AI Best Practices
AIIA's AI features are designed to augment — not replace — professional audit judgment. Follow these best practices to get the most value while maintaining audit quality and governance.
Golden Rules
- AI outputs are suggestions — always review before applying
- You are responsible — the auditor owns the final work product
- Verify citations — check that AI references are accurate
- Use confidence scores — lower scores need more scrutiny
- Document AI usage — note when AI was used in workpaper methodology
Do's and Don'ts
| ✅ Do | ❌ Don't |
|---|---|
| Use AI for first drafts, then refine | Blindly apply AI-generated text |
| Check AI citations against source documents | Assume AI references are correct |
| Use AI to identify patterns in large datasets | Rely on AI for final severity judgments |
| Document when AI assisted your work | Hide AI usage from reviewers |
| Start with clear context (scope, objectives) | Give vague prompts expecting perfect results |
| Review confidence scores | Ignore low-confidence warnings |
Getting Better Results
Provide Context
The more context you provide, the better the AI performs:
- Fill in engagement objectives and scope before asking for narratives
- Complete CCCER fields before asking for finding drafts
- Link risks and controls before asking for test procedure suggestions
Be Specific
Instead of: "Write a finding" Try: "Draft a finding about the approval workflow gap identified in workpaper WP-003, where 12 of 50 sampled POs lacked proper authorization"
Iterate
- Use AI output as a starting point
- Edit and refine the text
- Ask follow-up questions to improve specific sections
AI Governance Compliance
To maintain compliance with AIIA's AI governance framework:
- Every AI interaction is automatically logged
ai_execution_idtraces AI contributions in findings and workpapers- QA reviews can identify AI-assisted content
- The audit trail shows Apply/Reject decisions for all AI suggestions
When NOT to Use AI
- Final severity determination — use professional judgment
- Legal opinions — consult legal counsel
- Regulatory interpretations — reference the official regulation
- Disciplinary matters — require human sensitivity