Auditors Struggle to Verify AI Decisions

In 2026, auditors and chief information officers (CIOs) are struggling to verify AI decisions because current audit methods assume predictable processes and human sign-off, while large language models (LLMs) can give different answers to the same question. AI agents now score loan applications, assess inventory, shape financial statement figures and interact with IT and operational systems, but existing audit models do not account for this variability. Gartner analyst Lauren Kornutick said AI is advancing faster than audit frameworks, which depend on repetition.

Conventional audit trails record activities and events, but prompt logs and model outputs show only what entered a system and what came out; they do not show the intervening process or whether results are reliable. PwC US AI assurance leader Jennifer Kosar said organizations should create and retain records as systems operate rather than reconstruct them later. KPMG audit partner Mike Sawyer said AI audits now need to examine how AI is used in a process, what information goes into a model, how its output is generated and used, and how much the organization relies on it.

Oversight can break down when technology and finance teams understand different parts of a system but lack records connecting them. Gartner's 2026 AI Governance Survey of 697 AI leaders found that business leaders rated bias and fairness monitoring very or moderately difficult 67% of the time; output accuracy mechanisms were difficult 66% of the time, and responsible AI policy 64% of the time. Kornutick said there is no established playbook for AI-specific controls such as drift (changes in a model’s performance over time), bias monitoring and output accuracy. She also said generative AI does not provide a step-by-step path from prompt to response, and controlling every input still cannot guarantee predictable output.

Organizations must decide how much information to collect and retain. Real-time inference logs (records of a model’s responses when used) are expensive, so some organizations continuously monitor only their highest-risk systems and use point-in-time audits for others, reducing visibility and potentially leaving them in violation of external regulations. Kornutick said traceability and data retention are rooted largely in legal factors, and recommended due diligence and mitigating controls. Sawyer said a defensible AI audit should establish what data was used, how output was evaluated, who reviewed it and how it influenced the final decision.

Kosar outlined three layers for accountability: assess system design, risks and controls; periodically review those decisions as risks evolve; and independently check whether the first two layers worked correctly. A record of decisions, tests, approvals, exceptions and changes can improve visibility and reduce costly forensic audits. Vendors in the space include Optro (formerly AuditBoard), TeamMate, Workiva and Archer, as well as Credo AI, IBM watsonx.governance and Holistic Ai, which track bias, accuracy and drift. Kosar said AI features are appearing in enterprise software business teams already use, so existing controls may no longer work. She urged CIOs to treat auditing as ongoing; Sawyer said AI audit readiness is a business capability, and Kornutick called on CIOs to take ownership.

In 2026, auditors and chief information officers (CIOs) are struggling to verify AI decisions because current audit methods assume predictable processes and human sign-off, while large language models (LLMs) can give different answers to the same question. AI agents now score loan applications, assess inventory, shape financial statement figures and interact with IT and operational systems, but existing audit models do not account for this variability. Gartner analyst Lauren Kornutick said AI is advancing faster than audit frameworks, which depend on repetition.

Conventional audit trails record activities and events, but prompt logs and model outputs show only what entered a system and what came out; they do not show the intervening process or whether results are reliable. PwC US AI assurance leader Jennifer Kosar said organizations should create and retain records as systems operate rather than reconstruct them later. KPMG audit partner Mike Sawyer said AI audits now need to examine how AI is used in a process, what information goes into a model, how its output is generated and used, and how much the organization relies on it.

Oversight can break down when technology and finance teams understand different parts of a system but lack records connecting them. Gartner's 2026 AI Governance Survey of 697 AI leaders found that business leaders rated bias and fairness monitoring very or moderately difficult 67% of the time; output accuracy mechanisms were difficult 66% of the time, and responsible AI policy 64% of the time. Kornutick said there is no established playbook for AI-specific controls such as drift (changes in a model’s performance over time), bias monitoring and output accuracy. She also said generative AI does not provide a step-by-step path from prompt to response, and controlling every input still cannot guarantee predictable output.

Organizations must decide how much information to collect and retain. Real-time inference logs (records of a model’s responses when used) are expensive, so some organizations continuously monitor only their highest-risk systems and use point-in-time audits for others, reducing visibility and potentially leaving them in violation of external regulations. Kornutick said traceability and data retention are rooted largely in legal factors, and recommended due diligence and mitigating controls. Sawyer said a defensible AI audit should establish what data was used, how output was evaluated, who reviewed it and how it influenced the final decision.

Kosar outlined three layers for accountability: assess system design, risks and controls; periodically review those decisions as risks evolve; and independently check whether the first two layers worked correctly. A record of decisions, tests, approvals, exceptions and changes can improve visibility and reduce costly forensic audits. Vendors in the space include Optro (formerly AuditBoard), TeamMate, Workiva and Archer, as well as Credo AI, IBM watsonx.governance and Holistic Ai, which track bias, accuracy and drift. Kosar said AI features are appearing in enterprise software business teams already use, so existing controls may no longer work. She urged CIOs to treat auditing as ongoing; Sawyer said AI audit readiness is a business capability, and Kornutick called on CIOs to take ownership.