10 Audit Evidence Examples and How to Document Them

You must now document audit evidence with the same rigour whether it comes from a paper invoice, a bank confirmation or an AI-generated summary. Quantity of records does not substitute for their source, accuracy or relevance to the claim they are meant to support.

An analysis of 31 October 2026 of audit evidence documentation across financial, legal and AI-assisted workflows argues that the distinction between obtaining records and obtaining persuasive evidence determines whether a file will withstand scrutiny. The analysis uses a purchase transaction traced through approval, ordering, receipt and payment to show how each stage requires separate documentary support. In our assessment, this discipline becomes more critical as organisations embed AI into casework and compliance processes, because a well-documented workflow can obscure whether individual outputs were actually checked or merely recorded.

What separates a document from evidence?

Under International Standards on Auditing 500, sufficiency concerns quantity whilst appropriateness concerns relevance and reliability. Collecting more invoices does not resolve a problem with their source, accuracy or whether they prove the proposition for which someone presents them. A document can be authentic without establishing the transaction it purports to record. The practical rule is to define the claim before collecting the evidence. For a recorded sale, you must connect the ledger entry to the invoice, the signed customer order and the shipping record—each supports a different condition for recognising revenue, and none independently establishes all of them.

For AI-assisted work, the same discipline means retaining the underlying material, the transformations applied, the checks performed and the reviewer's decision, not merely the final answer. A correct quotation can still be assigned to the wrong party, date or obligation. The file should separate the person's representation, the procedures performed and the reviewer's conclusion, so later readers can assess each on its own merits.

Which failure modes arise when evidence is incomplete?

• Authenticity without relevance — a document can be genuine without proving the proposition for which it is presented.
• Quantity without appropriateness — more records do not resolve problems with their source, accuracy or relevance to the assertion being tested.
• Observation without consistency — what a reviewer directly observed during a specified procedure does not establish that the practice occurred on other days or under different conditions.
• Explanation without corroboration — management's account of a transaction or process is a hypothesis until checked against underlying records.
• Repeatability without accuracy — a reproduced answer supports that a system produces the same result twice; it does not establish that the result is correct.
• Process documentation without operational proof — a flowchart describes intended design; it does not establish that controls were consistently implemented throughout the period.

What concrete controls must your audit trail demonstrate?

1. Connect source to procedure to result — document which material was examined, what check was performed on it, what the check found and which uncertainties remain unresolved.
2. Preserve contradictory information — retain evidence of discrepancies, follow-up and their resolution rather than replacing original records with unexplained corrected figures.
3. Establish independence where claimed — verify that confirmations came from respondents with relevant knowledge and independence, and that the route from respondent to reviewer was reliable.
4. Record selection logic and population completeness — for any sample, establish the relevant population and period before selecting items, and retain evidence that the population definition was complete.
5. Separate assertion from verification — distinguish what management represented from what you independently checked, and document which procedures corroborated or contradicted each representation.
6. Retain AI inputs and raw outputs — preserve the source documents, processing steps, raw outputs and independent checks before the final human decision, so the work can be scrutinised without relying on the system's account of its reasoning.

How does this apply to AI-assisted casework?

When a system generates a legal summary, compliance observation or factual extraction, the audit trail should connect the contract version or source document, the relevant clauses or data points, the instructions given to the system, the generated text and the reviewer's clause-by-clause corrections or approvals. A demonstration of the system's capability during testing does not establish how it performed on confidential casework, different document types or earlier versions in live use. Preserve the test environment, inputs and observed output separately from operational records.

For a draft summary, retain the original output alongside the officer's amendments and reasons. The distinction between an AI explanation and proof matters here. A system's account of its reasoning is not a substitute for inspectable source evidence. A caseworker's statement that an AI-generated summary was reviewed records an assertion about review; it does not show which clauses were checked or what errors were corrected. The valuable evidence is the documented comparison and follow-up, not the fluency with which the system describes a possible cause.

What tooling can carry and what remains your judgement?

Automated systems can generate logs, extract data, flag anomalies and produce formatted outputs at scale. They cannot evaluate whether the underlying information is complete or correct, whether an explanation is plausible without corroboration, or whether a particular reliance is justified. A dashboard can create an appearance of control without adequate audit evidence. Increased processing scale does not remove the need to evaluate the information and challenge the result. Access and privacy controls applied to the audit trail itself matter, especially where prompts or outputs contain confidential records; test those controls locally before sensitive use. The central question is not whether a file exists, but whether its contents justify the particular reliance being proposed. Ask for a record that connects the proposed decision to its supporting sources, procedures, exceptions and responsible reviewer, then assess whether that connection is sound.