To prove an AI posting decision to an auditor, you need to produce, for any invoice they choose: the invoice and the evidence the system relied on, the signed authority that allowed it to act, the version of that authority in force on the day, the confidence assessment and the outcome, and a record that could not have been altered afterwards. Add the name of the person accountable and the trail for anything escalated, and you have proof rather than reassurance.
Auditors are not testing your AI. They are testing a control. For supplier invoices the questions are old ones: did the expense occur, is it recorded at the right amount, in the right period, against the right account, and was it authorised by someone entitled to authorise it? Whether a person or a system made the posting, the auditor wants the same thing: evidence that the control was properly designed and that it operated consistently through the period.
AI changes the form of the evidence, not the standard. If anything it raises the bar, because "the system did it" is not an answer to "who authorised this?"
For any single posting, you should be able to retrieve:
If any of these lives only in a vendor's dashboard that you cannot export, treat it as missing.
Authority is where many AI arrangements are weak. A mandate is the written limit within which the system may act: which suppliers, which value bands, which nominal codes, and which conditions force a stop. It needs the finance owner's signature, a date and a version number. When it changes, the old version is kept, so you can show the auditor exactly what the system was permitted to do on 14 March, not what it is permitted to do today.
A log you can edit is a diary. An auditor needs to know that the record they are reading is the record that was written at the time. Two properties matter. Append-only means entries can be added but never changed or deleted. Tamper-evident means any attempt to alter an entry would be detectable.
One common method chains entries together so that each carries a fingerprint of the one before it. Change an old entry and every fingerprint after it stops matching. You do not need to explain the cryptography to your auditor. You do need to be able to say how alteration would be detected, and by whom.
Auditors are drawn to exceptions, and rightly. Be ready to show every invoice the system flagged or stopped in the period, who dealt with it, what they decided and how long it waited. Human overrides of the system's proposal matter as much as the system's own decisions. A pattern of overrides on one supplier tells a story, and it is better that you have read it first.
None of these shows authority, integrity or consistent operation. They are assertions, and auditors are paid to be unmoved by assertions.
Pick ten postings from last month at random. For each, retrieve the full evidence pack and time yourself. If any takes more than a few minutes, or depends on someone remembering what happened, you have found your weak point before the auditor did.
Then speak to your audit partner well before year-end. Share the mandate and a sample decision record, and ask what else they would want to see. Auditors much prefer being consulted to being surprised, and the conversation costs far less in October than in a fieldwork week.
Mandate is built around this evidence pack. Its agent, Invoice Maestro, makes the posting decision on supplier invoices inside a mandate the finance owner signs, scores its confidence on five named factors, escalates unclear cases to a named person, and writes every decision, with its evidence and the mandate version in force, to a tamper-evident, append-only audit trail. You can test whether that record satisfies your own auditor through the 60-Day Proof: sixty days on your own invoices, read-only and free, across two month-ends, with a day-60 report you keep, at runmandate.co.uk/60-day-proof.
Auditors assess controls, not tools. If you can show signed authority, a consistent record that cannot be altered and proper handling of exceptions, the posting is evidenced on the same terms as one made by a person.
No. You need to explain the control: what the system may do, how its decisions are recorded, and how exceptions reach a person. The internals of the model are rarely in scope.
As long as the underlying accounting records. HMRC generally expects company records to be kept for six years from the end of the accounting period, so check your own retention policy and make sure the records stay with you if you change provider.