The Compliance Checklist Your Auditor Will Send About AI. Before You're Ready.
An audit notice arrives. The first question on the new workpaper is not about your balance sheet. It reads: "Which AI systems had access to your financial data in the past 12 months, where did that data go, and who authorized each access?" Most finance teams cannot answer that question from memory. Few can answer it from documentation.
Your auditor is not asking whether you use AI. They are asking whether you can prove you controlled it.
The Audit Question That Changed
External audit scope has traditionally covered financial data accuracy — the numbers on the statements, the controls that generated them, the evidence trail from transaction to disclosure. AI governance has entered that scope not because auditors created a new standard — AI is now part of how financial data is generated, processed, and reported.
Finance teams using AI to categorize expenses are having AI tools make accounting entries. AI reconciliation tools influence what gets matched and what gets flagged. AI tools used to answer financial questions interact with data that appears directly in financial statements. The audit trail question — "how was this number generated?" — now runs through AI workflows that many organizations have never documented.
77% of employees who use AI for work paste confidential company data into it — and 82% of those do it from personal accounts, according to LayerX 2025 research. Your auditor does not need to find a breach to flag a problem: they need only establish that financial data touched AI systems without documented governance. That gap — between AI use and AI governance — is what the new generation of AI-aware audit workpapers is designed to surface.
The Three Questions on the New Workpaper
AI governance audits converge on three questions, regardless of whether the auditor works in financial statement audit, internal controls review, or regulatory examination.
First: the AI inventory. Which AI systems had access to financial data in the 12 months under review? This includes formally approved tools, AI features embedded in accounting software (Sage, Cegid, Xero, and QuickBooks all added AI capabilities in 2023–2024), and tools employees used individually without formal approval. Most finance teams discover they are already using AI in three places they never formally documented: software-embedded AI features activated as standard updates, team-level AI subscriptions paid for on corporate cards, and individual AI tool usage by finance staff that was never prohibited. Never tracked.
Second: the data flow. Where did financial data go when it touched each AI system? In-house or to external servers? Within the EU or to US-hosted infrastructure subject to the CLOUD Act — the 2018 US law that allows American authorities to compel access to data held by US companies anywhere in the world? In real time or in batches? The data flow documentation required for this question is the same documentation required for GDPR Article 30 processing records — Article 30 requires organizations to maintain written records of all their data processing activities — so organizations that have maintained proper GDPR records have a head start, while those that haven't face two compliance gaps simultaneously.
Third: the authorization chain. Who approved each AI system for use with financial data? Was that approval documented? Did it include a risk assessment, a Data Protection Impact Assessment, or a PCI-DSS scope review (PCI-DSS is the Payment Card Industry Data Security Standard — mandatory for any entity processing card payment data)? If the approval was informal — "the IT team enabled the feature" or "employees started using it and nobody stopped them" — that is the answer the auditor is looking for. It is the answer that generates a finding.
What Samsung Demonstrated
In 2023, Samsung engineers pasted proprietary semiconductor source code into ChatGPT — three separate incidents in a single month. Samsung's response was immediate: internal AI bans across the organization. The incidents demonstrated that the risk of uncontrolled AI use with sensitive data is not theoretical. It is the default behavior of employees who have access to powerful AI tools and no documented policies about what can be shared.
Finance teams face the same exposure every time a team member pastes a financial document into an AI tool. Samsung's engineers were not trying to leak intellectual property. They were trying to solve technical problems quickly. Finance staff using AI to answer payment questions, reconcile accounts, or prepare reports are solving workflow problems — and may be sending financial data to external AI infrastructure that no audit has reviewed.
Samsung's internal response — banning AI tools — is not the answer available to most finance teams. Finance AI use is already too embedded and too valuable to prohibit. The available response is governance: documenting which AI tools are authorized, what data they can access, where that data goes, and who is accountable for each system's use.
The French FEC Intersection
For French financial entities, AI governance intersects with the FEC compliance obligation in a way that concentrates audit risk. The FEC — the fichier des écritures comptables, the standardized accounting export that France's tax authority (DGFiP) can demand with 15 days' notice — requires a complete, traceable chain from source transaction to accounting entry. The penalty for failing to produce it: €5,000.
Every AI tool involved in the accounting process — categorizing entries, suggesting reconciliations, flagging anomalies — requires FEC audit trail documentation of those AI contributions. An accounting entry that was generated, modified, or approved using an AI system without a traceable record creates a gap in the audit chain that the FEC assessment will surface. For any French entity using AI in their accounting workflow without governance documentation, the FEC risk and the general AI governance risk are the same risk expressed twice.
Building the Documentation Before the Auditor Arrives
A complete AI governance record requires four components, all of which can be built in 60 to 90 days for organizations starting from scratch.
Phase one, the first 30 days: conduct a full AI inventory — every tool in active use across the finance department, every user with access, every data category processed. The inventory must include software-embedded AI features, not just explicitly adopted tools. A survey of the finance team ("which AI tools do you use for your work, including features within the software you already use?") surfaces the informal adoption that system logs miss.
Second phase, days 30 through 60: establish a data processing agreement with every AI vendor identified in the inventory. For tools that cannot produce a GDPR-compliant DPA — with EU-only processing commitment, explicit training prohibition, and full sub-processor list — document the risk and initiate a transition plan. Add each AI tool to the DORA ICT third-party register (DORA — the EU's Digital Operational Resilience Act — requires EU financial entities to maintain a formal list of every technology provider from January 2025). Complete Data Protection Impact Assessments for any high-risk AI processing identified.
Month three, days 60 through 90: document the authorization chain for each AI tool. Who approved it? What was the governance basis for approval? What are the policies governing its use? What oversight mechanisms exist? Store this documentation in a format that can be retrieved and presented to an auditor within 48 hours of request.
Building this record in 90 days answers every question on the new audit workpaper. The record you don't build answers those questions with silence — which auditors document as control gaps.
What Sovereign Architecture Delivers
Genuine governance requires genuine auditability. An AI system that generates source-cited, logged, verified outputs is governable. One that generates answers without documentation of what data it accessed, what it did with that data, or what reasoning produced the output is not — regardless of what the vendor's privacy policy says.
Stralevo generates an audit-ready record as a natural output of every query: which documents were accessed, which fields were read, which output was generated, and which user requested it. That record is available to an external auditor as a direct read from the system, not as a reconstruction from memory. FEC audit chains are maintained by design — every accounting-relevant query produces a traceable log linking the AI output to the source documents that generated it.
Sovereignty matters for the data flow question: data processed within EU infrastructure under documented sovereign architecture satisfies the CLOUD Act exposure question without case-by-case analysis. The answer to "where did your financial data go?" is a documented architecture diagram, not a best-guess inference from vendor privacy pages.
What the Next Audit Looks Like
By 2026, AI governance questions are expected to appear in standard audit workpapers for EU financial entities — coordinated between financial services supervisors (France's ACPR banking regulator, the AMF securities regulator, and the European Banking Authority) and EU AI Act market surveillance authorities. The organizations that built AI governance documentation in 2025 will answer those workpapers from their records. The others will build the answers under audit pressure.
The question on that workpaper is already written: "Which AI systems had access to your financial data, where did that data go, and who authorized each access?" The organizations that can answer it are ready. The ones that discover, on receiving the workpaper, that they cannot — will recognize the moment the governance work should have started.
---
Stralevo generates audit-ready AI governance documentation as standard output: source citations, access logs, query records, and FEC-compliant audit chains. For organizations preparing their AI governance record before the next audit cycle: the documentation infrastructure is ready from day one.