PCAOB Auditing Standard 1215 sets the bar for audit documentation. Today you learn how to use AI on engagement files in a way the standard recognizes — with reproducible prompts, versioned outputs, and a reviewer who can reconstruct your reasoning months later.
By the end of this lesson you will know what PCAOB AS 1215 requires for audit documentation, how an AI prompt and response fit into the working papers, the structure of a reproducible "audit-trail-safe" prompt, and how to handle the situation where a model gives different output the second time you run the same prompt.
PCAOB Auditing Standard No. 1215, Audit Documentation (formerly AS No. 3) is short and specific. The requirements that matter most for AI use are paragraphs .04 through .07. The standard requires audit documentation to (a) demonstrate that the engagement complied with PCAOB standards, (b) support the auditor's conclusions, and (c) demonstrate that the underlying accounting records agreed or reconciled with the financial statements.
Paragraph .06 is the operative one for AI: documentation must contain "sufficient information to enable an experienced auditor, having no previous connection with the engagement," to (a) understand the nature, timing, extent, and results of the procedures performed, (b) determine who performed the work and reviewed it, and (c) identify the items tested.
Translate that to AI terms: a future reviewer with no prior connection to the engagement must be able to look at your workpaper and understand exactly what you asked the model, what it returned, what items it analyzed, who you are, and who reviewed your work. A chat URL is not enough — it might disappear, the chat history might be cleared, the model behind the link might be updated. The documentation has to be self-contained.
Run the same prompt against ChatGPT or Claude twice and you may get two different answers. This is normal — large language models sample from probability distributions, and the temperature setting controls how much they sample. For audit documentation, this is a real problem: AS 1215 requires that the documentation support the conclusion. If a future reviewer reruns your prompt and gets a different answer, that complicates the support.
There are three ways to handle this. First, save the actual response text in the workpaper, not a link to it — that way the response that supported your conclusion is preserved regardless of what the model returns later. Second, when using API access, set temperature to 0 (or close to it) and record any seed parameter you used, both of which improve reproducibility. Third, treat the AI as one source of evidence among several — never let an AI output be the sole support for a conclusion.
# Audit-trail-safe prompt template
Engagement: [Client Code] FY2025 Audit
Workpaper Ref: 4400-A — AR Aging Analytical Review
Procedure Date: 2026-04-24
Auditor: J. Smith, Senior
Reviewer: M. Jones, Manager
Model: claude-3-7-sonnet-2026-02-19
Temperature: 0
API parameters: max_tokens=4096, top_p=1, seed=42
Source data: AR_aging_2025-12-31.csv (SHA-256: a3f2...e91c)
Prompt:
"You are reviewing the December 31, 2025 accounts receivable aging
for [Client] (redacted as 'Taxpayer A'). The total AR is $4,287,442.
Identify customers with balances over 90 days past due that have
grown by more than 25% year-over-year. For each, output customer
code, current balance, prior-year balance, percent change, and
a one-sentence audit-evidence question. Do not invent customers.
Quote each value from the source data."
Response (verbatim):
[paste full response — do not paraphrase]
Auditor follow-up:
[your verification of each flagged customer, cross-referenced to
confirmation responses or subsequent receipts]
This is the "audit-trail-safe" structure. Every element a future reviewer needs is captured: who performed the work, when, against what data (with a hash to prove the file did not change), with what model and parameters, what was asked, what was returned, and what was concluded. The hash is optional for non-issuer work but worth the thirty seconds it takes — it eliminates any future question about whether the source file was the same one used.
For non-issuer engagements, AICPA AU-C 230, Audit Documentation is the governing standard. The requirements are functionally equivalent to AS 1215 but written from the AICPA framework. Both standards require enough documentation that an experienced auditor with no prior engagement connection could understand the work. Both apply with full force to AI-assisted procedures.
For SSARS 25 review and compilation engagements, AR-C section 90 sets the documentation requirements. They are lighter than AU-C 230 but still require documentation of the analytical procedures performed and any unusual matters identified. AI-assisted analytics fall squarely within the scope of "analytical procedures" and require the same supporting documentation.
Imagine you are the manager reviewing the senior's workpaper six weeks after the procedure was performed. You have never used AI on an audit before. You open the workpaper and see "asked Claude to find unusual journal entries — see attached." That is not enough.
What you want to see instead: the senior's hypothesis going in, the prompt they used, the full response, the senior's review of that response (which entries they followed up on, which they discarded as false positives and why), the cross-references to client documentation that resolved each item, and the senior's conclusion. That is a workpaper that supports a manager's review and that survives PCAOB inspection or AICPA peer review.
Before moving to Day 4, you should be able to answer: