restored “in a sample of 180 contracts”. A third item, not counted as a near miss, was voice: the model’s version of the executive summary opened with a sentence praising management’s “commitment to continuous improvement”, which the CAE deleted on the grounds that nobody in the function had ever said it and the evidence did not support it.
The report went to the audit committee on time, with the verification tick sheets in the file and a one-page AI-assistance record. The committee chair, briefed on the pilot in advance, asked one question: whether the function could show that every citation had been checked. It could. The hours saved were real; the near misses were the reason the function kept the hours.
Frequently asked questions
Can internal auditors use ChatGPT or similar tools to write audit reports?
They can use drafting assistance for restructuring, tightening, altitude changes and consistency checks, provided the facts come from workpapers, every number and citation is verified before review, and engagement material only enters a tool whose contract terms the function has approved. Consumer tools that may train on inputs are not suitable for engagement material.
What is the biggest risk of AI-assisted audit writing?
Fabricated criteria: a standard number, regulation article or policy clause that is plausible, specific and wrong. Audit reports rest on cited criteria, so one fabricated citation destroys the finding. The control is to quote criteria from the source document and verify every reference individually.
Should the audit report say it was written with AI assistance?
The emerging norm is no in the report and yes in the audit file: record the tool, the stages it was used for, the prompt patterns and the verification tick sheet. The audit committee approves the usage policy; the reviewer always knows; external quality assessors increasingly ask.
How long does the verification pass take?
Fifteen to thirty minutes per finding for a competent auditor: numbers to workpapers, criteria to sources, attributions to notes, imported content struck, ratings re-derived from the rule, dropped qualifiers restored. It is less than the drafting time saved and it is not optional.
Can the model write the recommendation?
It can test one. Recommendations depend on what is feasible in the organisation, which the model does not know. Write the recommendation from the cause, then ask the model whether it addresses the cause as stated and what a sceptical control owner would say about it.
What should a usage policy for report writing contain?
Approved tools and their contractual terms, the stages where assistance is permitted and prohibited, the fact-sheet requirement, the verification pass and its documentation, confidentiality boundaries by material type, and the reviewer’s obligations. The model policy in the AI usage policy guide covers these in eleven clauses.
Related guides
- AI usage policy for internal audit — a model policy, clause by clause, with workpaper rules.
- Generative AI across the audit lifecycle — use cases, review gates and failure modes in every phase.
- The auditor’s prompt library — reusable prompts for audit work, with guardrails.
- Writing for the board — altitude, brevity and the courage to simplify.
- Writing airtight audit conditions — stating what is, without editorialising.
- Writing cause statements that point to the fix — causal logic on paper.
- Finding severity ratings — the calibrated matrix and the rating rule the prose must follow.
- Audit software due diligence — security, data residency, AI data use and vendor stability.
- Auditing enterprise AI governance — a program for the NIST AI RMF and EU AI Act era.
Leave a Reply