A useful AI audit is boring on purpose. It ranks work, names owners, and ends with one funded release — not a slide of fifty ideas. The theatre version looks busier: workshops with sticky notes, a vendor-led “discovery”, a heat map nobody can trace back to the general ledger, and a closing deck that recommends a platform. Ninety days later the organisation has spent money and still cannot say which workflow will change on Monday.

I run audits the other way round. Rank use cases by P&L impact and control risk, then fund one narrow release. Everything in the ninety days serves that decision.

How to spot audit theatre early

Three signals tell me an audit is drifting. First, the idea list keeps growing after week three; a healthy audit shrinks its list every week. Second, nobody has asked for a baseline — not a perfect cost model, just rough volume, hours by role and the errors people already complain about. Third, the recommendations name tools before they name owners. If a recommendation cannot say who will be accountable for the metric, it is a brochure, not a plan.

The ninety days, without the padding

Days 1–20: map the work. Pick the five to eight recurring workflows that consume the most skilled time or create the most rework. For each, write five lines: input, decision, output, owner, and what “good” looks like today. In a CA practice this is usually research and first drafts, document extraction, reconciliations, reporting packs and routine client communication. In a finance team it is close, payables, collections and management reporting.

Days 21–45: score and cut. Score each workflow on value (hours, cycle time, error cost, cash timing), feasibility (data availability, system access, process stability) and control risk (confidentiality, regulatory exposure, whether an error reaches a client or a filing). Be ruthless. Anything that needs clean data you do not have goes to the “later” column. Anything that would put an unreviewed answer in front of a client goes to “redesign”.

Days 46–70: design one release. Take the top one — occasionally two — and design the thin version: which team, which data classes the tool may see, where the human approval gate sits, what is logged, and the metric you will review weekly. Write the stop conditions now, while nobody is emotionally invested.

Days 71–90: run it beside the old process. Two to four weeks with one team, reviewed weekly. The output of the audit is not the deck. It is a working release with evidence, or a clean “no” with reasons.

What the final report should actually contain

One page per recommended workflow: the five-line map, the score and the reasoning behind it, the owner, the metric, the controls, and the cost of the next ninety days including review time — not just licences. A short list of what you deliberately did not pursue, and why, is just as valuable. It stops the same weak ideas returning at the next board meeting.

For CA firms, add a line on professional responsibility: which outputs a signing professional must review before they leave the firm. AI does not change who is accountable. I have written more on that for AI opportunity audits for CA firms, and the earlier 90-day roadmap for leaders covers the scoring logic in more depth.

Public frameworks such as the NIST AI Risk Management Framework are useful for structuring the risk conversation — govern, map, measure, manage. Treat them as prompts. Your chart of accounts, staffing and auditor’s expectations are the real constraints.

Related reading: start with the AI for chartered accountants in India hub, then when a finance team should say no to an AI pilot, AI governance without a Chief AI Officer.

Monday-morning checklist

  • List no more than eight recurring workflows and write the five-line map for each.
  • Collect a rough baseline: volume, hours by role, known error patterns.
  • Score value, feasibility and control risk; cut the list every week.
  • Design one thin release with owner, data classes, human gate and stop conditions.
  • Judge the audit by the release it ships, not by the length of the deck.

Sources

Educational commentary from implementation work — not personalised financial, tax, legal or investment advice. Verify vendor terms and your own policies before committing spend.