The Foundation Is the Feature: Getting AI Right in Audit

Why trust, standardization, and quality depend on what your audit AI is built on.

AI is going to change how audits get done and I say that as someone building it, not warning against it. Used well, it takes the most repetitive parts of an engagement off the auditor's plate and hands that time back to the work only a person can do. For a profession that has done too much by hand for too long, that's genuinely good news.

But "used well" carries a lot of weight in that sentence. The same technology on the wrong foundation doesn't make an audit better, it makes it faster to get wrong. So the real question isn't whether to use AI in audit. It's what the AI is built on, and who stays in control of it.

The foundation decides the outcome

AI is an amplifier. Give it a clear, consistent process and it amplifies that, to include faster documentation, more standardized workpapers, less time lost to re-keying. Give it a shaky or improvised one and it amplifies that too, except the inconsistency now arrives faster and wrapped in output polished enough to look finished. A capable model on a weak process produces confident work that still won't survive review. The same model on a strong, well-defined process produces work you can stand behind. Same AI, opposite result because the difference is what's underneath it.

What is the AI grounded in?

This is the question I'd put at the center of any AI-in-audit conversation. Trustworthy AI isn't a generic model applying the internet's average idea of an audit to your engagement. It's AI anchored to the things that make an audit defensible in the first place: the authoritative guidance, governance, and a sound, consistent process for applying it. That grounding is what lets the output stand up in review, in front of a client, and in front of a regulator.

Get it right and three things follow. Quality rises, because routine work gets done consistently well and your people spend their judgment where it counts. Standardization rises, because engagements get run and documented the same defensible way instead of a different way each time. And trust follows from both consistency that holds up in peer review, and institutional knowledge that doesn't walk out the door when someone does.

And when I say grounded in your process, I mean your process. The most useful AI doesn’t ask a firm to throw out how it already works and adopt someone else’s, it folds into your methodology rather than reinventing it. If you’ve already found ways AI helps in your practice, the right platform should build on those. Good automation conforms to how you work, not the other way around.

Keep the human in the loop

None of this works without the auditor. AI drafts; the auditor decides. Used well, AI can pull together a first cut of the documentation, surface what looks off, and take repetitive load off your team and then a person reviews, corrects, and signs off, exactly as they would a junior's work. That design isn't a limitation to engineer away; it's the reason the output can be trusted. An audit is an opinion backed by evidence and professional judgment, if you automate the judgment out then it isn't an audit anymore.

Be discerning about the promises

A word of caution here, not about AI, but about how it's sold. Be a little skeptical of the biggest claims: "cut audit time by 80%," "fully automated testing," "AI that does the audit for you." They aren't always wrong, but a promise that large usually skips the two questions that matter most. Durable time savings come from AI doing the repetitive work well on a solid foundation, not from handing over the engagement and hoping. Ask what it's grounded in, ask where the human is, and trust it in proportion to the answers. That isn't AI-skepticism; it's the professional skepticism you already apply to everything else in an engagement, pointed for once at your own tools.

The bottom line

The firms that pull ahead over the next few years won't be the ones that adopted AI the fastest. They'll be the ones that built on a solid process, the right governance, kept their people in the loop, and used AI to make that foundation faster, more consistent, and easier to trust. The foundation is the feature. The AI is what makes it fly.

Let me be straight about where we are, because this piece is about not overpromising and I'm not going to break my own rule. Audora has real, working AI in the product today and it takes genuine, repetitive work off the auditor's plate and keeps the judgment where it belongs. It is not a magic box that runs the audit for you, and we're honestly just getting started. What matters more to me than what it does today is how we're building it: toward AI that's grounded in a firm's own process and standards, governed rather than guessed, with the auditor in control the whole way. That's a deliberate approach, and we have a long way to go on it,  which is rather the point. The firms that get the most from AI won't be the ones handed a finished black box; they'll be the ones whose tools are built on the right foundation from the start. If you want to see what's real today and where we're taking it, that's what our workshop is for: we scope Audora to how your firm works and let you run real work through it  so you're judging what's actually in front of you, not a promise. I'd be glad to set it up. 

FAQ

Will AI replace auditors? No. In a sound setup, AI handles the repetitive work, drafting documentation, surfacing what looks off while the auditor reviews, exercises judgment, and signs off. An audit is a professional opinion; the judgment can't and shouldn’t be automated away.

Can I trust AI-generated workpapers? To the extent the foundation and the review behind them justify it. AI anchored to authoritative guidance, the right governance model, and a sound process, with a qualified reviewer in the loop, produces work you can defend. A generic model with no human check does not.

Does AI make audits less consistent? Done right, the opposite. When AI works from a consistent, well-defined process, it documents every engagement the same defensible way which is more consistent than a process that changes with whoever is running it.

How should I evaluate an AI audit tool? Ask two things above all: what is the AI grounded in,  authoritative guidance, strong governance model, and a sound process, or generic patterns? And does a qualified auditor stay in control of the result? Be cautious of outsized promises that skip both.

Will we have to change how our firm works? No,  that’s the point. Good audit AI folds into your existing process and standards rather than replacing them; if anything it makes your way of working more consistent, not different.

Chris Watson is the CEO of Audora. He spent 25+ years in cybersecurity and audit, including at EY and Accenture, and writes on audit quality, trust, and the future of the audit profession.