The Auditability of Agents

Welcome to issue #011 of New Age Accounting. The audit is coming. Here's how to be ready when it does.

May 18, 2026

The profession is moving fast. The audit is coming. The question is whether you’ll be ready when it does.

The accounting profession is in a building phase right now. Workflows are being automated. Closes are getting faster. Commentary that used to take hours is being produced in minutes. The tools are here, the results are immediate, and the momentum is real.

But here’s the question almost nobody is asking while they’re building:

Can you defend it?

Not “does it look right” or “does it pass the gut check”. But, can you sit in front of an auditor, a CFO, or a board member and walk them through exactly what happened, what the AI did, what you reviewed, and why you’re confident in the output?

That’s the auditability question. And the accountants building with AI right now need to be thinking about it from day one – not after the audit work has begun.

What is an AI agent?

An AI agent isn’t just a chatbot that answers a question. It’s a system that executes multiple steps, makes decisions along the way, and produces an output — often without accountants watching and being involved in the output step by step like they have in the past.

Said another way, when you ask Claude a question in Chat, you’re conversing. You see every response. You adjust and review the output. Then you make the decision of what you do with it.

An agent is different. You assist with the initial setup and tweaks but once you go live, it’s hands off. You give the agent a task (e.g. run analysis, process data, generate report) and it works through the steps autonomously. The output arrives and the steps that produced it aren’t always visible — and that is exactly where the auditability question lives.

The more powerful and reliable the agents, the higher the audit risk.

And that risk doesn’t manage itself.

Why this matters

For decades the profession has built audit standards around human work. A human has prepared reconciliations – there’s a paper trail, a reviewer, a sign-off. A human has written the variance commentary – all with preparer, reviewer and other records of the process.

AI agents are being treated as task replacements. The agent did the reconciliation. The agent wrote the commentary. Task complete. But that framing misses something critical.

In terms of auditability, these workflows deserve the same level of scrutiny we’d apply to any automated process in a financial system. Except there’s a human element that makes it even more important — because the output is only as good as the person who built it. The instructions they gave. The context they provided. The review they built in. The judgment calls they made along the way.

That’s what makes the Accounting Engineer’s role so important here. You built it. That means you own it. And owning it means being able to defend every step of it when the auditor arrives.

That’s the standard. Everything else in this article is about how to meet it.

Why assertions still matter

If you’ve spent any time in public accounting or working closely with auditors, you know the assertions. Existence. Accuracy. Completeness. Cutoff. Presentation. They’re the foundation of how auditors gain assurance over financial statements — the questions they’re asking when they pull a sample, test a control, or trace a transaction.

They didn’t go away when AI arrived. If anything, they became more important.

Here’s why: when a human prepares a reconciliation, an auditor can sit down with that person and ask them to walk through every step. Where did the data come from? How did you identify the reconciling items? What did you do when something didn’t tie? The human can answer. The evidence exists. The judgment calls can be explained.

When an AI agent runs that same reconciliation — who answers those questions?

That’s not a reason to stop building. It’s a reason to build differently.

The assertions as a lens

You don’t need to go deep on every assertion to make this point — but it helps to see them as a lens for evaluating any AI workflow you’re building or deploying.

Existence — did this transaction actually occur, and can you prove the agent processed it correctly? If an agent is touching transaction data, the auditor is going to want to know the process was reliable and the output reflects reality. What’s your evidence?

Accuracy — is the amount right? AI can produce outputs that look correct and aren’t. Without a defined verification step built into the workflow, a plausible-looking wrong number can move through a process unchallenged. Accuracy doesn’t assume itself just because AI produced the output.

Completeness — is everything that should be there, there? An agent following instructions doesn’t know what it doesn’t know. If something falls outside the parameters you set, it may not flag it. Completeness requires the person who built the workflow to have thought through the edges — what could be missing and how would we know?

Cutoff — is it in the right period? Period-end judgment calls are some of the most nuanced decisions in accounting. An agent doesn’t have the context for those calls unless you’ve built it in explicitly. Cutoff errors are one of the most common audit findings — and they don’t get less likely just because AI is involved.

Presentation — is it presented correctly? An agent presents based on the instructions and context it was given. If the context is incomplete or the instructions are ambiguous, classification errors follow. The auditor is going to ask how you know it’s right.

The question underneath all of them

Every assertion comes back to the same underlying question: can you demonstrate that the process produced a reliable output — and can you show your work?

For a human process, showing your work is second nature. For an AI workflow, it has to be intentional. It has to be built in. Because if you can’t answer the assertion questions, the auditor can’t gain assurance — and without assurance, the work doesn’t stand.

This is what is going to separate the successful audits from the ones that result in deficiencies.

What Goes Wrong Without Auditability

Let’s get specific. Because the risk here isn’t theoretical — it’s the kind of thing that shows up in audit findings, management letters, and uncomfortable conversations with your CFO.

Here are three scenarios where the absence of an audit trail becomes a real problem.

1/ The auditor asks why — and you can’t answer.

You built a workflow that generates variance commentary. The numbers look right. The narrative reads well. The CFO signed off. Then audit fieldwork starts and the auditor pulls the workpaper. They want to understand the methodology. How was the variance calculated? What data did it pull from? How do you know it captured everything?

You ran a prompt. You reviewed the output. It looked right so you moved forward.

That’s not a methodology. That’s a task. And there’s a significant difference between the two when an auditor is sitting across the table asking questions you can’t answer.

2/ The output was wrong and nobody caught it.

AI produces plausible-sounding outputs. That’s one of the things that makes it so useful — and one of the things that makes it genuinely dangerous in a financial context if there’s no structured review layer.

Hallucination is real. Gaps in context produce gaps in output. An agent that wasn’t given the right parameters will work within the ones it was given — and produce something that looks complete when it isn’t. Without a defined verification step built into the workflow, a wrong number moves through unchallenged. It makes it into the report. Into the board deck. Into the filing.

By the time someone catches it, the damage is done.

3/ Nobody owns it.

This is the one that keeps coming up and it doesn’t have a clean answer yet.

When an AI agent makes a decision in a financial workflow — who is responsible for that decision? The accountant who built the workflow? The one who reviewed the output? The one who signed off on the report?

Without clear ownership built in from the start, the answer defaults to nobody. And nobody is not an acceptable answer when a deficiency gets written up, when a restatement conversation starts, or when someone is trying to understand how an error made it through the process.

The agent didn’t make the decision. The person who deployed the agent made the decision. That accountability has to be explicit — in the workflow, in the documentation, and in the mindset of whoever built it.

These aren’t edge cases. They’re the natural consequence of moving fast without building the right infrastructure around what you’re creating. The next section is about what that infrastructure actually looks like.

Building It Right From Day One

The good news is that auditability isn’t complicated. It’s not a separate workstream or a box you check at the end. It’s a mindset you bring to the build — and if you bring it from the start, it becomes part of the workflow rather than something you retrofit after the fact.

Here’s what building it right actually looks like.

1/ Design with the assertions in mind.

Before you deploy any AI workflow into a live financial process, ask yourself the assertion questions. Can I demonstrate existence? Can I prove accuracy? Can I show completeness? Can I defend cutoff? Can I explain presentation?

If you can answer those questions before you build, you’ll build differently. You’ll think about what evidence needs to exist, where the human review points need to be, and what documentation needs to accompany the output. You’re not building a prompt. You’re building a process. And processes have standards.

2/ Build human checkpoints at the right moments.

AI doing the work doesn’t mean humans are out of the picture. It means humans are in the picture at the right moments — not reviewing everything, because that defeats the purpose, but reviewing the things that matter most.

A human checkpoint isn’t “I looked at the output and it seemed fine.” It’s a defined review step tied to a specific assertion. For a flux analysis — did a human confirm the variance drivers are accurate and complete before this goes to the CFO? For a reconciliation — did a human verify that the items flagged by the agent are the right items and nothing was missed?

The checkpoint needs to be documented. Who reviewed it, when, and what they confirmed. That documentation is your audit trail.

3/ Document the methodology.

Every AI workflow that touches a financial process needs a documented methodology. What instructions were given to the agent? What context was provided? What data did it have access to? What was it asked to produce?

This doesn’t have to be a lengthy document. It has to be clear enough that someone unfamiliar with the workflow could pick it up and understand what was done, why it was done, and on what basis. That’s the same standard we’ve always held human work to. It applies here too.

If you built it and you can’t explain it, it’s not ready.

4/ Own the output.

The agent isn’t the accountant. The person who designed the workflow, set the instructions, and deployed it into the process owns the output. Full stop.

That ownership is what makes everything else defensible. The auditor doesn’t need to gain assurance over the AI — they need to gain assurance over the process. And the process has a person behind it. That person needs to be able to stand behind it.

5/ Test it before you trust it.

Before any AI workflow goes live in a financial process, run it the way an auditor would test it. Pull one transaction. Trace it end to end. Follow every step from input to output. Can you explain every decision the agent made along the way? Can you tie the output back to the source data?

If you can do that — if you can walk an auditor through the workflow the same way you’d walk them through a manual process — it’s ready. If you can’t, it isn’t.

This isn’t about slowing down the build. It’s about making sure what you built actually holds up. The goal is an AI workflow you can defend with the same confidence you’d defend any other control in your process.

Getting Auditors on Board

This is the question underneath everything else in this article: how do auditors actually gain assurance over AI agents?

The honest answer is the profession is still working through it. The standards are evolving. The guidance is catching up. But the framework for how auditors gain assurance hasn’t fundamentally changed — and that’s actually the most useful thing to understand right now.

Auditors gain assurance the same way they always have. They understand the control environment. They test the controls. They verify the outputs. They ask questions and expect answers. The fact that an AI agent is involved in the process doesn’t change what they need — it changes what you need to give them.

And right now, most AI workflows aren’t built to give them anything.

Get your own house in order first.

Before you think about the auditor, think about yourself. Can you sit down today and walk someone through every AI workflow you’ve deployed into your financial process? Do you know what instructions each agent was given? Do you have the methodology written down? Do you know where the human review points are and what they confirmed?

If the answer is no — start there.

Organize your agents and your Projects. Document what each one does, what it was built to produce, and what the review process looks like. Build a simple log of the workflows you’ve deployed — what they are, when they were implemented, and who owns them. This doesn’t have to be complicated. It has to exist.

The goal is simple: if someone walked in tomorrow and asked you to explain your AI workflows, you could do it. You could pull the documentation, walk them through the methodology, show them the review steps, and answer the assertion questions with confidence.

That’s the foundation. Everything else builds on top of it.

Then inform your auditors.

Once your house is in order, bring your auditors into the conversation — not to co-build the workflow, not to get their sign-off before you proceed, but to make sure there are no surprises when fieldwork starts.

A brief conversation early goes a long way. Here’s what we’ve been building. Here’s how we’ve documented it. Here’s where the human review lives. Here’s what the output looks like and how we verify it.

That conversation doesn’t need to be extensive. It needs to happen before the audit — not during it. An auditor who has context going into fieldwork is a very different experience from an auditor who is seeing your AI workflows for the first time while they’re trying to gain assurance over your financials.

You’re not asking for permission. You’re giving them the visibility they need to do their job. That’s a professional courtesy that will pay off every time.

The profession is defining this in real time.

There are no perfect answers here yet. The standards will catch up. The guidance will get more specific. Best practices will emerge. But right now, in this building phase, the accountants who are thinking about auditability — who are organizing their workflows, documenting their methodology, building human review into the process, and owning their outputs — are the ones writing the first draft of what responsible AI use in accounting actually looks like.

That matters. Not just for your audit. For the profession.

Build With the End in Mind

The profession is in a building phase. The tools are real, the results are real, and the momentum isn’t slowing down. Accountants are automating processes that used to take days. They’re producing outputs that used to require teams. They’re moving faster than anyone expected.

And most of them aren’t thinking about what happens when the auditor arrives.

That’s the gap. Not the technology. Not the tools. The mindset.

AI agents are being deployed into financial workflows the way a task gets handed off — here’s what I need, go do it. But unlike handing a task to a person, the agent can’t sit in a room and explain its work. It can’t walk an auditor through every step. It can’t answer the questions that fieldwork generates.

That’s your job. You built it. You own it. You have to be able to defend it.

The Accounting Engineer who understands this builds differently from the start. They’re not just asking “what can this agent do” — they’re asking “how do I build this in a way I can stand behind.” They design with the assertions in mind. They document the methodology. They organize their workflows before anyone asks them to. They build the human checkpoints in. They own the output.

That’s not a constraint on building. That’s what building responsibly looks like.

The audit is coming. The standards are evolving. The profession is figuring this out in real time. The accountants who bring auditability into the build from day one — who treat their AI workflows with the same rigor they’d apply to any other control in the process — are the ones who will be ready.

The ones who don’t will find out the hard way.

Build with the end in mind. Always.

Here’s my question to you:

How are you thinking about auditability in your AI workflows right now? Are you building the audit trail in from day one — or figuring it out as you go? Drop it in the comments. This is a conversation the profession needs to be having.

Discussion about this post

Ready for more?