Use the agent to assemble, not to represent. It reads each request on the auditor's list, pulls the evidence from your systems of record, maps it to the request and drafts the response. A named member of the finance team reviews every pack and sends it. The agent never creates, edits or explains away a document, and it flags gaps instead of filling them.
What is the process, and who owns it?
During an audit, the auditors send a list of requests: samples of transactions to support, reconciliations to provide, walkthrough questions about how a process works, and follow-ups on anything that looked odd. Answering them well takes weeks of finance team time, most of it spent finding documents and matching them to request numbers.
The financial controller usually owns the audit response. A named person in the finance team owns each area of the request list: payables, receivables, payroll, fixed assets. Communication with the auditors goes through one channel the controller sets. The wider position on finance agents is in AI agents for finance: books you can audit.
How does the agent answer a request, step by step?
- Agent, depth 1: reads the request list and splits it into items, each with its request number, area and due date. Evidence: the parsed list linked to the original.
- Agent, depth 1: identifies the source for each item. The general ledger, the sub-ledger, the bank statements, the contract register, the approval records. Evidence: the source named per item.
- Agent, depth 1: retrieves the evidence. For a sample of 25 invoices, it pulls each invoice, the purchase order, the goods receipt, the approval and the payment record. Every document carries its provenance; records from your systems are sealed. Evidence: the retrieval log.
- Agent, depth 2: checks the pack against the request. Does every sampled item have every document asked for? Do amounts and dates agree across documents? Evidence: a checklist per item with any mismatch noted.
- Agent, depth 2: drafts the response. A cover note per request: what is attached, where it came from, and any gap or mismatch stated plainly.
- Person, area owner: reviews and approves. Reads the cover note, checks a sample of the evidence, and explains any gap in their own words.
- Person, controller or delegate: sends to the auditors through the agreed channel. Evidence: the pack as sent, with the sender and time.
- Agent, depth 1: tracks open items and drafts follow-ups for the area owner when an item is overdue.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Parse | Splits the list into items | 1 | Nothing |
| Locate | Names the source per item | 1 | Nothing |
| Retrieve | Pulls documents from systems of record | 1 | Nothing |
| Check | Tests completeness and consistency | 2 | Explaining gaps |
| Draft | Writes the cover note | 2 | Approval |
| Send | Nothing | None | Controller or delegate |
| Track | Lists open items, drafts reminders | 1 and 2 | Nothing |
Why does a person always send?
Because what goes to the auditor is the company's representation. A response that says "all approvals were in place" is a statement someone must stand behind. If a pack is incomplete or a mismatch is unexplained, the auditor will ask who reviewed it. That must be a person, by name.
There is a practical reason too. Auditors notice patterns. A pack that arrives instantly and fluently, with every gap smoothed over, invites more testing, not less. A pack with an honest cover note that says "item 14: goods receipt missing; the delivery was confirmed by email, attached" builds trust. Whether an agent should take part at all is considered in can an AI agent answer auditor queries.
Which controls matter, and what evidence do they leave?
Read-only access scoped to the audit period. The agent cannot change the records it is retrieving. Evidence: the agent's access grant and its verdicts, all at depth 1 for retrieval.
No document creation. The agent never produces a document that looks like source evidence, such as a reconstructed invoice. It can produce working schedules, clearly marked as prepared for the audit. Evidence: every attachment's source and provenance.
Gaps stated, not filled. Evidence: the mismatch list on each item and the area owner's explanation.
One sender. Evidence: the send log, showing a person on every pack.
The agent itself is in scope. Auditors may ask how the agent works, what it may do and how it is controlled. Keep that documentation ready; what they are likely to ask under the EU AI Act is set out in the EU AI Act documentation an auditor will ask for about your AI agents. The verdict record answers most of it.
What should you measure?
- Time from request to pack sent, by area.
- Re-requests, where the auditor asks again because the first response was incomplete.
- Mismatches found by the agent before sending, against those the auditor found afterwards.
- Corrections sent after a pack went out.
- Finance team hours spent on the audit, compared with the previous year's audit.
Where does it usually go wrong?
Questions get answered as if they were data requests. A walkthrough question such as "how do you approve new suppliers?" needs a description of the process as it runs, not the policy document. The area owner writes or approves that answer.
Evidence comes from reports instead of records. A dashboard export is not source evidence. Use the ledger and the documents, and note when a report was used for convenience. Answering questions from dashboards has its own limits, set out in letting an AI agent answer questions from your BI dashboards.
The sample is changed. The agent picks a "better" invoice for an item because the requested one has a missing document. Never substitute; report the gap.
Supplier and auditor queries get mixed up. The same agent may answer suppliers asking about payments, but the tone, audience and authority differ. That process is described separately in answering supplier payment status queries.
Where Pryme fits
In Pryme, the audit agent works at depth 1 and 2 only: it retrieves and drafts, and cannot send to the auditors or change a record. Every document it attaches carries its provenance class, and every retrieval is filed, so the controller can show the auditor where each piece of evidence came from.
Questions people ask
Can the agent talk to the auditors directly?
It should not. Auditors can be given read access to the agent's prepared packs, but questions and answers go through the named finance team members.
Does the agent help with interim and year-end audits alike?
Yes. The process is the same; the volume and the areas differ. Interim work is a good place to start, because deadlines are looser.
What if the agent finds an error in the books while preparing a pack?
It flags it to the area owner at once. Correcting the error, and deciding whether to tell the auditor, are decisions for the controller.