What data does AI audit software need?
AI audit software needs the evidence relevant to the procedure it is performing. That may include questionnaires, policies, process documents, walkthrough recordings, screenshots, spreadsheets, system exports, reports and prior-year documentation.
More data is not automatically better. The inputs should be scoped to the audit purpose and subject to the firm's normal confidentiality, access and retention controls. A focused ITGC assessment may need information about relevant applications, users, system changes and operations. A process-understanding workflow may need the walkthrough and documents that explain the transaction flow.
The system should handle common audit formats and make the source visible in the output. It should also flag where information is incomplete or inconsistent rather than filling the gap with a plausible answer.
Firms should agree who can upload evidence, how client consent and notifications are handled, where data is hosted and what is retained after the engagement. Good data governance is part of the audit workflow, not a procurement question left until the end.
References: FRC generative and agentic AI guidance · Platformed control assurance