EXECUTIVE BRIEFING
PSG EXECUTIVE BRIEFING · NO. 04
AI and your auditors.
How to put AI inside your finance function without creating audit findings — the controls auditors actually test, the evidence they accept, and the five-document package that turns an uncomfortable conversation into a routine one.
PLATINUM STRATEGY GROUP · 2026
WWW.PSG-INC.COM
Auditors don’t fear AI. They fear undocumented AI.
An auditor’s question is never “did a machine do this?” — spreadsheets, macros, and ERP automations have processed financial data for decades. The question is the same one asked of any control: can you show me who is responsible, how it was reviewed, and what evidence exists? AI creates findings only when it slips into the close process informally — an analyst pasting reconciliations into a chatbot, a board pack drafted by a model nobody disclosed. The fix is not banning the tools; it’s bringing them inside the control framework you already run.
THE FOUR QUESTIONS EVERY AUDITOR WILL ASK
Where does AI touch financial data?
An inventory of every AI use in the finance process, formal or informal.
Passing answer: a maintained register — tool, use case, data touched, owner. “We’d have to ask around” is itself a finding.
Who reviews the output?
Whether a qualified human stands between AI output and the financial record.
Passing answer: named reviewer, documented sign-off, and review evidence retained — same standard as any journal entry approval.
Can you reproduce this number?
Whether an AI-assisted figure can be traced from source data to final output.
Passing answer: inputs, prompt or model version, output, and adjustments logged — the AI equivalent of workpaper support.
What happens when it’s wrong?
Whether error detection and correction is designed in, or discovered by accident.
Passing answer: exception thresholds, an escalation path, and a log of caught-and-corrected errors — which proves the control operates.
The reframe. A well-documented AI control is often stronger than the manual process it replaced — it runs the same way every time, logs everything it does, and never gets tired on day nine of the close. Auditors know this. Documentation is the entire difference between a finding and a talking point.
Five documents that end the conversation.
Maintained together, these five artifacts answer every AI question an external auditor, a lender, or an acquirer’s diligence team will raise. None is long. All five can be stood up in two to three weeks.
AI use register. One table: every AI tool touching financial or operational data, its use case, data classification, owner, and approval date. The document that proves you know what’s running.
Usage policy. One page: what data may enter which tools, what requires human review before use, and what is prohibited. Signed by staff annually, like the expense policy.
Control descriptions. For each AI touching the close: input source, model/tool version, review step, reviewer, and evidence retained. Written in the same format as your existing control matrix so it drops straight into the auditor’s walkthrough.
Change log. Dated record of model swaps, prompt changes, and configuration updates for production AI — because “the tool changed mid-year” is only a problem when nobody can say when or why.
Exception log. The errors the review step caught, and what was done. Counterintuitively, a populated exception log is your best exhibit — an empty one suggests the control never operated.
Beyond the audit. The same package is what a lender’s diligence team and an acquirer’s QofE provider will ask for. Companies preparing for a sale or refinancing should treat AI documentation as part of deal readiness — it is now a standard diligence request, and a clean answer reads as management quality.
Audit-ready in three weeks.
Find everything. Survey the team — with amnesty, or you’ll get silence — and build the AI use register, including the informal uses. Expect surprises; every company has shadow AI by now, and the register is worthless if it only lists the official tools.
Decide and document. For each use: approve with a review step, restrict to non-sensitive data, or stop it. Write the one-page policy and the control descriptions for whatever touches the close.
Brief the auditors first. Walk your audit partner through the package before fieldwork, not during it. Proactive disclosure sets the tone: this is a managed capability, not a discovered risk — and their feedback now is free, while a finding later is not.
WHAT THIS BUYS YOU
A clean audit
AI questions answered in one meeting with five documents — instead of a scramble that colors the whole engagement.
Freedom to expand
With the framework standing, each new AI use is a one-row addition to the register — not a fresh governance debate.
Deal readiness
Lenders and acquirers now ask. A ready answer reads as management quality and protects valuation in diligence.
Want the package built before your next audit?
A 30-minute diagnostic consultation — where AI touches your close today, what your auditors will ask, and a three-week plan to be ready.