AI Audit Outputs and Reports

What it is

Audit outputs are what the audit delivers: findings, ratings, an overall conclusion or opinion, recommendations and agreed management actions. The report communicates them to the people who must act, and follow-up confirms that actions were taken.

AI audit reports must make technical issues, such as drift, bias or prompt control, understandable to executives and boards, and link them to business, legal and human impact.

How it works

Structure of a finding

The cause is what makes a recommendation useful. Fixing the condition alone, by validating the three models, leaves the cause to produce the next gap.

Rating findings

Findings are rated, for example high, medium or low, using the audit function's methodology. For AI, ratings should reflect impact on people and compliance, not only financial loss, and the number of decisions affected.

Overall conclusion

The report gives an overall conclusion on the objective, such as whether controls provide reasonable assurance. It must state the scope, period, model versions covered and any limitations, for example where the vendor denied access to model documentation or data was unavailable. A limitation that prevents a conclusion must be reported, not hidden.

Audience and communication

Plain language is essential. "The model's recall for small-business applicants fell below the threshold" may need to become "the model is missing more bad loans for small businesses than the policy allows".

Management responses and action plans

Management responds to each finding with an action, owner and due date. The auditor checks that actions address the cause. If management accepts the risk instead, the auditor confirms the person accepting has the authority and that the acceptance is within appetite; if not, the auditor escalates.

Follow-up

The auditor tracks actions and verifies closure with evidence, not just management's statement that the work is done. For AI, closure may need a retest: the fairness metric now within threshold, or the pipeline now blocking unapproved deployments.

Independence in reporting

The auditor reports objectively, including findings that are unwelcome. Draft findings are discussed with management to confirm facts, but the auditor decides what the report says.

Using AI in reporting

AI tools can draft finding summaries, harmonise wording and produce dashboards of AI audit results. The auditor remains responsible: every statement must be checked against work papers, confidential data protected and the use of AI recorded. AI drafting must not soften or alter a finding's substance.

Reporting on AI metrics

Audit reports may also comment on how well management reports AI KPIs and KRIs, for example whether the board sees fairness and drift indicators, not only adoption figures.

A worked example

An audit of a claims triage model finds that monitoring thresholds are breached monthly with no action. Management proposes to raise the thresholds so breaches stop.

The auditor notes that raising thresholds addresses the symptom, not the cause, and may hide harm. The report rates the finding high, states the effect on claimants, and recommends defined escalation with owner action. Management's response is escalated to the audit committee because the proposed action does not address the risk.

How the exam asks about this

• "Which element of an audit finding is MOST important for an effective recommendation?" The root cause.
• "Management states a finding has been fixed. What should the auditor do?" Obtain evidence, and retest where needed, before closing it.
• "The vendor refuses access to model documentation needed for the audit. How should this be reported?" As a scope limitation in the report, with its effect on the conclusion.