Audit rigour for AI: the finding as the unit of proof

Producing text has become almost free, and a fluent answer inspires confidence long before it has been checked. For an organisation that prepares a committee, assesses a file or drafts an opinion with generative AI, the question is no longer whether the text is well written, but what it rests on. Turning scattered information into a reliable conclusion is something audit made into a profession long ago. Its standard of proof applies well beyond its own ranks.

What audit calls evidence

Before concluding, the auditor gathers sufficient and appropriate evidence. Sufficient to support the conclusion, appropriate because it is relevant to the objective and reliable, as defined in the audit glossary of the European Court of Auditors.

In France, NEP 500, the professional auditing standard approved by ministerial order on 19 July 2006, spells out the terms. Sufficiency is assessed against the quantity of evidence gathered, which depends on risk and on its quality. The reliability of evidence depends on its origin, its nature and the circumstances in which it was obtained. The formula appears in every statutory audit report: the evidence gathered is judged sufficient and appropriate to support the auditor’s opinion.

The formula sounds administrative. Yet it holds a whole ethic of intellectual work.

A conclusion is only as good as the evidence behind it, and someone must be able to trace one back to the other without relying on the memory of whoever wrote it.

For a long time, this requirement was a luxury reserved for the professions obliged to meet it. Checking takes time, so does finding the right document, and most organisations run on reasonable trust in their own files. AI changes this equation: for the first time, it makes systematic verification possible at scale, provided the tools are built for it.

Intelligence professionals describe this work as a cycle. You direct the search, you collect, you analyse what you found, you share the result, and that result redirects the next search. The cycle describes the work of a monitoring unit just as well as that of an internal audit team or a research department: every organisation produces intelligence, often without calling it that.

From the report to the finding

Faced with the sourcing errors of AI tools, invented references or citations that do not support what they are made to say, the answer already exists in audit. It means changing the unit. You stop treating the report as a block of text and treat it as an assembly of findings, each linked to its sources down to the passage.

A finding worthy of the name meets the two criteria of the auditing standard. It is sufficient, meaning backed by enough evidence to stand, and appropriate, meaning backed by relevant and reliable evidence. To these two criteria, AI makes it possible to add two more that used to be too costly. The finding is traceable, since one click leads to the exact passage. It is reproducible, since you can rerun the search and retrieve the same evidence.

Review finding by finding, check in proportion to risk

This unit changes how you work. Review happens finding by finding, and a reviewer can approve, challenge or ask for a second source on a specific point. Versioning keeps track of every change.

Human oversight, for its part, is proportionate to risk. NEP 500 sets no number of sources: it requires a quantity of evidence proportionate to risk and to its quality. The method we propose draws on it. A finding that drives an important decision benefits from corroboration by a second source and a review; a descriptive finding can rest on one. The day someone asks where a figure comes from, the answer takes ten seconds.

What regulators are starting to expect

Regulated professions are the first to formalise what will eventually apply to everyone, and they have started. The Royal Institution of Chartered Surveyors, the professional body for property and construction, has applied since 9 March 2026, to its members and the firms it regulates worldwide, a mandatory professional standard on the responsible use of AI. According to LexisNexis, it covers governance and risk management, professional judgement and oversight, transparency with clients and responsible development, with risk registers, usage policies and supplier due diligence before any purchase.

At European level, Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, amended the AI Act. In force since 27 July 2026, it postpones to 2 December 2027 the obligations for high-risk systems in Annex III, and to 2 August 2028 those for systems embedded in regulated products. Lawyer Arnaud Dimeglio notes that the transparency obligations of Article 50 have applied since 2 August 2026, the Omnibus having left them on schedule. Querying your documents or drawing deliverables from them mostly falls outside the high-risk scope. But the direction is clear: document, oversee, be able to explain.

These texts converge on the same expectation within their respective scopes: being able to show where conclusions produced with AI come from. Our reading is that this expectation will spread beyond regulated professions. Organising now around the sourced finding means getting ahead.