Learn
Planning & risk assessment
The audit planning phase offers the highest leverage for sophisticated AI application. Here, we move beyond basic summarization to utilize Large Language Models as cognitive partners in strategic analysis. Effective prompting during this stage can surface novel risks, challenge biases, and structure a more robust audit plan from the outset.
During planning, your objective is to construct a comprehensive understanding of the entity and its environment to identify and assess the risks of material misstatement. Advanced prompting techniques can systematically enhance this process. For example, instead of just summarizing prior-year findings, you can instruct the model to perform a longitudinal analysis.
A sophisticated prompt might be:
You are a forensic accountant and data analyst. Given the attached management letters and audit finding reports from the past three fiscal years (2022-2024), analyze the documents for recurring control deficiencies. Identify any themes or regression in controls, particularly in revenue recognition and inventory management. Synthesize the findings into a trend analysis table, highlighting the issue, the years it was noted, and the evolution of management's response.This structured approach transforms the AI from a simple reader into an analytical engine, providing a deeper level of insight than a manual review might yield alone.
For brainstorming inherent risks, one of the most effective techniques is Chain-of-Thought (CoT) prompting. By appending a simple phrase like "Let's think step-by-step" to your prompt, you fundamentally alter the model's inference process. It is compelled to externalize its reasoning, leading to a more logical, thorough, and defensible analysis. This is critical for brainstorming risks related to new standards or complex business changes.
Consider this CoT prompt:
My client is a mid-size software-as-a-service (SaaS) company. They have just expanded their operations into the European Union for the first time. The current date is August 2, 2025. Considering their business model and the new market entry, what are the primary risks of material misstatement I should consider for the upcoming audit? Let's think step-by-step, addressing regulatory, operational, and financial reporting risks separately.This prompt forces the model to methodically consider GDPR compliance and data residency (regulatory), currency translation and transfer pricing (operational), and complex revenue recognition under IFRS 15 for a new market (financial reporting), providing a structured and comprehensive starting point for your risk assessment.
Chain-of-Thought prompting is a powerful method for improving reasoning in large language models. When you ask a model a complex question, a standard prompt might cause it to rush to a conclusion, potentially making logical leaps or errors.
By adding a directive like "Let's think step-by-step" or "Explain your reasoning," you are essentially asking the model to perform a series of intermediate reasoning steps before providing a final answer. This mimics human problem-solving and has been shown in research to significantly improve performance on arithmetic, commonsense, and symbolic reasoning tasks. For auditors, this means you get a more reliable analysis and, crucially, a transparent "thought process" that you can inspect and validate.
A significant, research-backed value of using LLMs in audit planning is their ability to mitigate human cognitive biases. Auditors, like all experts, are susceptible to biases such as:
- Anchoring Bias: Over-relying on last year's risk assessment and workpapers.
- Availability Heuristic: Focusing on risks that are easily recalled or recently experienced.
An LLM, when provided with current, broad context (e.g., recent economic reports, new industry regulations, company press releases), has no such biases. It can provide a dispassionate "outside view." By prompting the AI to identify risks based on a fresh set of external data, you can challenge your own assumptions and ensure you haven't overlooked emerging threats that don't fit the pattern of prior years.