The evidence file

36 artefacts appear across AI in finance and accounting. 0 of them are demanded by more than one obligation, which makes them the ones worth building first: the same document, properly made, discharges several duties at once. An artefact that is merely present does not discharge anything, so each entry records what makes it sufficient — that sentence is the part an assessor is testing.

What you will be asked for

• A data classification stating what may enter each tool

  One obligation

  • IESBA Code R114.1, R114.2, 114.3 A3 and R114.4 — Confidentiality

    Written per tool: this assistant may take internal management information, that one may not take customer-identifying material. A single line forbidding “sensitive data” leaves the classification to whoever is in a hurry.

• A declination record with the reasons as communicated

  One obligation

  • IESBA Code R230.3 and R230.4 — Acting with Sufficient Expertise

    What was refused, to whom the reasons were given, and on what date. Communicating them is a separate mandatory act, so a decision living only in the accountant’s own notes discharges half the provision.

• A leavers record covering prompt libraries and custom assistants

  One obligation

  • IESBA Code R114.1, R114.2, 114.3 A3 and R114.4 — Confidentiality

    What a departing accountant may take with them. Prior experience travels; the material does not, and a saved thread holding a client’s pricing structure is the material.

• A named route to someone who can explain the output

  One obligation

  • IESBA Code R220.8 — Using the Output of Technology

    Who inside the employing organisation understands how this tool produces what it produces, and whether that person was reached before reliance. A supplier support desk is not that person.

• A reasonableness challenge note against an independent expectation

  One obligation

  • IESBA Code R220.4, R220.5 and R220.6 — Preparation and Presentation of Information

    The check against a separate source or a prior-period expectation, and what it showed. The point is not that the figures agreed; it is that something other than the model was consulted before the number was used.

• A reasoned conclusion that nothing needed escalating

  One obligation

  • IESBA Code R220.9 and R220.10 — Addressing Information that Is or Might be Misleading

    Where a doubt arose and was closed without going further, the note saying why. Its absence is the finding: nothing then distinguishes a matter considered and settled from one never examined.

• A record of what the tool’s own confidence figures were tested against

  One obligation

  • IESBA Code 110.1 A1(b)(iii) — Objectivity

    Self-reported accuracy is a claim by the party whose work is under review. What counts is whether anything independent corroborated it, and where nothing did, whether that limited the conclusion drawn.

• A reliance rationale for each material use

  One obligation

  • IESBA Code 110.1 A1(b)(iii) — Objectivity

    Why this degree of dependence was appropriate here, given what could be established about how the output was produced. Undueness is circumstantial, so the record has to be circumstantial too.

• A technology-use judgement record, one per material use

  One obligation

  • IESBA Code R220.8 — Using the Output of Technology

    Names the tool and version, what it produced, which steps the accountant decided this use needed, and the reasoning. Without a contemporaneous note, nothing separates a considered decision from an unexamined one.

• A threat register naming the bias, not the technology

  One obligation

  • IESBA Code 120.12 A2 — Bias

    Automation bias recorded as live for the specific judgements this function makes with machine support, with the chosen responses beside it. A register whose entry reads “AI risk” has identified a technology, not a threat to a fundamental principle.

• A version record tying the figure to the configuration that produced it

  One obligation

  • IESBA Code R220.4, R220.5 and R220.6 — Preparation and Presentation of Information

    Tool, settings and date, held with the deliverable. Where a covenant or an incentive turns on the number, the question of what produced it arrives months later, by which time the configuration has moved on.

• An assumption schedule for every model-produced forward-looking figure

  One obligation

  • IESBA Code R220.4, R220.5 and R220.6 — Preparation and Presentation of Information

    Separating what the tool generated from what management set, with the source of each. It is what makes the difference between a forecast and an output nobody can interrogate.

• An escalation log with dates, recipients and responses

  One obligation

  • IESBA Code R220.9 and R220.10 — Addressing Information that Is or Might be Misleading

    Each rung: who it was put to, what was asked for, what came back. The ladder is the only part of this duty capable of being proved by something other than recollection.

• An expectation formed and recorded before the output was seen

  One obligation

  • IESBA Code 110.1 A1(b)(iii) — Objectivity

    What the accountant expected, on what basis, written first. It is the only artefact capable of distinguishing a conclusion they reached from one they were handed and did not disturb.

• An identifiability assessment for anything a model was fitted to

  One obligation

  • IESBA Code R114.1, R114.2, 114.3 A3 and R114.4 — Confidentiality

    Whether the people and entities the material concerns can be recovered from what the system generates. That question is separate from whether the input was ever disclosed, and it is rarely on a review checklist.

• Bias-identification training in the CPD record

  One obligation

  • IESBA Code 120.12 A2 — Bias

    Named in the Code as part of continuing professional development, which makes it a recorded item rather than an attitude. A generic session on how large language models work does not evidence it.

• Competence criteria written for AI-assisted work

  One obligation

  • IESBA Code R113.1, 113.1 A3, R113.2 and R113.3 — Professional Competence and Due Care

    What a person must be able to do before using this tool on this work, expressed as capabilities rather than as courses attended. Without criteria there is nothing to evaluate anyone against, and the file records availability instead.

• Continuing development in the tool’s method, not in AI generally

  One obligation

  • IESBA Code R113.1, 113.1 A3, R113.2 and R113.3 — Professional Competence and Due Care

    How this class of model produces its output and where it fails. An introductory session on generative systems evidences interest in the subject and answers nothing about the activities actually undertaken.

• Dissent and override history across the function

  One obligation

  • IESBA Code 110.1 A1(b)(iii) — Objectivity

    Occasions on which a person departed from the output, with reasons. A period in which nobody ever departed is not proof of a good tool; it is the pattern the third limb describes.

• Evidence of challenge where output was accepted against contrary indications

  One obligation

  • IESBA Code 120.12 A2 — Bias

    Who challenged, what they put, and what changed. Consulting others is one of the responses the Code contemplates, and a consultation leaving no trace is indistinguishable from agreement.

• Evidence of lifecycle oversight and access control

  One obligation

  • IESBA Code R220.8 — Using the Output of Technology

    Who approved the tool’s introduction, who may operate it, and what governs it when it changes. Two of the eight factors turn on the organisation’s arrangements rather than on any individual’s care.

• Fitness-for-purpose evidence for the task actually performed

  One obligation

  • IESBA Code R220.8 — Using the Output of Technology

    Supplier testing or internal evaluation covering that task, not the product in general. Where neither exists, the memorandum recording the absence is itself what an assessor asks to see.

• Override notes from occasions when the tool was contradicted

  One obligation

  • IESBA Code 120.12 A2 — Bias

    Cases where a person disagreed with the system and set out why. They are the only positive proof that the tendency is being addressed rather than merely described in a policy.

• Retention and destruction terms taken from the contract

  One obligation

  • IESBA Code R114.1, R114.2, 114.3 A3 and R114.4 — Confidentiality

    Not from a supplier’s security page. The principle covers storage, retention and lawful destruction, so what is needed is a term somebody could enforce and a configuration that matches it.

• The addressing steps considered, and what each would have cost

  One obligation

  • IESBA Code R230.3 and R230.4 — Acting with Sufficient Expertise

    Manual re-performance, a narrowed scope, an expert brought in, more time requested. A file showing only the outcome invites the reading that nothing short of refusal was ever attempted.

• The audience, purpose and context statement

  One obligation

  • IESBA Code R220.4, R220.5 and R220.6 — Preparation and Presentation of Information

    Who the information is for, what decision it supports, and what they are being asked to take on trust. R220.6 asks for this in terms, and very few management packs carry it.

• The bias consideration recorded at preparation rather than at review

  One obligation

  • IESBA Code R220.4, R220.5 and R220.6 — Preparation and Presentation of Information

    Which known distortions could reach this figure through the data or the method, and what was done about them. Sub-paragraph (f) is a duty of awareness, and awareness either leaves a note or leaves nothing.

• The correction or notification record

  One obligation

  • IESBA Code R220.9 and R220.10 — Addressing Information that Is or Might be Misleading

    Whether the figure was corrected, and whether people who already had it were told. A fix that reaches only the next reporting cycle leaves the earlier recipients exactly where they were.

• The disassociation determination and what it refused

  One obligation

  • IESBA Code R220.9 and R220.10 — Addressing Information that Is or Might be Misleading

    Where matters reached that point: what was refused, on what date, and which options had been exhausted first. Rare, and the one record an employer will not be keeping on the professional’s behalf.

• The input record: data supplied, configuration and prompts

  One obligation

  • IESBA Code R220.8 — Using the Output of Technology

    Kept with the deliverable rather than in a chat history nobody can retrieve. Inputs and the human decisions taken during use bear directly on the judgement, so they belong in the file with it.

• The limitations notice given to users, and where it appears

  One obligation

  • IESBA Code R113.1, 113.1 A3, R113.2 and R113.3 — Professional Competence and Due Care

    What the client, employer or recipient was told about what the work cannot support, in the deliverable rather than in a file note. Making users aware is an outward act, so an internal record does not evidence it.

• The misleading-information memorandum

  One obligation

  • IESBA Code R220.9 and R220.10 — Addressing Information that Is or Might be Misleading

    What was believed misleading, on what basis, and when the belief formed. Written before the escalation rather than after its outcome, because its whole value is that it fixes a state of knowledge at a date.

• The representation actually made about expertise

  One obligation

  • IESBA Code R230.3 and R230.4 — Acting with Sufficient Expertise

    What the accountant told the employing organisation about their command of the tool and its method. The prohibition is breached by allowing a belief to stand, so the artefact is the statement rather than the silence.

• The supervision record for staff using tools the supervisor does not

  One obligation

  • IESBA Code R113.1, 113.1 A3, R113.2 and R113.3 — Professional Competence and Due Care

    What the supervisor asked and what they were able to check for themselves. Reviewing an output is not supervising a method, and the duty attaches to the person holding authority over the work.

• The threat assessment that preceded the decision

  One obligation

  • IESBA Code R230.3 and R230.4 — Acting with Sufficient Expertise

    Which of the named conditions were present — time, information, expertise — and what was tried before concluding the threat could not be addressed. It is what makes this a determination rather than a refusal.

• The written authorisation contemplated by 114.3 A3

  One obligation

  • IESBA Code R114.1, R114.2, 114.3 A3 and R114.4 — Confidentiality

    Naming the information, the purpose, who undertakes the activity, and whether the source or the subjects stay identifiable in what comes out. Obtained before the activity, not reconstructed after a query arrives.