The AI Audit Report That Audits Itself Wrong

The audit profession stands at an inflection point. Staffing shortages, fee pressure, and accelerating regulatory complexity are driving firms of all sizes to adopt artificial intelligence. The promise is compelling: AI can draft workpapers in minutes rather than hours, generate analytical procedure documentation instantaneously, and produce first-draft audit reports while the engagement team focuses on judgment-intensive tasks.

But this adoption is outpacing verification. McKinsey's 2025 Global Survey (n=1,993) found that 79% of organizations regularly use generative AI, yet only 27% review all AI-generated content before use (McKinsey H2 2024, n=1,491). In audit specifically, our analysis indicates AI adoption rates for numerical tasks exceed 59-84% while independent verification remains critically low at 6% to 19%. The AICPA Q4 2024 survey (n=273 CPA decision-makers) confirmed that only 6% of firms are fully using generative AI in key operations, with 92% expressing concern about accuracy risks.

The core problem is architectural: LLMs are language models. They predict the next token in a sequence. When asked to calculate materiality, they do not perform arithmetic -- they generate text that looks like arithmetic. The distinction is invisible in the output but catastrophic in consequence.

Through analysis of AI-generated audit workpapers across multiple engagement types and firm sizes, we have identified eight distinct categories of AI failure. These are not edge cases or rare glitches -- they are systematic, reproducible errors inherent to the architecture of large language models when applied to numerical audit tasks.

Each failure type represents a different mechanism by which LLMs produce incorrect audit outputs. Understanding these categories is essential for developing effective quality control procedures and determining which audit tasks can and cannot be delegated to current AI systems.

The fundamental limitation is not that LLMs are bad at math. It is that they do not do math at all. When an LLM produces the output "Materiality = $2,400,000," it has not performed a calculation. It has generated a sequence of tokens that are statistically likely to follow the preceding context. The number may be correct by coincidence, but it is never correct by computation. Researchers at the National University of Singapore have formally proven that hallucination is mathematically impossible to eliminate in LLMs used as general problem solvers (Xu, Jain & Kankanhalli, arXiv:2401.11817, 2024).

Published benchmarks quantify the scope of the problem. The HaluEval benchmark (EMNLP 2023) found ChatGPT hallucinated on approximately 19.5% of user queries. Stanford HAI's preregistered study of AI legal research tools found general-purpose chatbots hallucinated on 58% to 82% of legal queries, with even RAG-based tools hallucinating at rates above 17% (Magesh et al., Journal of Empirical Legal Studies, 2025). On the CPA exam, ChatGPT-4 scored only 67.8% without tools but reached 85.1% when given a calculator -- demonstrating that tool augmentation dramatically improves reliability (Review of Accounting Studies, 2024).

This distinction matters enormously in audit. Professional standards require that audit evidence be sufficient and appropriate. Evidence generated by statistical pattern matching -- where the model cannot explain its reasoning, cannot trace its calculation, and cannot guarantee reproducibility -- does not meet this threshold.

The cascading nature of audit errors amplifies this risk. A single hallucinated materiality threshold propagates through every subsequent audit procedure, affecting scope determinations, sample sizes, evaluation of identified misstatements, and ultimately the audit opinion itself.

AI hallucinations in a marketing email are an embarrassment. AI hallucinations in an audit workpaper are a regulatory violation. The audit profession operates under a legal and regulatory framework that elevates AI errors from quality issues to potential fraud, professional misconduct, and public harm.

Unlike most business applications where AI errors can be caught and corrected through normal feedback loops, audit errors have asymmetric consequences. A missed misstatement may not surface until an investor has relied on misstated financial statements, a company has raised capital on false pretenses, or a PCAOB inspection reveals the deficiency months or years later.

Understanding where AI errors enter the audit process requires mapping the engagement lifecycle. Each phase of an audit presents different opportunities for AI-generated errors to contaminate the workpaper file, and each carries different risk profiles based on the nature of the task and its downstream impact.

The following exhibit maps the typical engagement lifecycle, identifying the specific points at which AI-generated errors are most likely to be introduced and the risk level associated with each injection point.

The following scenarios illustrate how AI failures manifest in real engagement contexts. Each scenario is constructed from observed failure patterns and represents a plausible chain of events that could occur when AI-generated outputs are not independently verified.

Professional auditing standards were written in an era when audit evidence was created by humans. The existing framework addresses risks associated with computer- assisted audit techniques (CAATs) and IT general controls, but these frameworks assume deterministic systems that produce consistent outputs from consistent inputs. LLMs violate this assumption fundamentally.

Standard-setting bodies are beginning to respond, but the pace of guidance lags the pace of adoption. The following timeline illustrates the emerging landscape of AI-related audit guidance and highlights the significant gaps that remain.

The solution is not to abandon AI in audit. It is to architect AI systems correctly. The fundamental error in current implementations is treating the LLM as a general-purpose engine for all audit tasks, including numerical computation. The correct architecture separates language processing from mathematical operations, routing each task to the appropriate engine.

We propose a three-layer architecture that preserves the productivity benefits of AI while eliminating the risk of hallucinated numerical outputs. This architecture ensures that every number in an AI-assisted workpaper is computed, not generated.

Until audit-grade AI systems with integrated computation layers become standard, firms need a practical framework for governing AI use in audit engagements. The AI Audit Integrity Protocol provides a four-tier classification system that categorizes audit tasks by their suitability for AI assistance and specifies the validation requirements for each tier.

Based on the analysis presented in this paper, we offer the following recommendations organized by stakeholder group. These recommendations are designed to be actionable immediately while supporting the long-term development of audit-grade AI systems.

The audit profession exists because society needs assurance that financial statements are materially correct. Every element of the audit framework -- from professional standards to quality control requirements to PCAOB inspections -- is designed to ensure that the numbers are right.

AI systems that generate numbers rather than compute them are fundamentally incompatible with this mission. An AI that hallucinates a materiality threshold is not merely producing a wrong answer -- it is undermining the evidentiary foundation of the entire engagement. When that hallucinated threshold cascades through scope determinations, sample sizes, and misstatement evaluations, the result is an audit that provides false assurance to the investing public.

The path forward is clear. AI has enormous potential to improve audit quality and efficiency, but only when its architecture matches the requirements of the profession. Language processing must be separated from numerical computation. Every calculation must be deterministic and verifiable. Every citation must be validated against authoritative sources. Every output must carry a complete audit trail.

Firms that adopt this architecture will achieve the productivity benefits of AI without the existential risks. Firms that do not will face a growing burden of undetected errors, regulatory findings, and professional liability.

The numbers in an audit must be right. Not probably right. Not statistically likely to be right. Right. That is the standard, and any AI system used in audit must meet it.