# Auditor AI-Use Working-Paper Record and Declaration

Track A and Track B · Neutral documentation bundle

## Purpose

Document permitted and actual AI assistance, source checking, edits and accountable reliance without retaining unnecessary confidential transcripts.

## Intended user

Auditor using an assistant, engagement supervisor and data/provider approval owner where relevant.

## When to use

Before intended AI use and after any actual contribution to working material; revise when purpose, data or provider scope changes.

## Included templates

- **AI-use working-paper disclosure**.
- **Responsible-AI-use declaration for auditors**.

## Shared evidence/provenance and human-review fields

Complete this cover once per working-paper record. Repeat only where the scope or reviewer changes. Local review rows should reference the shared decision ID when the same decision covers them; record only view-specific judgement or a different decision there, not duplicate names/dates. A role label alone may not identify the actual reviewer: use the responsible person or institution-controlled reviewer reference in the authorised record, without unnecessary personal data in provider inputs. Use source IDs in individual rows rather than copying the full evidence inventory. Blank is not a pass; use “not supplied”, “not performed”, “unclear”, or “not applicable — reason” accurately.

| Field | Definition / professional purpose | Entry |
|---|---|---|
| Record ID and objective | Local working-paper reference and the decision/question this record supports; not a newly assigned AMO ID | — |
| System/process and period | Exact unit, system baseline and period examined; bounds the conclusion | — |
| Source register | Evidence ID; permitted locator; version/date; source owner; date obtained; scope/access limitation. A cited document not inspected stays “not inspected” | — |
| Preparer and work state | Responsible preparer role; date; distinguish proposed, performed and supplied third-party work | — |
| Reviewer decision | Reviewer identity/reference and authority; date; exact record/version reviewed; decision ID and rationale; restrictions. Leave unrecorded until a person decides | — |
| Unresolved matter / follow-up | Missing or conflicting evidence; affected decision; next request/action; owner/date only if supplied | — |
| Approved carry-forward | Exact edited material authorised for the next activity, linked to review decision and remaining limitations; no automatic approval | — |

Suggested review states describe this document only: draft, awaiting evidence, returned for revision, held, or reviewed for the stated limited use. They do not change any application schema or establish an engagement conclusion. An action status is recorded separately from an evidence or reviewer status.

## Field definitions and fillable templates

Each table is a blank working view. Duplicate a view or its item rows only for a distinct system, test, claim or event. Keep related evidence under stable IDs.

### AI-use working-paper disclosure

| Field | Definition / purpose | Entry |
|---|---|---|
| Activity / working-paper link | Bounded task and record/claim location that AI assisted, not a statement that it performed the audit. | — |
| Actual tool / model / date | Provider, tool, model/version and execution date where known; no keys; no fabricated values for historic work. | — |
| Source identity / permitted inputs | Prompt/Workflow ID and exact Prompt version where used; approved data categories and evidence IDs rather than unnecessary raw text. | — |
| AI contribution and provenance | What was generated, what was manually entered and what came from an external tool; distinguish a supplied simulation from actual generation. | — |
| Human checks / edits / rejections | Actual checks and source locators, material changes, rejected claims and work not performed. | — |
| Reliance / reviewer / limits | Who accepted what for which purpose, when, and what remains blocked. | — |
| Retention / export handling | Institution-controlled record location and governing retention/privacy decision reference; no prescribed duration. Full/redacted exports and derived copies require review under the same approved requirements. | — |

**Completion guidance:** If no provider was used, write “none — supplied synthetic draft reviewed” rather than inventing a model or call time. A Run Record is optional activity documentation, not independent audit evidence.

### Responsible-AI-use declaration for auditors

| Field | Definition / purpose | Entry |
|---|---|---|
| Purpose / authority | Intended assistance, governing policy/engagement reference and scope of permission. | — |
| Competence / independence | Auditor's ability to review the output and any conflict or specialist-review dependency. | — |
| Permitted data / minimisation | Input categories permitted, information withheld and unresolved data-owner questions. | — |
| Provider / surface boundary | Permitted tool/workspace and transfer/storage restrictions with actual supporting decision reference. | — |
| Responsibility statement | Auditor retains professional judgement; no delegated conclusion, invented testing or automatic closure. | — |
| Stop / escalation conditions | Missing permission, unexpected sensitive content, unavailable sources or unsupported capability; responsible function if supplied. | — |
| Actual declaration and review | Person/role, date and exact commitments actually made; outstanding decisions stay pending. | — |

**Completion guidance:** This is an accountable-use record, not a certification form. Do not pre-sign it for another person. Permission must exist before restricted input is sent; a declaration cannot create that permission. Disclosure records involvement but does not make the work acceptable: source verification, competence, permitted use and actual professional review remain separate requirements.

## Bundle completion guidance

Record intended use first; actual execution and review belong in the disclosure after they occur. Separate the provider-generated material from the authoritative source evidence. Use existing AMO-P-000155/AMO-P-000149 methods as references, with manual/external handling where the current surface cannot execute their tool label. An unavailable model/version is recorded as unknown, not inferred from a current UI.

Before carrying material forward, reconcile the question, criterion, source and actual observation. Preserve original evidence in the institution's authorised repository. Use only permitted excerpts in an AI surface; do not paste private credentials or unapproved identifiers. Local saving is not evidence custody or permission to disclose to a provider. A proposed test or a completed form cannot stand in for a recorded result.

The audit supervisor decides sufficiency and reliance; the specialist decides matters within their competence and authority. Management validates its own representations and owns corrective action. Management agreement is not the audit reviewer's independent closure decision. Carry-forward remains editable and requires explicit review.

## Example completed synthetic excerpt

Responsible-AI-use declaration for auditors proposed use: review synthetic CA records only; confidential extracts held per CA-02/CA-09; provider permissions not inferred from CA-03. AI-use working-paper disclosure hypothetical learner entry, to use only if true for that learner: “No provider used in this exercise; supplied synthetic draft CA-07 reviewed manually; provider/model/execution time not applicable.” This is not a statement about how the Pack was authored. If the learner actually uses an assistant, record that involvement and its known tool/model/date instead. Proposed learner check: compare the five-item claim with CA-05/CA-06 and record corrections after performing that review. No real reviewer signature or reliance decision has been entered. CA-10's local draft retention remains a separate unresolved records matter.

This is an illustrative entry from the bundled fictional case, not work performed on a real organisation. Review dates/decisions shown as proposed must not be represented as real sign-offs.

## Limitations

- Does not authorise confidential processing, resolve provider retention or replace institutional retention/custody rules.
- Redacted exports still require inspection; redaction does not guarantee anonymity.
- An AI-use declaration is not compliance certification or professional approval.
- This is a supplied-evidence review aid. It does not perform an audit, issue an audit opinion, establish control effectiveness, certify anything, determine legal compliance or grant professional approval. The authorised audit professional retains judgement and reliance decisions. Use only information permitted for the selected provider; local encrypted storage does not itself authorise provider disclosure.

## Related Amo.ng resources

**Prompts:** [AMO-P-000155 — Sensitive Data Handling Checklist for AI Workflows](https://amo.ng/prompts/sensitive-data-handling-checklist-ai-workflows) v2.0.1; [AMO-P-000149 — Team AI Usage SOP and Review Loop](https://amo.ng/prompts/team-ai-usage-sop-review-loop) v1.0.1; [AMO-P-000071 — Evidence-Grounded AI Output Verification and Release Gate](https://amo.ng/prompts/ai-output-verification-checklist) v2.0.0

**Workflows:** [AMO-W-000002 — Vendor Procurement Due Diligence](https://amo.ng/workflows/vendor-procurement-due-diligence)

**Skills:** [AMO-S-000016 — Trace Consequential Claims to Original Evidence](https://amo.ng/skills/trace-consequential-claims-to-original-evidence)

These are complementary methods, not additional proof of the same claim. Read their current source boundaries; open their normal resource pages for the full instructions. Existing resources and their verification status remain unchanged.

## Related audit Prompts and Workflow

- [AMO-P-000361](https://amo.ng/prompts/challenge-internal-audit-engagement-scope-evidence-plan) exposes scope/data dependencies.
- [AMO-W-000044](https://amo.ng/workflows/evidence-controlled-internal-audit-working-paper) requires this record alongside final human review.

Use of these resources is subject to the [Amo.ng Terms](https://amo.ng/terms).