AI for Auditors: Full-Population Testing, Exception Logs With Evidence and Findings Memo Drafts (2026)
AI for auditors pulls full populations instead of samples, tests every transaction against your rules, documents each exception with links to its evidence and drafts the findings memo, always for the auditor's review and sign-off. This guide shows the audit workflow SPIRITT runs, a worked example and a checklist.
AI for auditors is an AI agent that does the data work of an audit so auditors can spend their time on judgment: it pulls the full population of transactions instead of a sample, tests every item against the rules in your audit program, documents each exception with links to its source and evidence, and drafts the findings memo. SPIRITT runs that workflow end to end, read-only on client or company data, and every result goes to the auditor for review and sign-off. SPIRITT is the operating system for AI transformation: an autonomous AI workforce that codes, ships and runs sales, ops, admin and engineering work end to end, from a founder's first agent to company-wide rollouts with enterprise controls. For an internal or external audit team that means one agent that reads exports, ledgers, PDFs and scans, composes models inside each task for the optimal mix of capability and price, and leaves a trail of every step it took.
What changes when AI tests the whole population
Sampling exists because testing every transaction by hand is too slow. An agent can read every row, so the question changes from "is the sample clean?" to "which items broke a rule, and why?". The auditor's skepticism, materiality and conclusions stay human.
| Audit step | With sampling by hand | With an AI agent |
|---|---|---|
| Population | Request, then pick 25 to 60 items | Every row loaded, with completeness reconciled to the ledger total |
| Testing | Tick and tie each sampled item | Every item tested against each rule in the program |
| Exceptions | Noted in a workpaper by hand | Exception log with rule, amount, user, date and evidence link |
| Evidence | PBC requests by email, chased by hand | Request list drafted per exception, received documents matched to items |
| Workpapers | Built from scratch each period | Procedures, results and tickmarks documented as the test runs |
| Findings | Memo written at the end | Draft memo with condition, criteria, cause, effect and recommendation |
This guide is about audit testing. For ongoing compliance monitoring and evidence for frameworks, read AI for compliance, and for payroll checks across countries, read payroll audits at scale.
The audit workflow SPIRITT runs
- Loads the full population. The agent reads the exports you provide or connects read-only to the source: the general ledger, AP and AR subledgers, the vendor and employee masters, expense reports, access logs or bank statements. It reconciles record counts and totals to the trial balance or control report before any test runs, so completeness is documented.
- Turns the audit program into rules. You give it the procedures in plain words: "three-way match on every invoice over the threshold", "no journal entries posted by the preparer and approver in the same login", "no payments to vendors with bank details changed in the last 30 days". It writes each as an explicit, readable test and shows you the logic before running it.
- Tests every item. It runs each rule across the whole population, in code, so the same test gives the same result every time and can be rerun next period.
- Builds the exception log. Each exception gets a row in Google Sheets or Excel: transaction ID, rule, amount, date, user, counterparty, a link to the source row and the documents behind it (invoice PDF, approval email, contract clause).
- Requests and matches evidence. For exceptions that need support, it drafts the request list for the client or the process owner and matches documents to items as they come back, noting what is still missing.
- Documents the work. The workpaper records the objective, the population and its reconciliation, the rules, the results per rule and the tickmarks, so a reviewer can follow every step.
- Drafts the findings memo. For confirmed exceptions it drafts each finding as condition, criteria, cause, effect and recommendation, and a summary table by rule and severity for the audit lead.
- Reruns next period. The tests stay saved as a routine, so the next quarter or year runs the same program on new data, and continuous auditing becomes a schedule.
The audit testing workflow SPIRITT runs, with the auditor reviewing and signing off
SPIRITT connects to QuickBooks, NetSuite, SAP and other ERPs, Google Sheets, Excel, SharePoint, Google Drive and 1,500+ other apps, and processes PDFs, spreadsheets and scans. Systems with no API, such as a legacy ERP screen, are handled by the agent's cloud computer, which works inside the app like a person under read-only rules.
Worked example: testing a full year of vendor payments
This example shows the workflow; it is not a customer story, and the thresholds are illustrative.
The situation. An internal audit team plans an accounts payable review. In past years they tested a sample of payments and walked through the vendor setup process. This year the audit lead asks for every payment in the year to be tested.
The population. The team gives SPIRITT the payment export, the invoice register, the vendor master with its change log and the approval matrix. The agent loads every payment, reconciles the total to the AP control account and documents the match in the workpaper.
The tests. It runs the rules the lead approved: duplicate invoice numbers and amounts for the same vendor, payments to vendors created or changed shortly before payment, payments released by the same user who set up the vendor, amounts just under the approval limit, weekend and holiday payments, and bank details that differ from the master file. Each rule is a short script the team can read.
The exceptions. The log shows a small set of hits per rule, each with a link to the payment, the invoice PDF and the vendor change entry. Most have a clear explanation, such as a recurring weekend payroll tax payment. A few do not: two payments with the same invoice number and amount a week apart, and a vendor whose bank account changed days before a large payment. The agent drafts the evidence requests for those items.
The memo. When the evidence is back, one duplicate is confirmed and recovered, and the bank change was properly verified. The agent drafts the finding for the duplicate as condition, criteria, cause, effect and recommendation, plus a note on the control that would have caught it.
What the auditors did. Approved the rules, reviewed every exception, judged the explanations, decided which were findings and signed off the workpaper and memo.
How to choose AI for auditors
- Works on full populations and documents completeness against the ledger
- Turns your audit program into readable, repeatable tests
- Logs each exception with the rule, source row and evidence links
- Stays read-only on client and company data
- Documents procedures and results in workpaper form a reviewer can follow
- Drafts findings in your format for the auditor to edit and sign
- Reruns the same tests next period as a routine
- Has access rules, audit logs, SSO and data controls your firm accepts
Eight questions to ask before AI joins your audit team
Independence, evidence and the auditor's sign-off
AI changes how much an audit team can test, not who is responsible for the conclusion. Keep the agent read-only on source systems, keep the test logic visible and saved with the workpaper, and keep every judgment, from materiality to whether an exception is a finding, with the auditor. SPIRITT applies Read, Write and Destructive rules per integration with single-use approvals, keeps audit logs of every action, and offers SSO, scoped roles, protected secrets and zero data retention model routes. Firms with strict data rules can run SPIRITT in their own cloud with BYOC or air-gapped deployment.
Where general AI tools fit
General assistants such as Microsoft Copilot and Gemini can summarize a contract or explain a standard when you paste text in, and spreadsheet copilots can help write a formula. An audit team gets the most from an agent that holds the whole engagement in context: the population, the program, the exceptions, the evidence and the memo, and that writes and runs the tests as code so they can be reviewed and rerun. That is the work SPIRITT runs.
FAQ
How can auditors use AI?
Auditors use AI to load full populations, test every transaction against the audit program, build exception logs with evidence links, draft evidence requests and workpapers, and draft findings memos. SPIRITT runs these steps read-only and the auditor reviews and signs off.
What is the best AI for auditors?
The best AI for auditors tests full populations with readable, repeatable rules, documents completeness and evidence, stays read-only on source data and drafts findings for review. SPIRITT does that, with access rules and audit logs.
Can AI replace audit sampling?
For many tests, yes: SPIRITT tests every transaction against your rules instead of a sample, so the auditor reviews exceptions rather than a selection. Whether full-population testing meets your methodology for a given assertion is the auditor's call.
Can AI do journal entry testing?
SPIRITT tests every journal entry against the criteria you set, such as entries posted after close, by unusual users, on weekends, with round amounts or just under approval limits, and lists each hit with its source line for review.
Will AI replace auditors?
No. AI takes the data loading, testing and first drafts. Auditors keep professional skepticism, materiality, judgment on exceptions, client conversations and the sign-off.
Is it safe to use AI with client audit data?
It can be, with read-only access, audit logs, SSO, scoped roles, zero data retention model routes and deployment options that keep data in your environment. SPIRITT provides these, including BYOC and air-gapped deployment.
How we checked
SPIRITT publishes this guide. It does not give audit, accounting or legal advice; audit methodology and standards differ by firm, engagement and jurisdiction, and every output in this workflow is reviewed by the responsible auditor. SPIRITT facts and controls come from spiritt.ai, spiritt.ai/enterprise and the SPIRITT docs, checked in November 2026. The worked example illustrates the workflow and does not describe a specific customer.
