This article is for informational purposes only and does not constitute audit or legal advice. You should consult with a qualified professional before making any decisions about the use of AI in your firm.
What Are the Risks of Using ChatGPT for Audit Work Papers?
Using an AI tool for audit work papers raises two separate questions: whether client data may enter that product, and whether an auditor can verify the generated analysis and record its source. Check the current product terms and firm policy before any client-specific use.
Before using ChatGPT to summarise a document or draft a narrative, decide which material may enter the tool and who will check the result against the audit evidence.
The Confidentiality Catastrophe
Check the terms and settings for the specific service before entering a client's trial balance, a summary of an internal control deficiency or a draft audit opinion. Review training use, retention and access alongside the firm's approval for that material.
Keep a record of the approval and data-handling review so the firm can explain why the use was permitted.
Do not enter confidential client material until the firm has approved the tool and the proposed use.
The Hallucination Hazard
Review generated facts, figures and references against the underlying documents. Treat a fluent summary as a draft to check, not as audit evidence in its own right.
The table gives hypothetical examples of what to check: omitted lease terms, unsupported explanations for financial movements and incorrect interpretations of standards.
| Risk of Using ChatGPT for Work Papers |
Example Scenario |
| Fabricated Summaries |
You ask ChatGPT to summarise a complex lease agreement. It confidently produces a summary that misses a crucial break clause, leading you to misjudge the client's liabilities. |
| Invented Explanations |
You ask ChatGPT to provide a possible explanation for a fluctuation in a client's gross margin. It invents a plausible but entirely fictional reason (e.g., "a previously undisclosed supply chain issue"), sending your audit team down a rabbit hole and wasting hours of time. |
| Misinterpreted Standards |
You ask ChatGPT to explain the application of a specific IFRS standard. It provides a summary that is subtly incorrect, leading you to apply the standard improperly in your audit testing. |
Verify any generated material used in the work papers independently. Record the source and the auditor's review so the reasoning can be followed.
The Illusion of Efficiency
Compare total drafting, correction and checking time with the existing process. Include the effort needed to verify facts and numbers before judging whether a use saves time.
If the reviewer cannot verify a generated passage, exclude it from the work papers until the evidence is resolved.
What About a Private, Enterprise Version?
Check the exact ChatGPT Enterprise feature, account, binding terms and settings for the proposed work papers. Record training, retention and access evidence separately from output testing. Enterprise branding alone establishes neither confidentiality nor reliable audit evidence.
Specify human verification in the audit methodology for any approved AI-assisted task, including how reviewers record corrections and unresolved evidence.
The Bottom Line: There Are No Shortcuts in an Audit
Consider a bounded trial of document summarisation or initial analysis only after the data-handling and reviewer checks are agreed.
Keep professional judgement and scepticism with the auditor. Any draft included in the work papers needs a traceable evidential basis and a recorded review.
Follow the firm's restrictions on client-related use, and escalate proposed uses that are not covered by its policy.
Before expanding a trial, review the corrections, unresolved evidence and total checking effort.
Take the Next Step
Ask what an assessment would cover for your firm: approved tooling, data boundaries, work-paper evidence and reviewer responsibilities. Confirm the scope before commissioning it.
Book a Discovery Call → or learn more about the AI Audit.
Need to make AI useful without weakening audit quality or client trust?
Identify the work worth improving, the evidence to retain and the controls to assess before allowing AI to handle client material.
