ChatGPT for Auditors: Working Paper Drafting and Where It Stops

Yes, a small audit practice can use ChatGPT to draft working-paper wording, such as test narratives and file notes, from material the auditor already holds. It cannot gather evidence, judge it or conclude. A person must verify every statement against the evidence, keep confidential data out, and document what was drafted with AI and who reviewed it.

The line is easy to state and easy to cross. A drafted sentence like "We inspected a sample of 25 purchase invoices and agreed amounts to the ledger without exception" reads well whether or not anyone did that. The risk in audit is a clean paragraph describing work that was not done, or conclusions the evidence does not support. For the owner or manager of a small practice, that leaves four decisions: what to draft, how to feed it, what to check and what a reviewer will want to see in the file.

Follow me on Instagram@sagnikteaches

What ChatGPT can and cannot do on an audit file

It can turn your rough notes into clear sentences, suggest a structure for a test narrative, reword a long paragraph for clarity, produce a checklist from a description of a process and draft a list of questions for a walkthrough. It cannot see the evidence unless you paste it, cannot know what you actually did, and has no professional scepticism: it is built to produce likely-sounding text, not to doubt the client.

Connect on LinkedInSagnik Bhattacharya

OpenAI's usage policies point the same way: they bar building or offering AI tools that give others tailored advice requiring a licence without a licensed professional involved, and they bar implying that the AI itself holds professional credentials. An auditor drafting their own papers is a different case, but the principle carries over: treat the tool as drafting support for the person who holds the responsibility. Whatever the auditing standards in your jurisdiction require of documentation, the drafting tool does not change them: the file must still show the work performed, the evidence obtained and the conclusions reached, by named people.

Subscribe on YouTube@sagnikteaches

Confidentiality first: what may be entered

An audit client's information is confidential by duty and often by contract. Decide the practice's position in writing before anyone drafts anything. A workable rule has three levels. Level one, allowed: generic descriptions of a process ("a retailer receives goods, matches the delivery note to the purchase order, and posts the invoice"). Level two, allowed with a coded name and the engagement partner's agreement: your own notes about a client's control, with names, amounts and account numbers replaced. Level three, not entered: financial statements, ledgers, bank details, payroll data, anything with personal information, and anything the client has asked you not to share.

On the tool: OpenAI's enterprise privacy commitments rule out training on business data by default for ChatGPT Business, Enterprise and the API, and its Business overview says a workspace needs at least two seats, which even a two-partner practice can meet. On a personal Plus or Pro account, chats are shared for training until the user turns off "Improve the model for everyone". Either way, the plan lowers one risk; confidentiality duties to your client still decide what you may enter. If you are unsure whether engagement terms allow it, ask the client, and consider adding an AI-use clause to the engagement letter. Questions to ask before buying AI that touches client data gives a list you can adapt.

Drafting a test narrative from your own notes

A test narrative describes what you did, on what, how many items, and what you found. The auditor already knows all of this; the writing is the slow part. The best use is to feed your bullet notes and ask for prose, forbidding additions.

Turn these notes into a working-paper narrative for a test of purchase invoice approval.
Use only the facts in the notes. Do not add procedures, sample sizes, dates or conclusions that are not stated.
If something a reviewer would expect is missing, list it under "Gaps in notes" instead of filling it in.
Structure: Objective; Procedure performed; Population and sample; Results; Exceptions; Conclusion (as stated in my notes).
Notes:
- objective: check invoices are approved before posting
- population: [N] invoices in the period, sample [n] selected [method]
- inspected approval signature and date on each
- [x] exceptions: [describe]
- my conclusion: [as I recorded it]

A realistic output reads cleanly under each heading and, if you did this properly, ends with a "Gaps in notes" list such as "No selection method stated; no tolerance for date differences stated". Those gaps are the most useful part: they are what a reviewer would have raised. The flaw to check for is quiet embellishment: "all invoices were approved by an appropriate authorised person" where your notes said only that signatures were present. Check: read each sentence and point to the line in your notes or the file that supports it. Delete anything that you cannot point to.

Turning a client process description into a walkthrough record

Walkthroughs generate messy notes. After a meeting with a client's finance manager, you may have a page of fragments. Strip names and amounts, and ask for an ordered description plus questions to follow up.

Below are my notes from a walkthrough of a small independent bookshop's sales cash handling, with names removed.
1. Rewrite them as a numbered process description in the order things happen.
2. Mark any step where the notes do not say who does it, or what record is produced.
3. Suggest follow-up questions for a reviewer. Do not assume controls that are not described.
Notes: [paste]

A sample result is a nine-step description with two steps flagged: "who counts the till at close?" and "is the daily takings sheet signed?" These are the questions a good manager would have asked on the day. Check: send the description back to the client contact to confirm it is accurate, which is also a normal part of a walkthrough, and file the confirmed version, not the draft. The confirmed record is your evidence that the process was understood.

Drafting a summary of exceptions without softening them

A common drift: a drafting tool turns "three of the 25 invoices had no approval" into "a small number of exceptions were noted". That wording hides the rate. Tell it to keep numbers and avoid evaluative adjectives.

Write a factual summary of the exceptions below. Keep every count and amount exactly as given.
Do not use words like "minor", "isolated", "immaterial" or "satisfactory": the engagement partner decides those.
Present as a table: ref, description, count, amount, management response (quote as provided).
Exceptions: [paste]

The table that comes back is dull, which is the aim. Judgement words, such as whether the exceptions are significant, are for you and the partner after considering the population, the type of misstatement and what the control is meant to prevent. Check: confirm that the table's counts total the exceptions in the file, that nothing was merged or dropped, and that quoted management responses are verbatim.

Where it stops: tasks to keep out of ChatGPT

• Selecting samples and evaluating results. Use your own method and tools; the sampling and the maths need to be reproducible and documented.
• Concluding on the control or balance. Draft the wording of your conclusion if you wish, after you have reached it.
• Assessing fraud risk or going-concern. These need professional judgement and enquiry; a tool can offer a question list, not an assessment.
• Anything involving the client's actual data unless the practice policy and the client allow it.
• Replacing the reviewer. A model reading a paper can miss that evidence is absent; it does not know what should be there beyond what the text says.

Be wary of asking it to "check my working paper is complete". It will say yes politely. Ask for specific things a reviewer would query, and treat the output as a prompt for your own questions, not a pass.

The evidence trail a reviewer should see

If a partner, a quality reviewer or a regulator's inspector reads the file, they will want to see how AI was used. A short, consistent record covers this. Add a standard note to the file index or a drafting log with five fields: which paper, what was drafted with AI (narrative, summary, question list), what source material was supplied (described, not pasted), who reviewed it and date, and what was changed. Keep the original notes as well as the final paper, so that the reviewer can see the path from evidence to wording.

Illustration: a log line reads "Purchases approval test narrative; drafted from preparer's notes (coded client); gaps list produced; reviewed by manager, 14 Nov; changed two sentences that overstated what was inspected". Over a year, such a log shows a pattern: where drafting helps, where reviewers keep changing things. If your reviewers keep deleting a certain kind of sentence, add a rule to your prompts.

Do not paste ChatGPT's conversation into the audit file as if it were evidence. It is a drafting aid, not an audit procedure. The evidence is the invoice, the inquiry response, the count. The paper's wording is the preparer's, adopted by signing it.

A payroll test at a seven-person practice, start to finish

Take a hypothetical seven-person practice auditing a small independent bookshop, with every figure invented. The senior performs a payroll test: sample of 15 pay records from 120 for the year, agreeing hours and rates to approved timesheets and contract details, and recalculating gross pay. Notes run to 20 lines, with two exceptions: one timesheet signed a week after payment, one rate that differed from the contract by $0.50 an hour.

The senior replaces employee names with codes (E01 to E15), removes amounts other than the rate difference, and runs the narrative prompt. The draft comes back in six headed sections plus a gaps list: "No selection method stated; no statement of whether the pay period for each record was recalculated; no population total". The senior adds the method and population from the file, which turns out to matter, because the manager would otherwise have raised it in review.

The exceptions prompt produces a two-row table. The senior fills the conclusion by hand, referencing the extent of the exceptions and the extra work performed, then asks the manager to review. The manager changes one sentence: the draft said "timesheets were approved", but the notes only said timesheets were signed. Total drafting time falls from about 70 minutes to about 40, in the senior's estimate, with the saving coming from prose and the gaps list; the verification took as long as ever. The file records the AI use in the drafting log.

One supplier-payment exception, worded three ways

Seeing the drift makes it easier to catch. Start from a note: "Tested 20 supplier payments; 2 paid before invoice approved; both approved later same week; amounts $640 and $1,150." A careless draft says: "Payments were generally approved appropriately with minor timing exceptions." That sentence loses the count, the amounts and the fact that approval came after payment, and it adds "appropriately", a judgement.

A tightened prompt gives: "Of 20 supplier payments tested, 2 (10 per cent) were paid before the invoice was approved. Both were approved later in the same week. The amounts were $640 and $1,150." That keeps the evidence and leaves the evaluation for the preparer to add after considering whether the control failed. The third version, which you would write yourself after thinking, adds what you did next: "We extended testing to a further 10 payments from the same weeks and found no further exceptions." Only the preparer can write that sentence, because only the preparer did the work. If ChatGPT offers it unprompted, it has made it up.

When "designed as described" turned into "effective"

A senior asks ChatGPT to tidy a planning memo and receives a paragraph saying that "the entity's internal controls were assessed as effective". The notes only said that the walkthrough found controls "designed as described". Design is not operating effectiveness, and no tests had yet been run. The sentence read smoothly and survived the preparer's read-through, because it sounded like standard audit language. A manager caught it, as the memo contradicted the test plan on the next page.

The lesson for a practice: banned-word lists help. Tell the tool never to use "effective", "adequate", "appropriate", "reliable", "satisfactory", "material" or "significant" in a draft; add them as a standing line to every audit prompt. Where a paper needs those words, the preparer types them after deciding. You will still find the occasional one slipping through, which is why the reviewer's second question (does the wording match what was done?) matters.

Other file notes worth drafting with help

Beyond test narratives, a small practice writes dozens of short documents where wording takes time and judgement does not. Meeting notes from a client call can be turned into a dated file note: who attended (roles), topics discussed, information requested and by when. Ask for a bulleted action list with an owner and a date for each, and check every date. An understanding of the entity's business can be drafted from your own bullet points into continuous prose, with a flagged list of anything not covered.

Management letter points are another good candidate, because they follow a pattern: observation, risk, recommendation. Give it the observation and ask for a neutral draft of the risk in plain words and a practical recommendation the client could follow. Keep the severity rating and the decision on whether to raise the point for the partner. Illustratively, a bookshop that lets one person order stock, receive it and approve supplier invoices gets a draft recommendation to split two of those roles or to add a monthly owner review, written in two or three plain sentences. The partner changes "should" to "may wish to" where that suits the relationship.

Plain-language rewrites are low-risk: take a paragraph you wrote and ask for a shorter version with the same facts. Check that the facts survive and that no qualifier went missing. "Subject to the receipt of the bank confirmation" is the kind of phrase that disappears when text is shortened, and its absence changes the meaning.

Training juniors without teaching them to skip the thinking

The risk in a small team is that trainees learn to draft before they learn to test. Set two rules. First, a junior writes their own notes before touching any tool; the notes are what the reviewer will check against. Second, a junior must explain in their own words what each procedure was meant to show before the narrative is drafted. A narrative that comes from ChatGPT without that thinking tends to describe a standard procedure, not the one that was performed.

A simple exercise for the team: take a completed, signed-off paper from last year with client details removed, give a junior only the preparer's notes and ask for a narrative. Compare it with the signed version and mark every sentence that goes beyond the notes. Discussing those sentences, usually two or three in a page, is quick training in professional scepticism about the drafts as well as the client.

What it costs and what it saves, as a quick sum

Illustrative arithmetic only. If a practice prepares 40 test narratives and file notes a month and each takes 30 minutes to write, that is 20 hours. If drafting help cuts writing to 18 minutes, the saving is 12 minutes each, or 8 hours a month. Verification against the notes takes perhaps 5 minutes per paper, so the net saving is nearer 4.7 hours a month. At those figures, the value lies in the gaps list and consistency more than in raw hours. Plan prices change, so check the current pricing page before assuming a number, and weigh your own time against whatever seat or subscription cost applies. Use your own timings from a month of real work rather than these.

The unmeasured cost is review: if reviewers have to spend extra time untangling overstated drafts, the saving disappears. Track the number of review comments per paper that say "not supported by file" before and after you start. If that count rises, tighten the prompts and the preparer's check before widening use.

When the client objects

Some clients will not want AI used on their file. Record the request, follow it and do not argue; the drafting savings are not worth the relationship. Others will ask detailed questions: which tool, which plan, what is entered, where is it stored. Keep a short answer sheet: the tool and plan type, the rule that no identifying data is entered, the human review step and the log. Where a client asks for assurance in writing, check the wording with the engagement partner before sending, and never promise more than your policy delivers.

What the practice's AI policy page must cover

A small practice does not need a long policy; it needs one that people read. Cover who may use AI tools and on which account; what may and may not be entered, in the three levels above; the tasks that are allowed (narratives, summaries, question lists, plain-language rewrites) and the tasks that are not (sampling, conclusions, risk assessments); the review and logging requirement; and how to report a mistake, such as pasting client data into the wrong account. Review it every six months, because the tools and their terms change, and add a line to engagement letters if your terms or professional guidance call for one.

For a ready-made set of prompts to start from, ChatGPT prompts for auditors: client request lists and workpaper notes is the companion piece, and for the client-facing side of evidence requests, AI agents for chasing evidence requests covers a different use of the same technology.

Checking a drafted paper: a reviewer's five questions

Give reviewers a short script so AI-assisted papers get the scrutiny they need. First, can every factual statement be traced to a document, count or enquiry in the file? Second, does the procedure described match the procedure the preparer's notes show they performed? Third, are numbers consistent between sections: sample size, exceptions, totals? Fourth, are there evaluative words, such as "satisfactory", that the evidence does not yet support? Fifth, does the conclusion belong to a named person who took responsibility for it?

Spot checks help. Once a quarter, pick two AI-assisted papers at random, compare them to the underlying evidence and note anything the draft overstated. Illustratively, if one in four contains an overstated sentence, tighten the prompt rules and the preparer training. If none do over several quarters, you have evidence that the process works, which is worth recording for your quality-control file.

Questions small audit practices ask about ChatGPT

Can ChatGPT form an audit conclusion?

No. Conclusions rest on evidence the auditor has examined and on professional judgement, which cannot be delegated to a drafting tool. Use it to word what you did and found, then make sure each statement matches the evidence in the file and your own conclusion.

Should I tell the client we use ChatGPT?

Check your engagement terms, your firm's policy and your professional body's guidance. Many practices add a line to the engagement letter. Even where it is not required, telling the client what is and is not entered into AI tools is good practice and avoids surprises.

Do AI-drafted working papers need special review?

They need the same review as any paper, with extra attention to whether each statement is supported by evidence in the file. A reviewer should be able to trace every sentence to a document, a count or an inquiry; a fluent sentence with no source is a finding.

Which client information is safe to enter?

Prefer none that identifies a person or the entity. Describe the process in generic terms or use coded names. Check the plan's data terms: business plans do not train on workspace content by default, individual plans have a setting. Confidentiality duties still apply either way.

Further reads

• How to Stop AI Tools Training on Your Business Data — Settings to check so client material is not used for training.
• How Accountants Use AI to Spot Errors in Client Books — Using AI to spot errors in client books.
• How to Mention AI Use in Client Contracts and Proposals — How to mention AI use in client contracts and letters.
• ChatGPT for Accounting With Excel: Seven Tasks, Each With Its Check — Seven Excel tasks with the check for each one.
• AI Tool Approval Process: How Staff Request a New AI Tool — How staff request a new AI tool before using it.
• How to Handle Staff Who Over-Rely on AI — Handling staff who trust drafts without checking them.
• ChatGPT for Civil Engineers: Reports, Method Statements and Emails — A civil engineer's guide to ChatGPT for reports, method statements and emails, with data-leak safeguards for project files and checks for each output.
• Can AI Select an Audit Sample? Document and Defend It — A small-practice method for AI-assisted audit sampling: a reproducible selection in Excel or Python and the documentation wording a reviewer can test.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: OpenAI enterprise privacy page, OpenAI usage policies, and OpenAI help articles on ChatGPT Business and data controls, checked 4 November 2026.