AI for Tax Audit Support: Document Requests, Timelines and Draft Replies

Yes, a small tax practice can use AI to organise document requests and draft replies during a tax audit, provided the AI only sorts, lists and drafts. A tracker shows each request, its due date and its status, AI prepares a first reply from facts you supply, and the preparer checks every statement and the deadline against the notice before anything is sent.

The saving is in the paperwork around an audit, not the judgement inside it. A notice that asks for 23 items arrives; somebody has to split it into tasks, chase the client, index what comes back, and write a cover letter. That clerical load is where AI helps. Deciding what the practice will say about a client's position is not, and nothing below changes that.

Follow me on Instagram@sagnikteaches

What a small practice actually needs from audit support

Large firms build audit platforms. A practice of three to ten people, handling perhaps a handful of open enquiries at any time, needs something far smaller: one place where every open audit or enquiry is listed, every request is broken into separate items, and nobody has to remember when the next response is due. If you can answer "which clients have something due this week, and what are we waiting for?" in ten seconds, the system is good enough.

Connect on LinkedInSagnik Bhattacharya

That can be a shared spreadsheet, a table in your practice-management tool or a board in whatever task tool you already run. AI is an assistant to the tracker, not a replacement for it. It reads a notice and proposes the rows. A person confirms them.

Subscribe on YouTube@sagnikteaches

The enquiry file tracker

Use two tabs or two tables: one row per audit (the "case" level) and one row per requested item (the "request" level). Keeping them separate is what makes reporting work, because a case with 23 requests would otherwise be a messy cell.

Case tab

Request tab

The column "wording from notice" is copied word for word. The "plain-English task" column is where AI earns its place, as the next section shows.

Step 1: Convert the notice into request rows

When a notice or an information-request list arrives, the first job is to turn dense paragraphs into a list of discrete things to collect. A long letter often packs three or four asks into one sentence. Missing one is how a practice ends up replying "incomplete" to the authority.

Before you paste anything into an AI tool, look at what is in it. An audit letter contains the taxpayer's name, address and reference number. Strip these first, or work from a scanned copy where you have blacked them out. The tool needs the request wording, not the identity.

Below are the numbered requests from a tax audit letter. Names and
references have been removed. For each request, give me:
- the exact wording (copied unchanged)
- a plain-English description of what the client must find
- the likely documents (e.g. bank statements, invoices, loan agreement)
- anything ambiguous that needs clarifying with the examiner
Do not interpret what the authority "really" wants. If a request is
ambiguous, say so and list the possible readings.

REQUESTS:
[paste the anonymised wording]

The instruction to flag ambiguity is the useful part. A sample result for a request reading "records supporting all expenses claimed for travel" might say: "Ambiguous: 'records' could mean receipts only, or mileage logs and diary entries as well. Ask the examiner whether trip purpose records are required." You ask. It beats guessing and sending the wrong pile.

The preparer reads the output against the original notice, line by line, and corrects it. Treat the first read as five minutes of checking, not of trust.

Step 2: Fix the timeline with the date source on view

Deadlines do not come from AI. They come from the notice, and the person logging them confirms them. If you want AI to extract the stated dates as a time-saver, make it show where it found each:

From the text below, list every date and time limit mentioned.
For each: the date, what it relates to, and the exact sentence it
came from. If a deadline is expressed as a period ("within 30 days
of the date of this letter"), do not calculate the date; quote the
sentence and tell me the starting point it refers to.

The "do not calculate" instruction matters. Calendar arithmetic, especially with working days, weekends and posting rules, goes wrong in chat. You calculate the date, a second person confirms it, and the calculated date goes in the tracker with its source. A simple internal rule works well: set the practice's working deadline several days earlier than the authority's, so there is a buffer for a client who sends records late.

A worked timeline (illustrative): a notice dated the 3rd asks for responses within 30 days. The preparer diarises day 30 as the authority's deadline and sets an internal deadline at day 23. The first client chase goes out on day 5, a second on day 10, and a phone call on day 15 if less than half the items have arrived. If at day 15 the client has supplied under half the items, the preparer asks for an extension before the internal deadline, in writing, not on the last day. Each of those dates is a tracker row with an owner.

Step 3: Chase the client with templates, not fresh emails each time

Clients are the bottleneck in most audits. Practices spend hours writing similar chasers. Templates, with a human-edited variable section, cut that. AI helps tailor the list of outstanding items to the client's level of understanding, which is often the thing that actually gets documents delivered.

A chaser with the outstanding list filled in (illustrative)

Subject: Documents we still need by [internal date]

Hi [first name],

Thank you for the bank statements for the main account, which we
received on [date]. To finish the response, we still need:

1. Statements for the second account for March, June and September
   (those three months are missing from the folder).
2. The loan agreement for the vehicle purchase, or a letter from
   the lender showing the balance at the end of the year.
3. Anything showing how the 4,200 payment on 14 August was split
   between the two jobs it relates to.

If any of these do not exist, tell me and I will word the reply
accordingly. It is better to say that now than to find out later.

I have set our internal deadline for [date] so that we can review
before it goes out.

[your name]

The final sentence of item three shows the second rule for chasers: always invite the client to say if something does not exist. A silent client who has no receipts is a bigger risk than one who says so.

You can have the AI generate the numbered list from the tracker's "outstanding" rows and soften the wording for clients who are anxious. Keep the client's name out of the prompt and add it afterwards. The tutorial on chasing client documents in a small firm has a fuller chasing sequence you can borrow for audit files.

Step 4: Index what comes back before anyone writes a reply

Once documents arrive, the temptation is to start writing. Resist it for an hour and build an index first. An index is a table with a reference number, a description, the period it covers and the request it answers. It is boring work, and it is the part AI is good at when the content is not sensitive or when your approved tool handles client files under a business plan.

A practice that has not approved any AI tool for client documents should do this step by hand, or with the capabilities already built into the document system. If you do use a tool, be clear about the boundary: you are indexing documents, not asking the tool to decide whether they prove anything.

For each file name and short description below, produce an index
row: ref number (continue from 31), description, period covered,
and the request ID it answers. Flag any file whose description does
not clearly match any request. Do not guess; use "unclear".

A common outcome is that three or four files show as "unclear". Those are the interesting ones: they may be irrelevant, they may answer a request nobody noticed, or they may be a document the client should not have sent. Someone senior decides which.

Step 5: Draft the reply and the covering letter

A reply has two parts: the covering letter that responds to each request in order, and the documents. AI can draft the covering letter from the index and the request list, because the structure is mechanical: "Request 4: we enclose the bank statements for both accounts (documents 12 to 35)." The preparer writes or rewrites anything that explains the client's position.

Before and after (illustrative)

First AI draft: "In response to Request 9 regarding the home office, the taxpayer uses a room exclusively for business and therefore the full deduction is appropriate."

After the preparer: "In response to Request 9, we enclose the floor plan (document 41) and the utility bills for the year (documents 42 to 46). Our client uses the room as an office on working days; the claim is based on the proportion of the property it represents, as set out in the enclosed calculation (document 47)."

What changed? The draft asserted "exclusively for business", which nobody had confirmed, and drew a conclusion the file did not support. The corrected version states what is enclosed, what the client says and where the calculation is. That is the pattern: AI tends to assert; the preparer describes and evidences. Each time a draft states a fact, the preparer asks "where in the file is this?" and if the answer is "nowhere", the sentence goes.

A reply template that gives AI less room to invent:

Draft a covering letter with one short section per request.
For each request use ONLY this pattern:
"Request [n]: [restate the request in 15 words or fewer]. We enclose
[list of document references with descriptions]. [Add one sentence
only if I have written one under NOTES for that request.]"
Do not add explanations, legal arguments or assurances.

REQUESTS AND DOCUMENTS: [paste the index]
NOTES: [the preparer's own sentences, if any]

Step 6: The review gate before anything is sent

A reviewer who is not the drafter reads the final reply against the notice, with a short checklist.

1. Every request on the notice has a response, even if the response is "no documents exist" or "we are asking for clarification".
2. Every document referred to is in the pack and numbered as the letter says.
3. Every factual sentence can be traced to the file or the client's written confirmation.
4. No personal data appears that was not requested (an unredacted account number, another person's details).
5. The deadline in the tracker matches the notice, and the sending method gives proof of delivery.
6. The client has seen and approved the final pack, where the practice's engagement terms require it.

Add a line in the tracker: "Reply reviewed by [name] on [date]". If a dispute arises later, the trail shows a human read and approved what was sent.

Consent, confidentiality and the written information security plan

Audit files are as sensitive as client data gets: income, bank accounts, family details, sometimes health or immigration information. Three questions come before you use any AI tool on them.

Has the client agreed? Check the engagement letter. If it does not mention generative tools, ask. Some tax systems also have specific rules on when a preparer may use or disclose return information without the taxpayer's written consent, in a set form; ask your professional body whether sending that information to an AI vendor counts before you assume it does not. A short consent line is easy to add to future letters, and for current audits a one-line email reply from the client works. If the client says no, respect that and run the audit on the tracker alone.

Which account is the work in? Use a business plan with training switched off by default (ChatGPT Business, Claude Team or Microsoft 365 Copilot, now called Microsoft Copilot in Microsoft's documentation, as stated on the vendors' own pages when checked on 4 November 2026), not a personal account. The practice, not the individual, should own it so access can be removed when someone leaves. See the tutorial on whether ChatGPT is safe with client data for the full checklist.

Is it in the written information security plan? If your practice keeps a WISP, add a short section for the AI tool: its name, the plan type, who may use it, what data classes are allowed (request wording and indexes: yes; full tax returns and identity documents: no), where outputs are stored and how long chats are kept. The plan is also where you record that only the tracker holds client names. A plan that is out of date is worse than none, because it describes controls you no longer follow. Review it whenever a vendor changes its terms.

What goes wrong, and how it shows up

• The wrong deadline. A tool extracts "30 days" and the junior counts from the wrong date. Shows up as a missed date. Fix: date source column, second-person check, and an internal deadline a week earlier.
• A request quietly dropped. A long paragraph contained two asks and the extract listed one. Shows up when the authority says the reply is incomplete. Fix: the reviewer ticks every request on the original against the tracker, not against the AI list.
• A confident assertion in a reply. The draft says "all expenses were incurred wholly for business" and nobody checked. Shows up much later, when the examiner asks for proof. Fix: Step 5's rule that every factual sentence has a file reference.
• Identifiers in the prompt. A junior pasted the whole notice with the reference number. Shows up in the tool's chat history. Fix: anonymise first, delete the chat, tell the practice's data lead, and log it.
• Index drift. Documents were renamed after the index was made. Shows up when the letter cites document 17 and the pack's 17 is something else. Fix: freeze the pack before the letter is finalised.

A small-practice example, start to finish

Say a five-person practice handles a recruitment agency's audit. The notice lists 14 requests across two tax years. The preparer anonymises the request wording and asks AI to produce the request table; it returns 17 rows because three requests contained two asks each. She confirms them against the letter, sets the authority's deadline and an internal deadline eight days earlier, and sends the client a chaser listing the first nine items.

Over two weeks the junior indexes documents as they arrive, using the tracker and a simple index prompt. By day 18, 15 of 17 items are in. Two are not: a commission agreement the client cannot find, and a mileage log that never existed. The preparer asks the client to confirm in writing that neither exists, drafts a note for each request explaining what is provided instead, and asks AI only to turn her bullet points into the covering letter format. A reviewer who has not touched the file reads the pack against the notice, finds that document 22 is labelled as a different month, and has it corrected. The reply goes out on day 24, six days inside the authority's deadline. The practice records about nine hours of staff time, against a figure of twelve to fifteen on comparable earlier files, but that estimate is the practice's own timesheet data, not a promise for yours.

Handling a request you cannot meet in time

Sooner or later a client cannot produce something by the deadline. The tracker should make that visible early, and the practice should have a standard way to respond. Draft a short extension request as soon as an item is at risk, stating the item, the reason it is late, and the date by which you expect to supply it. AI can tidy the wording, but the preparer decides what to promise. Never promise a date the client has not confirmed.

A realistic example: a client's former bookkeeper holds the payroll records and is slow to respond. The preparer adds a row noting "records held by former bookkeeper; written request sent on the 9th; reply promised by the 16th", asks for a partial extension on that item only, and sends the rest on time. Splitting the response this way keeps most of the reply on time and shows the examiner exactly what is outstanding and why, and the tracker makes it easy because each request has its own status.

Keep a short log of every contact with the examiner as well: date, who spoke, what was agreed. A phone call that agreed a narrower scope means nothing unless it is followed by a confirming email and a tracker note. AI can turn your rough call notes into a tidy file note, again with names removed from the prompt, but the preparer must check it says what was actually agreed.

Measuring whether it is working

After three or four audits, look at four numbers from the tracker: days from notice to first client chase; items outstanding at the internal deadline; number of reply corrections made by the reviewer; and total staff hours per case. If the first number falls, the second falls and the third does not rise, the process helps. If corrections increase, the drafting prompts are letting too much through and need tightening. These measures need no special software, only a habit of filling the tracker.

For broader tools for handling large piles of documents, the tutorial on summarising bundles with AI safely covers the limits of summarisation, and the readiness checklist for professional firms helps with the wider question of whether the practice is ready to adopt AI at all.

Audit support questions small practices ask

Do I need client consent before using AI on audit correspondence?

Check your engagement letter and the rules that govern your practice. Many practices add a clause covering generative tools used under supervision. Where a client has refused or the letter is silent, either get written consent or keep AI away from that file and use the tracker without it.

Can AI read the notice and tell me the deadline?

It can pull out the stated date and the items requested, and that saves time, but a person must confirm the date against the notice itself and diarise it. A wrong deadline is the costliest error in this workflow, so the tracker should always show the date source.

What is a WISP and why does it matter here?

A written information security plan describes how the practice protects client data: who has access, how files are stored, what vendors are approved. If you use an AI tool on client files, the plan should name it, the account type and the data allowed, so you can show the controls if asked.

Should AI write the explanation of a position to the tax authority?

Draft the covering letter and the document index with AI if you wish, but the explanation of a client's position is the preparer's work. If AI helps with wording, the preparer must check each statement of fact and law against the file and sign it as their own.

Further reads

• How Small Law Firms Use AI to Answer Client Status Questions — Keeping clients informed without writing every update by hand.
• How Small Law Firms Use AI to Draft Letters and Routine Documents — Drafting routine letters for professional review.
• AI Time Capture for Solicitors: Recover Hours You Never Billed — Recovering unbilled time on matters like audits.
• Can AI Do My Business Taxes? What It Can Safely Prepare — What AI can and cannot safely prepare on tax work.
• How Small Tax Practices Use AI Through the Busy Season — Fitting AI into a small tax practice's peak weeks.
• How to Anonymise Client Data Before You Paste It Into AI — A fuller method for stripping identifiers before any prompt.
• AI Tax Research Tools Compared: Citations, Cost and Checks — Blue J, CoCounsel Tax, TaxGPT, Bizora, ChatGPT and Perplexity compared on cost and citations, plus a four-point citation check and a ten-question test.
• Spotting AI-Generated Evidence: A Checklist for Litigators — A working checklist for images, audio, video and documents: red flags, metadata checks, questions for the other side and when to instruct an expert.
• Can AI Summarise IRS Transcripts for a Tax Resolution Case? — A small-practice workflow: redact an IRS transcript, turn its codes into a plain-English case summary, check it, and keep the client updated on a fixed cadence.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: vendor privacy and plan pages for ChatGPT Business, Claude Team and Microsoft 365 Copilot (checked 4 Nov 2026), a tax authority's published guidance on preparer consent rules and standard practice for audit correspondence; always check the notice itself for dates and rights.