Generative AI Prompts for Auditors: Where They Help, Where They Stop and How to Write Them

This article explains how statutory, bank, internal and tax auditors, and the firms that manage them, can use prompt-driven generative AI tools across an engagement while keeping judgment, evidence and confidentiality intact.

Chat-type tools are now routinely used for drafting working papers, testing large datasets and preparing observations. The risk lies less in the tool than in how it is instructed and how its output is treated. A badly framed prompt produces confident text that no file reviewer can rely on; a well-framed one produces a structured first draft that the auditor can test against records.

Question 1: What are the ground rules before any prompt is typed?

Three conditions apply to every use, whatever the engagement.

• Professional scepticism is not delegated. The tool can propose procedures, flag exceptions and draft wording. It cannot supply sufficient appropriate audit evidence. Evidence comes from the entity's records, confirmations, inspection and re-performance.
• Client and customer data is anonymised first. Names, PAN, GSTIN, account numbers, loan identifiers and employee details are replaced with codes before anything is pasted or uploaded to an external platform. Anonymisation is a precondition, not a refinement.
• Output is verified. Every regulatory reference, calculation, conclusion and draft observation is traced back to the applicable standard, statute or original record before it enters the file.

A fourth habit follows from these: the prompt itself should instruct the tool to separate what is established from what is assumed, to say what evidence is missing, and to decline to invent figures, management responses or references.

Question 2: How should an effective prompt be constructed?

A prompt that works across engagements carries the same components, whatever the topic.