Most audit work is not judgment. It is pulling bank statements, exporting ledger detail, matching documents to transactions, re-running the same control test every quarter and formatting it all into a workpaper. Audit automation hands that logistics layer to software so the people involved can spend their time on the exceptions.
This guide is written for a US controller, internal audit lead or CFO at a company that reports under SOX, or one preparing to. It covers what can be automated, how that changes the evidence your external auditor sees, and which parts stay with people. For the process-level mechanics, see journal entry automation and automated reconciliation.
A note on names: Zamp (zamp.ai) builds AI employees for finance and back-office work. It is not "Zamp HR" (payroll) and not zamp.com (sales-tax compliance).
What is audit automation?
It is not one product. In practice it is a set of jobs: evidence collection, transaction testing, control testing, reconciliation tie-outs, workpaper assembly and exception routing. The same technology serves internal audit, the external financial statement audit and compliance programs such as SOC 2. What changes between them is which controls, thresholds, evidence and approvers are configured.
What does a SOX 404 program ask of you, and where does automation fit?
Under SEC rule 17 CFR 240.13a-15(c), management of an issuer must evaluate the effectiveness of internal control over financial reporting as of the end of each fiscal year, using a suitable, recognized control framework. For many issuers the independent auditor then audits those controls under PCAOB Auditing Standard 2201. Private companies are audited under AICPA auditing standards (the AU-C sections), such as AU-C 500 on audit evidence, which SAS 142 modernized. Those standards also expect the auditor to obtain sufficient appropriate evidence.
That work has a recurring shape: identify key controls, test that they operate, document the test, evaluate deficiencies, and keep the evidence. Automation fits in three places.
- Evidence. Agents pull the report, the statement or the approval record from the source system on a schedule, and tie it to the transaction it supports.
- Testing. Agents re-run a control check every time it fires, or on a daily schedule, instead of waiting for the quarterly sample.
- Documentation. Agents write what was tested, with what data, under which rule, and with what result, at the moment the test runs.
What automation does not do is decide whether a deficiency is a significant deficiency or a material weakness. That evaluation belongs to management and, for the audit, to the auditor.
What audit work can AI agents automate?
The table shows the main jobs, what an agent does in each, and what stays with a person.
Audit job | What the AI agent does | What stays with people |
|---|---|---|
Evidence collection | Pulls statements, invoices, contracts and ERP reports; extracts fields with intelligent document processing; links each to its transaction | Deciding what evidence is sufficient for a control |
Journal entry testing | Tests every entry against rules: unusual amounts, off-hours posting, duplicates, preparer and approver on the same user | Judging whether a flagged entry is an error, an override or a misstatement |
Control testing | Re-performs approval limits, three-way match and access checks on each occurrence | Concluding on deficiency severity |
Reconciliations | Matches items by rule, clears routine differences, queues the rest with context | Approving the reconciliation; resolving aged items |
Workpapers | Builds the test record as the work runs, with links to source evidence | Reviewing and signing off |
Reporting | Shows control health, exception trends and aging items to the audit committee | Deciding what to do about them |
How does automation change the evidence an auditor sees?
It changes the format and the timing. The auditor receives a dated record of each test instead of a spreadsheet assembled after the fact. Three points matter.
Information produced by the entity. When an auditor uses company-produced reports as evidence, PCAOB AS 1105.10 expects the auditor to evaluate whether that information is sufficient and appropriate by testing its accuracy and completeness, or the controls over them, and by evaluating whether it is precise and detailed enough for the audit. If an agent produced the report, expect questions about how the report was generated, what data it read, and which controls cover that data. Keep the agent's configuration and its change history alongside the output.
Re-performability. A good automated trail lets a reviewer reconstruct a single case without asking an engineer to pull logs from three systems: what the agent saw, which rule applied, what it decided, who approved it and when. See what an audit trail is and traceability.
Technology-assisted analysis. PCAOB Release No. 2024-007 (June 12, 2024) amended AS 1105 and AS 2301 to address auditors' use of technology-assisted analysis, effective for audits of fiscal years beginning on or after December 15, 2025. Ask your audit firm how it is applying those amendments to your data, because your automated outputs may be the input to its analysis.
How do auditors treat automated controls?
Automated controls can be efficient to test because they behave the same way each time. AS 2201 Appendix B (paragraphs B28 to B33) describes benchmarking of entirely automated application controls. If general controls over program changes, access to programs and computer operations are effective and continue to be tested, and the auditor verifies the control has not changed since the baseline, the auditor may conclude it is still effective without repeating the prior year's tests. The baseline must be reestablished after a period of time.
Two practical consequences follow. First, a control you automate is only as reliable as the change management around it. Treat the agent's rules, thresholds and access as in-scope for IT general controls. Second, talk to your external auditor before you rely on the change. Reliance on an automated control, and any effect on testing or fees, is the auditor's decision. It is not something a vendor can promise on their behalf.
How do you audit automated postings and AI agent actions?
When an AI agent posts, matches or approves something, the agent becomes part of the control environment. Auditors ask what they would ask about any non-human actor.
- Identity. Does the agent have its own account, separate from a shared service login?
- Access. Is it limited to the systems and actions its role needs, and can it post and approve the same item?
- Change. Who can change its rules or thresholds, and is each change approved and logged?
- Decisions. Can you reconstruct why it matched, cleared or escalated a given item?
- Oversight. Which actions need a human approval before they take effect?
Zamp's own pieces on this are how to govern AI agents: 12 controls for regulated enterprises, SOC 2 and AI agents: what changes in your controls, and the trust and security reference.
How do AI agents handle materiality and exceptions?
Set the thresholds in writing before the agent runs. Examples a finance team typically defines: the dollar amount above which an exception always goes to a person, the control failures that always escalate, the age at which an open reconciling item is raised, and who may approve each class.
Take bank reconciliation. A data agent pulls the bank feed and ledger activity on a schedule. A matching agent applies the rules (amount, date window, reference, vendor name) and clears the routine items. Items that do not match go to a controller's queue with what did not match, the evidence attached, and similar past exceptions. The workpaper records every match and every resolution, and the controller approves the finished reconciliation, with approver and timestamp logged. This is human-in-the-loop design: the agent does the matching, a person owns the decision. See bank reconciliation automation for where this breaks.
What does Zamp's published work show about audit-ready AI?
Zamp's case studies do not describe an audit engagement. They do show the evidence pattern auditors look for, in regulated settings.
- In a global biopharma procurement deployment, the AI employee writes its reasoning for each purchase-request decision inside the customer's own SAP Ariba, so a reviewer can read why a request was approved or flagged. It sent the cases it was unsure about to manual review instead of guessing. See the procurement case study.
- In freight order management, every portal interaction is recorded as a timestamped session video, so a reviewer can check the work without redoing it. See the freight case study.
- In multi-entity billing, completed invoice packages go for internal approval with an audit trail attached, and the deployment ran at 100% compliance to SOPs and SLAs. See the billing case study.
- In an enterprise-wide pharma rollout, full auditability and compliance with regulated-process requirements were conditions of the deployment from the start. See the pharma rollout.
These are results from specific customers on specific jobs. They are not a claim about your audit fees or your control testing time.
What does audit automation not replace?
Professional judgment, materiality, the evaluation of deficiencies, complex estimates (credit loss allowances, impairment, fair value, tax positions) and the audit opinion all stay with people. Independence also stays with the audit firm. Automation produces evidence and workpapers. A qualified person reviews them and signs. For limits worth knowing before you start, read limitations of AI employees.
How do you start?
- Pick one process with clear rules and volume. Bank reconciliation, journal entry testing and AP exception review are common first choices.
- Connect to the source system. Agents that read ERP data directly give you a stronger trail than agents that read exports.
- Write the approval gates down. Thresholds, always-escalate cases and sign-off points go in before go-live.
- Bring the audit firm in early. Show them the evidence format, the change log and the access model before the quarter you want to rely on it.
- Run in parallel for one cycle. Compare the agent's output with the manual process, and keep the differences as part of your documentation.
- Expand deliberately. Add controls once the first is stable. For ramp patterns, see the AI employee onboarding guide.
Sources
- SEC, 17 CFR 240.13a-15, Controls and procedures (eCFR).
- PCAOB, AS 2201: An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements and AS 1105: Audit Evidence.
- PCAOB, Release No. 2024-007, June 12, 2024 (amendments to AS 1105 and AS 2301; approved by the SEC on August 20, 2024).
- AICPA, SAS 142, Audit Evidence.
- Zamp published case studies linked above.
