Auditors have begun asking companies how an AI reached a particular decision, and many cannot say. AI now helps score loans, assess stock and shape figures in financial statements, but the logs most firms keep show only what went in and what came out.
An audit used to mean running it again
A normal audit leans on repetition. An auditor takes a payroll calculation, feeds in the same hours and rates, and expects the same pay. If it matches, the control works.
An AI breaks that. Ask it the same question twice and the answers can differ, and nobody can lay out the steps between the question and the answer. So the auditor cannot repeat the work to check it, and the only evidence left is whatever was written down when the decision was made.
The spreadsheet lesson carries over with one difference. A spreadsheet can be opened again after the fact, and its errors found by checking the formulas. An AI answer cannot be reopened, so the checking has to be recorded as it happens.
The record is four answers and a name
The four things an auditor wants to know are what data was used, how the output was evaluated, who reviewed it, and how it changed the final decision.
Take a warehouse where an AI proposes reorder quantities for 150 items each morning. The manager looks them over, changes a few and approves. Most of the record can be captured automatically: the stock file the AI saw, what it proposed, and what was finally ordered. Only the manager can add what they checked and why they changed those few items. That takes under a minute a day.
Now suppose an auditor asks about one quarter. At about 60 working days, that is 9,000 decisions. With the record, the auditor reads it. Without it, nobody can rebuild what the AI saw or why a quantity was accepted, and the team can only say the AI was probably right. An audit can fail on that alone, even when the model worked perfectly.
The gap is usually between teams
The technology group knows how the system runs and the finance team knows what the number means, and often nothing connects the two. An alert fires and nobody feels it is theirs. The cheapest fix is one named person for each AI-assisted number, who owns its record.
Many managers also assume AI auditing does not apply to them because the company has not launched an AI programme. But AI features keep appearing inside accounting, purchasing and HR software that teams already use. A figure produced by one of those features is still a figure someone relies on. The first job is a list of where AI already touches your numbers.
The law is heading the same way. In Europe, AI used for things like credit scoring must keep automatic logs of its operation, and the company using it must keep them for at least six months. That duty starts in December 2027 after the original date was pushed back.
The teams that pass these audits will not be the ones with the most accurate AI. They will be the ones who can show, for any number, who checked it and what they changed.