How Does Artificial Intelligence Actually Create Its Responses? Understanding Input–Process–Output for Audit Workpapers
Why auditors must understand how AI processes information before relying on it to develop audit documentation
Artificial intelligence is changing how internal auditors, external auditors, and compliance professionals prepare audit workpapers. Auditors are increasingly using tools such as ChatGPT, Claude, and Microsoft Copilot to summarize evidence, identify risks, evaluate internal controls, draft audit findings, and develop recommendations.
However, an important question is often overlooked: How does AI actually create the responses that auditors receive?
Understanding this process is essential because AI-generated content can appear accurate, authoritative, and professionally written even when its conclusions are unsupported or incorrect.
The key to understanding AI is a fundamental information-processing concept that has existed for decades:
Input → Process → Output (IPO)
Every computer application, accounting system, audit analytics program, and artificial intelligence model operates within this basic framework.
The difference is how the processing occurs.
For auditors, understanding the IPO model provides a practical foundation for evaluating the reliability of AI-generated audit documentation.
1. The Foundation: Input–Process–Output
The Input–Process–Output model describes how information systems transform data into useful results.
Input: What information enters the system?
Inputs may include:
User instructions and questions.
Financial statements and accounting records.
Audit programs and internal control descriptions.
Policies, procedures, and regulatory requirements.
Supporting documents and transaction data.
Relevant context supplied during a conversation.
Process: What happens to the information?
The system applies processing mechanisms to the inputs.
In conventional computer systems, processing generally involves explicitly programmed instructions, mathematical formulas, database queries, business rules, and algorithms.
In generative AI, processing primarily involves mathematical operations using parameters learned during model training.
Output: What does the system produce?
Outputs may include:
Audit planning memoranda.
Risk assessments.
Internal control narratives.
Audit findings.
Summaries of supporting evidence.
Recommendations for corrective action.
Draft audit workpapers.
The IPO model is straightforward. However, the quality of the output depends on the reliability of the inputs, the processing mechanisms, and the controls applied to the resulting information.
An auditor should never assume that a professionally written AI response is necessarily an accurate or adequately supported audit conclusion.
2. Traditional Computer Processing Versus Artificial Intelligence
Consider a traditional accounting application.
An accounts payable system receives a vendor invoice containing a vendor number, invoice date, purchase order number, invoice amount, and payment terms.
The application processes the invoice according to programmed business rules.
For example:
Input: An invoice for $25,000.
Process: The application compares the invoice against the purchase order, receiving records, vendor master file, and established approval limits.
Output: The invoice is approved, rejected, or routed for additional review.
The processing rules are generally identifiable, repeatable, and testable.
Now consider an auditor using AI to evaluate the same invoice.
Input: The auditor provides the invoice, purchase order, receiving report, and relevant purchasing policy.
Process: The AI model analyzes relationships among the supplied information, interprets the auditor's instructions, and generates a response using its learned parameters and the available context.
Output: The AI produces a narrative identifying possible discrepancies, missing approvals, or potential control weaknesses.
The two systems follow the same IPO structure, but their processing methods are fundamentally different.
Traditional accounting software generally follows explicit business rules. Generative AI produces responses using learned statistical relationships and computational operations.
This distinction matters because the AI model may generate a plausible conclusion without adequately establishing that the conclusion is supported by the underlying audit evidence.
3. How AI Actually Processes an Auditor's Question
A large language model does not ordinarily search its memory for a completed answer and then retrieve it like a document from a filing cabinet.
Instead, it generates a response through a sequence of computational operations.
Step 1: The auditor submits a prompt
Suppose an auditor asks: "Review the attached accounts payable transactions and identify possible duplicate payments. Prepare an audit finding using the five elements of an audit finding."
The prompt becomes part of the model's input.
Any attached transaction records made available to the model also become part of the information it can analyze.
The model may additionally receive instructions, earlier conversation context, and information retrieved through authorized tools.
Step 2: The input is converted into tokens
AI models process text as tokens.
Tokens may represent complete words, portions of words, numbers, punctuation marks, or other text elements.
The model converts these tokens into numerical representations that can be processed mathematically.
For example, the phrase: "Identify duplicate vendor payments"
is transformed into a sequence of token identifiers and numerical representations.
The model does not directly reason about the phrase as a human auditor would. It processes mathematical representations of the information.
Step 3: The model evaluates relationships
Modern large language models commonly use a neural-network architecture called a transformer.
An important mechanism within transformers is attention.
Attention allows the model to evaluate relationships among different tokens within the available context.
For example, when reviewing an invoice, the model may associate:
Vendor identification.
Invoice number.
Payment amount.
Payment date.
Purchase order.
Duplicate transaction indicators.
These relationships influence the model's subsequent computations.
The model uses learned parameters, often called weights, to transform the numerical representations through many layers of mathematical processing.
The parameters were developed during training by the AI creator. They are not a collection of individually written accounting rules.
Step 4: The model predicts the next token
At each generation step, the model calculates scores for possible next tokens and converts them into a probability distribution.
A token is selected according to the system's generation settings.
The selected token becomes part of the developing response, and the process repeats.
This continues until the response is completed.
The resulting answer may contain explanations, calculations, comparisons, recommendations, and structured audit findings.
However, the underlying text-generation mechanism is still based on predicting tokens from the available context and learned parameters.
The model is optimized to generate useful responses, but that does not independently establish the truth of every statement it produces.
4. Does AI Actually Perform Logical Reasoning?
This question requires an important distinction.
AI systems can perform tasks that involve logical reasoning, including comparing alternatives, applying conditional rules, developing explanations, and solving multistep problems.
However, an AI-generated explanation is not proof that the model followed a formally valid reasoning process.
A traditional computer program might apply the following explicit rule: IF invoice number matches AND vendor number matches AND payment amount matches, THEN flag the transaction as a possible duplicate.
A language model may recognize the same pattern and produce a similar conclusion.
But the model's response is generated through learned mathematical relationships rather than necessarily executing that exact programmed rule.
Some AI systems can also use external tools, including code execution, databases, and deterministic calculation engines. In those cases, parts of the processing may be governed by explicit algorithms.
This creates two different processing activities:
Probabilistic processing: The AI interprets information and generates language using learned statistical relationships.
Deterministic processing: A program executes defined rules or calculations that should produce the same result for the same inputs under the same conditions.
Both fit within the IPO framework.
For audit applications, deterministic processing is generally preferable when exact calculations, completeness testing, reconciliations, or transaction matching are required.
Generative AI is especially useful for explaining results, developing audit narratives, identifying possible risks, and organizing supporting documentation.
5. An Audit Example: Identifying Duplicate Payments
Assume an auditor is examining 10,000 accounts payable transactions.
The objective is to identify potential duplicate payments.
Input
The auditor provides a transaction file containing:
Field | Description |
Vendor ID | Unique vendor identifier |
Invoice number | Invoice reference |
Invoice date | Date of invoice |
Payment date | Date payment was made |
Payment amount | Amount disbursed |
Payment reference | Check or electronic payment identifier |
The auditor instructs AI to identify possible duplicate payments.
Process
A reliable approach separates the work into two processing stages.
Stage 1: Deterministic analysis
A database query, spreadsheet formula, or Python program identifies transactions sharing specified characteristics.
For example:
Same vendor.
Same invoice number.
Same payment amount.
Different payment reference numbers.
The program produces a list of potential duplicates.
Stage 2: AI-assisted interpretation
The AI reviews the exception report and supporting documentation.
It may help identify plausible explanations, organize exceptions, prepare follow-up questions, and draft an audit finding.
However, the auditor must determine whether the exceptions represent actual duplicate payments.
Two transactions with identical amounts do not necessarily constitute an improper duplicate payment.
Output
The system produces a list of possible duplicate payments and a draft audit observation.
The auditor then validates the exceptions against invoices, payment records, credits, reversals, and other relevant evidence.
The output is a starting point for audit evaluation—not automatically sufficient appropriate audit evidence.
6. The Critical Problem: AI Can Produce Incorrect Information
One of the most significant risks of generative AI is its ability to produce inaccurate information in convincing language.
These errors are commonly described as hallucinations.
An AI system may:
Not have a Auditing Standard that is current.
Misstate a PCAOB auditing standard.
Incorrectly summarize a contract.
Produce an unsupported audit conclusion.
Misinterpret financial information.
Invent a transaction or document reference.
Present an assumption as an established fact.
Why does this happen?
Because generating a plausible sequence of tokens is not the same as independently verifying every factual assertion.
Even when the model has access to supporting documents, it can misunderstand them or generate conclusions that go beyond the evidence.
This is particularly dangerous when AI-generated content is incorporated into audit workpapers without appropriate review.
An auditor could unintentionally document a finding that was never substantiated.
7. Applying the IPO Model to Audit Workpaper Quality
Auditors can use the IPO framework to establish practical controls over AI-assisted workpaper preparation.
IPO stage | Principal audit risk | Recommended control |
Input | Incomplete or inaccurate source information | Verify completeness, accuracy, relevance, and authorization of inputs |
Input | Confidential information disclosed improperly | Apply approved AI tools and data-protection policies |
Process | Incorrect interpretation or unsupported inference | Require documented procedures, cross-references, and independent evaluation |
Process | Mathematical or analytical errors | Use independently validated calculations and deterministic tools |
Output | Unsupported audit findings | Trace conclusions to underlying evidence |
Output | Incorrect regulatory references | Verify citations against authoritative standards |
Output | Misleading or fabricated information | Perform professional review and validation |
Output | Inadequate documentation | Retain sufficient records of procedures, evidence, and conclusions |
The auditor should evaluate all three stages rather than focusing exclusively on the final response.
8. The Importance of Audit Evidence
Consider an AI-generated statement: "The organization has inadequate controls over vendor master file changes."
This may be a reasonable hypothesis.
However, it is not automatically a supportable audit finding.
The auditor must determine: What evidence supports the conclusion?
Relevant evidence might include:
Vendor master file change logs.
User access listings.
Approval documentation.
Segregation-of-duties analysis.
Samples of vendor changes.
Interviews with responsible personnel.
Relevant policies and procedures.
The auditor must evaluate the sufficiency, appropriateness, and reliability of that evidence.
For PCAOB engagements, AS 1105 addresses audit evidence, while AS 1215 establishes audit documentation requirements.
AI-generated narratives do not eliminate these responsibilities.
An audit workpaper must demonstrate the work performed and the basis for the conclusions reached, not merely present a polished summary.
9. A Practical Example: AI Drafting an Audit Finding
Assume an internal auditor identifies 18 vendor master file changes without documented approval in a sample of 60 changes.
The auditor wants AI assistance preparing an audit finding.
Input
The auditor provides:
Audit objective.
Applicable vendor management policy.
Population and sample information.
Testing methodology.
Results of the 60 transactions tested.
Details of the 18 exceptions.
Management explanations, if available.
Process
The AI organizes the information using the five elements of an audit finding:
Criteria: What should exist?
Condition: What did the auditor find?
Cause: Why did the condition occur?
Effect: What is the actual or potential consequence?
Management Action Plan: What corrective action is management considering?
The model generates a proposed narrative.
Output
The AI might draft: "Testing identified 18 of 60 vendor master file changes (30%) without evidence of required approval. This condition increases the risk of unauthorized changes to vendor payment information."
That statement may be supportable if the underlying testing results and approval requirements have been verified.
However, the AI might also state: "The deficiencies resulted from inadequate management oversight."
That statement identifies a possible cause, but the audit evidence provided may not establish it.
The auditor should not accept that conclusion without further investigation.
The appropriate response may be to document the cause as undetermined pending management discussion and additional audit procedures.
AI can help structure an audit finding. It cannot manufacture the evidence necessary to support the finding.
10. What Should Auditors Document When Using AI?
An organization should establish a risk-based policy for documenting AI use in audit engagements.
For significant AI-assisted analyses, I recommend retaining the following information:
Purpose of AI use: Explain why the tool was used and what audit objective it supported.
Tool identification: Identify the AI application and, where available and relevant, the model version.
Inputs: Identify the source documents, datasets, instructions, and assumptions provided.
Processing methodology: Describe the analytical procedures performed, including any external calculations, scripts, or database queries.
AI-generated output: Retain the material response or relevant excerpts that influenced the workpaper.
Validation: Document how the auditor verified important facts, calculations, citations, and conclusions.
Professional judgment: Identify judgments made by the auditor rather than accepting the model's conclusions without evaluation.
Final disposition: Explain whether the AI output was accepted, modified, or rejected.
These are recommended documentation practices, not a claim that every auditing standard requires retention of every prompt or AI conversation.
The level of documentation should reflect the significance of the AI-assisted work and the applicable professional standards and firm methodology.
11. The AI Audit Workpaper: An Expanded IPO Model
For professional audit work, the traditional IPO model should be expanded to include verification and approval.
Input → Process → Output → Validation → Auditor Approval
Input controls
Are the source documents accurate, complete, relevant, and authorized for use?
Processing controls
Were the analytical procedures appropriate? Were calculations performed correctly? Were the AI model's limitations considered?
Output controls
Are the resulting statements supported by evidence? Are the findings properly classified? Are regulatory citations accurate?
Validation controls
Did the auditor independently verify significant calculations, assertions, and conclusions?
Approval controls
Did an appropriately qualified auditor review the completed workpaper and accept responsibility for its conclusions?
This expanded framework aligns AI use with established principles of audit quality, professional skepticism, supervision, and documentation.
It also creates a practical structure for evaluating AI-related risks within an organization's system of quality management.
12. AI Does Not Replace Professional Skepticism
Generative AI can improve auditor productivity.
It can reduce time spent drafting narratives, summarizing documentation, identifying possible anomalies, and preparing preliminary analyses.
However, productivity does not necessarily equal audit quality.
An auditor who accepts AI-generated statements without verification may simply produce unsupported conclusions faster.
The fundamental responsibilities of the auditor remain unchanged:
Obtain sufficient appropriate evidence.
Evaluate the reliability of information.
Exercise professional judgment.
Maintain professional skepticism.
Document the procedures performed.
Support conclusions with relevant evidence.
Accept responsibility for the final audit workpaper.
These responsibilities apply whether the auditor uses a calculator, spreadsheet, database, specialized audit application, or generative AI.
13. The Most Important Lesson for Auditors
Artificial intelligence is not magic.
It is an information-processing technology that operates within the same fundamental Input–Process–Output framework as other computer systems.
Its distinctive capability comes from using complex mathematical models to recognize relationships and generate responses based on learned patterns and available context.
That capability makes AI extremely useful for audit workpaper preparation.
It also creates risks because the model can produce persuasive narratives without independently establishing their factual accuracy.
Auditors should therefore approach AI-generated content as information requiring evaluation—not as automatically reliable audit evidence.
The auditor remains responsible for the inputs, the appropriateness of the processing, the validation of the outputs, and the conclusions documented in the workpapers.
Final Thought
The objective of using AI in auditing should not simply be to create more workpapers in less time.
It should be to create better-supported, more accurate, more consistent, and more useful audit documentation.
The most effective approach combines the analytical and drafting capabilities of artificial intelligence with the evidence-based judgment of a qualified auditor.
AI may generate the response. The auditor must establish whether the response is correct.
Corporate Compliance Seminars (CCS) provides continuing professional education for internal auditors, external auditors, accounting professionals, compliance personnel, and information technology professionals.
Learn more about our auditing, internal control, risk assessment, and artificial intelligence training programs at www.compliance-seminars.com.
Comments