What Should Be Found on the File: The UK Audit Regulator's Guidance on Documenting AI Tools, June 2025

In June 2025 the UK's Financial Reporting Council published AI in audit: Illustrative example and documentation guidance. It has two parts, in its own words: "an illustrative example of a potential use case of AI to enhance procedures over journals, and guidance on documenting tools that use AI." By AI it means "both traditional machine learning techniques and deep learning models, including generative AI."

It sets its own limit. "The material in this publication is not prescriptive, and does not represent a static set of FRC expectations."

Parts of the publication follow, not the whole.

Guidance on Documenting Tools That Use AI

Many of its expectations, the guidance says, "will be consistent with expectations in relation to traditional pieces of technology, but some are specific to AI." It points to what it calls the black-box nature of many AI models, and to their ability to learn on their own, which "enhances the importance of clear documentation around the governance over the tool, its development and how it was designed to be appropriately explainable."

It covers more than the tools that perform audit procedures. Its examples of other tools "may include tools that create first drafts of workpapers, tools that can review work to identify omissions or inconsistencies, or chatbots that the team can use to ask queries about the firm's methodology."

A firm may build a tool itself or obtain it from someone else. The overarching principles are the same in either case, the guidance says, "but it may be impossible to obtain some information from a 3rd party that the firm would have if they had built the tool themselves."

What Should Be Found on the File

The guidance speaks of what a firm documents centrally about a tool and what goes on the audit file of an engagement. For a tool that performs audit procedures, it says "as a guiding principle" that "the more widely used a tool is" across engagements, "the more we would expect to see the balance shift toward central documentation, and the more bespoke a tool or use case, the more we might expect to see on the audit file."

On the file, for such a tool, the material it may be appropriate to document includes "what data or prompts, where applicable, were input into the tool," and how the team used the tool's outputs to conclude on the relevant judgment, or to inform further procedures.

The guidance is meant to support proportionate documentation on audit files, because, in its words, "over-documentation can divert time and resource from areas where they can better enhance audit quality." Its example is a large language model-enabled tool used to research an aspect of the entity's environment, as part of risk assessment. If the tool's outputs "are all checked back to the cited sources, it may well be appropriate to document less about the tool than this guidance would suggest, as the corroboration limits the relevance of the fact that an AI-enabled tool has been used."

The Example: A Tool That Flags Journals

The illustrative example follows an audit firm that built a tool to find journal entries that look unusual against the rest, as part of its fraud procedures. The firm combines it with a selection of traditional, rules-based checks, and its methodology requires the team to consider why an item was identified as potentially anomalous. Its methodology also requires the team to stay alert for signs that the tool's assessment "may be systemically flawed in the context of this engagement."

The example, the publication says, "is not meant to imply that these are the best or only reasonable judgements, merely to illustrate a coherent approach and emphasise some of the key considerations."