--- title: "SOX evidence for AI-assisted accounting: what to keep, and how deep" description: "Vendors say their AI is audit-ready and rarely say what an auditor can test. Here is an evidence design for AI-assisted steps, with a tiering rule for how much to keep." author: "Team" category: "Accounting Operations" date: 2026-11-02T12:25:01.014Z canonical: "https://tasksheriff.com/blog/sox-evidence-ai-assisted-accounting" --- # SOX evidence for AI-assisted accounting: what to keep, and how deep > Vendors say their AI is audit-ready and rarely say what an auditor can test. Here is an evidence design for AI-assisted steps, with a tiering rule for how much to keep. A control operator opens the workpaper for a reconciliation. The preparer note reads "reviewed with AI assistant, no exceptions." The reviewer asks what the assistant saw, what it said, and what the preparer changed. Nobody can answer. That is the problem this piece addresses. We share how we think about evidence for AI-assisted steps. This is our design view, not audit advice, and your external auditor has the final word. ## The problem we set out to solve A manual control leaves evidence by habit: a signed checklist, a tick in a workpaper, an email. An AI-assisted step changes what happens between input and sign-off, and the old habits do not capture it. Two public sources show how unsettled this is. Numeric's guide to [building an AI audit trail](https://numeric.io/blog/ai-audit-trail) says plainly that the PCAOB has not endorsed any AI-assisted workflow, and it leaves open how large a sample should be and where "light" evidence ends and "full" evidence starts. FloQast's post on the [COSO generative AI guidance](https://www.floqast.com/blog/coso-genai-framework-ai-governance-audit) says its related module is in development, with no firm date. The COSO publication itself, [Achieving Effective Internal Control Over Generative AI](https://www.coso.org/generative-ai), is public, and it is the right place to start. So a controller today must decide how much evidence is enough, without a rule. We offer one. ## Our design principles for evidence - **Evidence is a by-product of the work.** If a person must write it up afterward, it will be thin or late. - **A person decides, and the record says so.** The AI proposes. A named human accepts, edits or rejects. - **Depth follows risk.** More judgment and more systems touched means more evidence. - **A record must let a stranger reperform the step.** If an auditor cannot reach the same result from the record, the record is a story, not evidence. ## How the record is built For each AI-assisted step, we keep five things together. - **Inputs.** The source documents or ledger extracts the model saw, by reference to the original object, not a copy pasted into a note. - **Model and instructions.** The model name and version, and the instruction text in force at the time. Without these, no one can explain why Tuesday's output differs from Thursday's. - **Output.** What the system proposed, including any item it flagged as uncertain. - **Identity.** Which agent identity acted, and which person reviewed. - **Decision.** Accepted, changed or rejected, with the time and the change. Records are appended, never overwritten. A correction is a new entry that points to the old one. Our companion piece on [auditing what an AI agent did](/blog/how-to-audit-ai-agent-activity) covers the review routine on top of this record. ## How we sort steps into two tiers Here is the rule we use for depth. TierTestEvidence StandardThe step is something a person could do in the system by hand, within one system, with no new judgment. Example: drafting a standard accrual reversal from a schedule.Five-part record above, kept with the transaction. FullThe step moves data across systems, transforms it, or applies judgment. Example: explaining a balance sheet variance, or loading a subledger total into the ledger.Five-part record, plus source totals tied to the output, the transformation logic, and a reviewer note stating what was checked. The tier is set when the step is designed, written in the control description, and reviewed when the step changes. It is not decided by the person in a hurry on the last day of close. ## How we keep accuracy and compliance in view Evidence only helps if the step works. Track two numbers for every AI-assisted step: how often the reviewer changes the output, and how often the reviewer finds an error that the AI did not flag. We cover these in our piece on [measuring accuracy](/blog/measuring-ai-accounting-accuracy). On retention and sampling, do not borrow a figure from a blog post, ours included. Numeric suggests keeping records for seven years or more and defers the detail to the auditor. Do the same. Ask your auditor two questions before the year starts: what sample they want to reperform, and where they draw the line between the tiers. ## How we revise the design After the first audit cycle, sit down with the audit team and read the requests they actually made. Count the ones the record answered at once, the ones that took a day, and the ones that had no answer. Each of the last two is a field you should have captured. Add it, and change the control description to match. ## What this means for your team You do not need a new tool to start. You need a list of the AI-assisted steps you already run, a tier for each, and a conversation with your auditor. - List every step where an AI drafts, matches or explains. - Assign a tier. - Check that the five-part record exists for each. - Fix the gaps in the highest tier first. --- Source: https://tasksheriff.com/blog/sox-evidence-ai-assisted-accounting