Building Defensible AI Agents for Audit

In audit, being right isn't enough; you have to show the decision making process behind it. We've learned this building agents that run in live audits at some of the largest accounting firms. This raises the question: what does agentic decision making look like?

Let's Build an Agent

We'll take a financial audit use case and focus on a specific procedure: testing a company's bank reconciliation. Companies compare the cash balance on their books to what their bank reports, and any difference should be explained by things like deposits in transit or uncleared checks. Testing this is tedious, high-volume work for clients with many accounts, which makes it a good fit for an agent.

How might we do this? Feed the agent the client's books, reconciliation, and bank evidence. Include the audit methodology in the prompt and use prior-year audits as examples. Finally, build an eval from previously reviewed audits and ensure a human signs off before anything is finalized. The metrics look great, users are happy, and we ship it.

Then, the audit gets selected for peer review or inspection, and someone asks: why was that sufficient? They don't care what the evals say, and they don't even care what the users say. For this specific audit, in this specific instance, why was this decision made?

Controls for Defensibility

In light of this, what does it mean to arrive at a "defensible" answer? Audit standards have a good definition for inspiration, paraphrased as "an experienced auditor, new to the work, can follow it". We can translate this into "can follow the agent" and enforce this through multiple controls: authorization, execution control, evidence provenance, and evaluation integrity. Additionally, there is always the line where an agent stops and a human makes the final call.

Authorization. An auditor flags a $62,500 outstanding check that hasn’t cleared in 90 days, and a reviewer signs off. A few days later, new statements arrive, which trigger the agent, and it clears the exception. If that write goes through without review, the signature now vouches for an answer that wasn’t reviewed. In Fieldguide, the agent raises a task to the human auditor instead, and the auditor sees the agent’s work on their dashboard, then goes in to review and finalize. Authorization isn’t just “can this identity call this tool”; it’s whether this action is allowed on this object, in this state, right now.

Execution Control. The agent says a $96,400 check cleared. An auditor reruns the job, and today’s run reads $69,400. Logs tell you the job ran, but they don't let you reexamine one decision. Instead, we break the run into steps (fetch, extract, match, conclude), and record each step’s inputs, outputs, and model version under a stable ID. Then we rerun only the contested step on its exact inputs. At Fieldguide, each use case is pinned to a model chosen by evals, and model changes go through a change management process.

Evidence Provenance. The agent cites a January bank statement for a $61,900 deposit. Where did the citation come from? Many documents could share the same name, or the same document could have been modified over time. We bind every citation to a stable identity (document ID, version, hash), not the model’s text. Then we enforce that the evidence attributes the claim depends on, such as account number, period, and amount, actually match.

Evaluation Integrity. Can we trust the eval? If it's built on last year’s conclusions, not ground truth, there could be misses where the agent was actually right, but the label was wrong. There could also be hits where the agent was actually wrong, but the eval wasn't updated to reflect changes in methodology. We tag every gold label with the methodology and period it’s valid for, audit both the misses and the hits, and report results by client, account type, and exception type. We also measure consistency across runs as part of our evals.

Human Review. Each case above had a moment when the agent and human needed to work together. In Fieldguide, a reviewer experience alongside agents makes it easy to review an agent’s work, and AI labels show all outputs created by AI.

Going Beyond Audit

None of this is specific to bank reconciliations or even financial audit. Fieldguide supports dozens of types of work across audit and advisory, and the same controls apply every time. Fieldguide is certified under ISO/IEC 42001, which covers how we govern AI across the company, and AIUC-1, which includes third-party evaluations of our agents every quarter.

Explainability and defensibility, not just correctness, is essential.