How should AI handle missing or contradictory audit evidence?
AI should make missing or contradictory evidence visible, not resolve the problem by guessing. It should distinguish between “not evidenced”, “not met” and “unclear”, then route the issue to the auditor.
Missing evidence may mean the client has not supplied the document, the control did not operate, the requested evidence was inappropriate or the system failed to find information that is present. Those are different situations and require different responses.
Contradictory evidence is equally important. If a walkthrough says all access is reviewed quarterly but the supplied review covers only administrators, the system should preserve both facts and flag the inconsistency. It should not select the more convenient version.
This is where professional scepticism and good product design meet. The workflow should record the gap, support a follow-up request, retain the evidence and let the auditor decide whether the control conclusion or audit response changes. Confidence scores can help prioritise review, but they should never replace the underlying rationale.
References: IAASB professional scepticism resources · FRC generative and agentic AI guidance