Claude for Auditors: Evidence, Sampling and Review

A useful first evaluation of Claude for auditors is a bounded preparation task: extracting fields from a small document set, comparing two records or organizing an exception list. The output should preserve the source references and make missing information visible.

Start with work the engagement team knows how to check. Ask for a table of invoice dates and amounts with page references, then inspect the table against the documents. Record corrections and review effort before deciding whether the procedure belongs in regular fieldwork.

The approach below is an evaluation framework. The applicable auditing standards, engagement circumstances and firm's methodology determine the actual audit procedures and documentation. Claude's output does not establish that sufficient appropriate evidence has been obtained.

Scope the information before connecting a tool

Identify the client, entities, periods, records and people permitted to use them. Confirm the approved AI service and contractual data-handling arrangements before providing engagement information. Begin with synthetic documents when testing the procedure.

For evidence preparation, use access limited to the records needed. Where the task only needs reads, configure that restriction in the source system and the connected tools. An instruction saying “read only” does not remove a credential's write permissions.

Anthropic's custom-connector guidance describes granting permissions when connecting and reviewing tool access. Confirm the actual connector's capabilities and the client's configuration; do not assume every ledger exposes the same reports or approval history.

Save an input manifest with the export or document references, extraction date, report filters and known omissions. A local file hash can help identify the exact file used later. It does not establish that the contents are accurate or complete.

Evaluate extraction with visible source references

Choose a task with observable answers. For invoice extraction, a useful review table includes the source file, page, invoice reference, date, currency and amount. Keep an explicit unresolved value when a field cannot be read.

For example, a synthetic invoice could show a net amount of €100, tax of €20 and a total of €120. Ask the assistant to retain all three fields and their labels. Then include a credit note, a poor scan and a document with a missing page. The exercise should reveal whether the procedure handles those differences or fills gaps with guesses.

Retain the original output alongside the corrected version. Record which fields the reviewer checked and why. A table that looks orderly can still have the wrong currency, a transposed date or a duplicated document.

Decide the review extent under the engagement's risk assessment and methodology. This article does not prescribe a universal percentage of rows to recheck.

Establish the population before selecting items

For an audit conducted under PCAOB standards, AS 1105.10 addresses the accuracy, completeness, precision and detail of company-produced information used as evidence. Other engagements must use their applicable standards. The practical question is whether the extract is fit for the procedure being performed.

Consider the direction of the test. Selecting recorded invoices can help examine those recorded items, but cannot by itself establish that unrecorded transactions are complete. The starting population needs to match the assertion and audit objective.

For a recorded-invoice population, prepare a reconciliation to the relevant ledger amounts. Explain exclusions, credits, voids, currency differences and cutoff adjustments. Record counts as well as totals, because a duplicated row and an omitted row can offset in value.

Claude can help organize this reconciliation and identify differences to investigate. Use checked calculations and inspect the source evidence before accepting its explanation.

Keep sampling and targeted selection distinct

An assistant may flag unusual transactions for investigation. Describe that output as a targeted selection and document the criteria. Do not present it as a representative random sample merely because the model selected varied items.

PCAOB AS 2315 recognizes statistical and nonstatistical sampling and discusses the objective, population, sampling risk and selection process. It does not supply one sample size for all engagements. Your team must determine the appropriate approach and evaluate the results under the applicable methodology.

If that approach calls for a reproducible random selection, use reviewed code or an approved sampling tool. Retain the input file, its stable row identifiers and ordering, the algorithm and version, parameters, seed where used, and selected items. Re-running the same procedure should reproduce the same selection.

A seed alone proves very little. A changed population, different sorting or a different algorithm can change the result. Reproducibility also does not prove that the method or sample size is appropriate.

Claude can assist with preparing a script and its explanation. The reviewer still needs to inspect the logic, test it and determine whether it implements the chosen procedure.

Test controls against the relevant records

An approval policy and an approval event answer different questions. To investigate whether a configured approval operated, the team may need the transaction, applicable threshold, authorized approver, decision timestamp and relevant change history.

Use a clear outcome for each inspected item:

Avoid making a successful tool call equivalent to an effective control. A log entry can establish that an action was attempted without proving that the accounting record changed or the required approval occurred.

Leave a workpaper someone else can inspect

For PCAOB engagements, AS 1215.06A describes documentation that allows an experienced auditor with no previous connection to understand the work, evidence and conclusions, including preparation and review responsibilities.

For the AI-assisted part of your evaluation, a practical record can include:

• The objective, scope and applicable procedure.
• Input references, report filters and population checks.
• The prompt, script or skill version and the model/service used on the run date.
• Raw output, exceptions and corrections.
• The review performed, reviewer, date and resulting conclusions or outstanding work.

This is a suggested record structure, not a claim that those fields alone satisfy an auditing standard. Keep confidential engagement material in the approved storage and retention process.

What to ask of the accounting system

Request a demonstration with a synthetic transaction: locate the source evidence, saved posting, activity history and approval record where approval was required. Include an example with missing evidence and inspect how the gap is reported.

Arfiti provides accounting infrastructure that assistants can use through supported tools, with authorization, integrity checks and applicable approval controls on financial changes. Its built-in agents are optional. Audit preparation should use the access appropriate to the task and check the evidence actually retained for the selected record.

We do not assume every transaction has a source attachment or a human approval. A configured straight-through workflow can have a different approval path, and an imported record may have different supporting evidence. Make those distinctions visible in the workpaper.

Describe the evidence workflow you want to evaluate. We are preparing to open access on 25 November. The form sends an enquiry for a personal reply; it does not create an account.

Related reading: Claude for controllers, packaging an accounting procedure as a skill, and reconciling reports before proposing a journal.