Audit

1. Introduction

1.1 Background

Auditing is the track in the Risk & Compliance group where the deliverable itself is the evidence. For other tracks, AI outputs (risk-control scores, review opinions, alert conclusions) usually only need to reconstruct the process when challenged; but an audit's working papers have existed from day one to be inspected by finance authorities, institute quality reviews, regulators, and even courts.

From 2025 to 2026, the global audit standards system responded intensively to AI: the International Auditing and Assurance Standards Board (IAASB) proposed on 2026-08-05 to revise three core standards — ISA 330, ISA 500, and ISA 520 — extending the definition of audit evidence into the digital-technology context; the Institute of Internal Auditors (IIA)'s Global Internal Audit Standards (2024 edition) took effect on 2025-01-09 and released a suite of AI tools for internal audit throughout 2026; and the Chinese Institute of Certified Public Accountants (CICPA) issued a risk-prevention notice on 2026-03-05, giving the most direct written position on the Chinese regulatory side regarding "the use of AI in auditing".

These texts share a common conclusion, which is the anchor for the whole of this track: the CICPA 2026-03-05 notice states explicitly — "Using AI tools in auditing cannot replace the CPA's professional judgement, nor does it reduce the CPA's responsibility for the audit opinion." The guidance issued by the International Ethics Standards Board for Accountants (IESBA) in 2026 sets out the same logic: regardless of the degree of automation or technical complexity, professional accountants remain responsible for their judgement and decisions.

What this means for Harness design is that the goal of AI adoption in the audit track is not to "let AI issue audit conclusions", but to ensure that, with AI involvement, the CPA still has the capability, the materials, and the procedures to bear this non-transferable responsibility. The concrete carrier of this responsibility is the evidence chain and the working papers.

1.2 Definition

The AI Harness for the Audit track is the engineered operational layer that carries tasks such as financial statement auditing, internal control auditing, information system (IT) auditing, internal auditing, continuous auditing, and digital forensics. Its core responsibility is to solidify the entire process of AI participation in auditing into an evidence chain that can be inspected, recomputed, and held accountable, rather than to accelerate the production of audit reports.

This track covers five categories of tasks:

Key defining note: all AI outputs in the audit track are audit leads pending verification. The CICPA 2026-03-05 notice requires that for anomalies identified by AI, "further audit procedures be taken to confirm whether there is a risk of material misstatement" — AI provides leads; it is the audit procedures that provide the evidence. This principle of "separating leads from evidence" is the defining feature that distinguishes this track from others.

1.3 Positioning in the AI Harness System

图 1-1｜审计方向 AI Harness 六层定位（L1–L6 · L4 瓶颈层）

数据来源：基于本文分析绘制的示意图。

The bottleneck is at L4.

The deliverable of auditing is the working paper, and the essence of the working paper is the "persistence of process evidence". The CICPA 2026-03-05 notice, following the requirements of China Standards on Auditing No. 1131 — Audit Documentation, makes it clear that the working papers should record "fully and appropriately the process and results of using AI tools, as well as the process of analyzing and adopting the results". This means that the L4 of Audit Harness is not "memory" but a tamper-evident audit trail: it must record not only what the model output, but also why a person adopted or did not adopt it.

This requirement is stricter than the "audit trail" of other tracks: other tracks' logs primarily serve internal accountability, whereas the intended reader of the audit trail is the external reviewer — when regulators inspect, the "AI recommendation + human analysis and adoption record" must form a complete supporting document; missing any part fails the check.

Key difference from other tracks: auditing is the meta-audit track of the Risk & Compliance group — it is simultaneously a "governed party" of the group's L6 (it must keep data in-domain and keep audit trails itself) and a "governor" (it conducts audits of the AI systems of the four tracks: Finance, Compliance, Legal, and Security). This means that the L4 and L6 of Audit Harness must be "self-applicable": the logs and permissions of the audit AI system itself are the first object examined when it issues internal-audit findings.

1.4 Value and Limitations

Value:

1. Full-population data analysis replaces partial sampling. The audit profession is shifting from "periodic, sample-based, retrospective review" toward "full-population data analysis, anomaly detection, predictive insight" (per the international survey on technology adoption in internal audit, Eulerich, Eulerich and Bonrath, Maandblad voor Accountancy en Bedrijfseconomie, Vol. 99, No. 4, 2025). The coverage blind spots of sampling audits are the most direct source of gains from AI adoption.
2. Upgraded structured-data processing capability. The technical examples in CICPA's Audit Standards Q&A No. 19 — Using Information Technology to Identify and Respond to Fraud Risk (published and effective 2025-01-07) show that OCR and AI models can automatically clean and merge bank-statement source files in various formats, automatically recompute the balance after each transaction and compare it with the original balance, and identify missing or discontinuous statements — mechanical checks of this kind that previously required heavy manual effort are a strength of deterministic tools.
3. Continuous auditing becomes feasible. Replacing the traditional annual risk assessment with continuous-audit planning cycles enables real-time monitoring of key risk indicators (KRIs), increasing audit coverage while reducing audit time and effort (per RSM US's published industry analysis).
4. Improvement in forensics efficiency. Google extended its open-source collaborative digital forensics platform Timesketch with agentic capabilities, driven by Sec-Gemini to automatically perform initial forensic investigations and significantly cut investigation time (Google official, 2025).

Limitations (must be faced squarely):

1. Non-transferability of responsibility is a hard constraint. The CICPA anchor statement and the IESBA guidance together show that AI participation does not change the accountable party. Any arrangement that attempts to dilute CPA responsibility on the grounds that "AI decides" is untenable under the current standards framework.
2. AI leads may not replace audit procedures before their precision is proven. Anomalies flagged by AI are only "candidates worth attention" and must be confirmed through further audit procedures; the conversion step between the two cannot be omitted.
3. Inconsistent evidence must trigger professional skepticism. The CICPA notice is explicit: if audit evidence obtained by AI is inconsistent with evidence obtained from other sources, professional skepticism must be maintained, the procedures that need to be modified or added must be determined, and the impact of that situation on the audit conclusion must be considered.
4. Data staying in-domain is a precondition. Without client authorization or legal/regulatory permission, confidential information must not be entered into or uploaded to public AI platforms; before using AI tools to process client data, the technical environment, data flows and access permissions must be ensured to be in a secure and strictly controlled state. This means the AI infrastructure for the audit track must be predominantly privately deployed or controlled, and public model platforms can only handle de-identified, non-confidential tasks.

2. Glossary

3. Case Studies

The following cases are all drawn from public materials of regulators, standards bodies, or enterprises, and are labeled with their evidence grade; relayed materials are marked "per XX report / as relayed".

3.1 Industry Transformation: From Sample-Based Auditing to Full-Population Data Analysis and Continuous Auditing

3.1.1 Background

Traditional auditing is built on a sampling logic: risk assessment identifies key account areas, and then sample tests are performed on balances and transactions. Sampling is statistically sound, but it has a structural blind spot in fraud identification — deliberately hidden transactions happen to fall outside the sample. As enterprise business processes became fully informatized and the audited data became fully digital, the audit profession gained the technical conditions to ask "can we analyze the full population directly"; at the same time, the IIA's Global Internal Audit Standards (2024 edition) took effect on 2025-01-09, and its Standard 10.3 requires the internal audit function to ensure it obtains the tools and technology necessary to perform its duties (per the IIA's official document pages), confirming at the standards level that "internal audit must use technology".

3.1.2 Approach

The industry-level transformation path runs through three layers:

• Methodological shift: according to the international survey on technology adoption in internal audit (Eulerich, Eulerich and Bonrath, 2025), the change driven by technology is from "periodic, sample-based, retrospective review" auditing toward "full-population data analysis, anomaly detection, predictive insight", shifting the internal audit function from reactive to proactive. The survey also notes that adoption challenges concentrate on four items: data privacy, cybersecurity risk, algorithmic bias, and professional-skills gaps.
• Continuous auditing in practice: RSM US's public industry analysis recommends that the 2024 IIA global standards support replacing the traditional annual risk assessment with continuous-audit planning cycles to achieve real-time risk response; introducing dashboards that integrate third-party data (tariff updates, policy announcements) or AI-based sentiment analysis to track geopolitical, economic, and regulatory indicators in real time as early-warning signals; and continuously monitoring KRIs to increase audit coverage while reducing audit time and effort.
• Skills and governance support: accounting firms have explored applying large models to areas such as data analysis, anomalous-transaction identification, and risk assessment, allowing auditors to move from "compliance-based auditing" toward "risk-oriented auditing" (per industry public reports); a Deloitte 2025 survey as relayed shows that 84% of internal auditors said AI skills are important when recruiting new auditors (original report not obtained).

3.1.3 Results

• At the standards level: the IIA 2024 global standards list technical resources as a necessary condition of the internal audit function, and in 2026 successively released a suite of tools including AI Prompting for Internal Auditors (2026-08-18), the audit committee AI coverage questionnaire (2026-06-16), and the board AI governance questionnaire (2026-06-16), turning "AI in internal audit" from a technology choice into standard-backed supporting actions (IIA official document list, Grade A).
• At the industry level: full-population data analysis extends audit coverage from samples to the whole population, and continuous KRI monitoring turns the annual risk assessment into real-time risk response (per RSM US and the above survey, Grade B).
• A limitation that must be stated honestly: no A/B-grade primary source was obtained for the quantified adoption cases and indicators of continuous auditing and continuous monitoring on the China side (see the information-gap statement); nor were authoritative statistics on internal-audit AI adoption rates obtained.

Implications for Audit Harness design: full-population analysis and continuous auditing turn auditing from an "annual project" into a "permanent system", which directly shapes the form of Harness — it is not a tool-calling assistant but a permanent, stateful data-analysis platform: L4 must carry the continuously accumulated evidence chain, and L5 must use historically confirmed conclusions as its regression set.

3.2 Regulatory Framework in Practice: CICPA AI Risk-Prevention Notice and Fraud-Identification Technical Examples

3.2.1 Background

The Chinese CPA profession's regulatory position on AI is concentrated in two documents: first, the CICPA Notice on the Risk Prevention of Using AI Technology by Accounting Firms in the 2025 Annual Report Audit (2026-03-05, Grade A); second, the Notice of the Chinese Institute of Certified Public Accountants on Doing Well the 2025 Annual Report Audit of Listed Companies (2026-01, Grade A). The former establishes four bottom lines for the use of AI, and the latter clarifies audit-procedure requirements in the new-technology environment; together with Audit Standards Q&A No. 18 and No. 19 issued and effective on 2025-01-07, they form the complete regulatory framework for "AI auditing" on the China side.

3.2.2 Approach (the four pillars of the regulatory framework)

• Data security: in strict compliance with the Interim Measures for Data Security Management of Accounting Firms, the Code of Professional Ethics for Chinese Certified Public Accountants, and similar requirements, keep confidential information learned in professional activities secret; without client authorization or legal/regulatory permission, do not disclose confidential information to third parties outside the firm, and do not enter or upload confidential information to public AI platforms; before using AI tools to process client data, ensure the technical environment, data flows and access permissions are in a secure and strictly controlled state.
• Professional skepticism: for anomalies identified by AI, further audit procedures must be taken to confirm whether there is a risk of material misstatement; information provided by AI can be verified against data obtainable from official platforms; if AI evidence is inconsistent with evidence from other sources, professional skepticism must be maintained and the audit procedures to be modified or added must be determined.
• Working-paper audit trail: under the requirements of China Standards on Auditing No. 1131 — Audit Documentation, fully and appropriately record in the working papers the process and results of using AI tools, as well as the process of analyzing and adopting the results; where necessary, relevant terms on the use of information technology may be agreed with the audited entity in the audit engagement letter.
• Information technology audit: the Notice on Doing Well the 2025 Annual Report Audit of Listed Companies points out that as business processes are closely integrated with information systems, there may be a risk of covert fraud exploiting technical privileges; the audit of controls over the information systems themselves must be strengthened, with a focus on the effectiveness of IT general controls and automated application controls; for areas adopting new technologies, such as business-process automation, artificial intelligence, cloud platforms, and big-data analysis, targeted audit procedures must be performed; attention must be paid to the quality and completeness of underlying data, and when necessary the work of information-technology specialists should be used.

The accompanying Q&A No. 19 provides technical examples that can be engineered directly: on the funds-analysis side, OCR and AI models automatically clean and merge bank-statement source files in various formats, automatically recompute the balance after each transaction and compare it with the original balance, and identify missing or discontinuous statements; then a one-to-one matching of bank statements and financial journals is performed to identify anomalous funds transactions where "the journal has an entry but the statement does not" or "the statement has an entry but the journal does not". On the behavior-analysis side, user- and merchant-behavior analysis models are built for fictitious revenue on internet platforms (concentration analysis of registration data, no large volume of consumption orders expected between 0:00–6:00, refunds without shipment after promotional periods, large single-day consumption, etc.); the counterparty analysis checks customers or suppliers whose transaction scale obviously mismatches their purchase/sales scale, fund flows with related parties such as the actual controller and directors/supervisors/senior management, and frequent or large transactions on non-working days.

3.2.3 Results

The actual effect of this framework is not reflected in some efficiency figure, but in delineating the compliance boundary of "AI auditing" in China:

• The responsibility anchor statement holds: "Using AI tools in auditing cannot replace the CPA's professional judgement, nor does it reduce the CPA's responsibility for the audit opinion" (CICPA, 2026-03-05, Grade A original text).
• The technical examples turn fraud identification from "relying on experience" into "reproducible procedures": the three steps of cleaning, recomputation, and matching of bank statements are all deterministic operations, and their results can be recomputed and written into working papers — this is precisely the audit-side counterpart of the AIxCC "deterministic-tool determination" paradigm (see Chapter 5 of this group's README).
• No. 18 focuses on identifying "financial statement fraud facilitated by third parties" (why professional skepticism is emphasized, common means, third-party characteristics, and how to identify and respond), jointly forming with No. 19 a combination of "human defense + technical defense".

Implications for Audit Harness design: the CICPA's four bottom lines can be translated directly into four mechanisms of Harness — data security maps to L6's out-of-domain interception and controlled deployment, professional skepticism maps to the mandatory instrumentation of L3's "lead → further procedures", working-paper audit trails map to L4's append-only trail, and information-technology audit maps to the ITGC and automated-control testing tools in L2's tool contract.

3.3 Intelligent Digital Forensics: Timesketch + Sec-Gemini and FACADE

3.3.1 Background

Forensic work in audit and investigation scenarios has long faced two bottlenecks: first, the large volume of log and event data makes manual timeline reconstruction time-consuming; second, anomalous behavior from insider threats lacks historical attack samples to learn from. Forensics requires that the "evidence chain be admissible" — hash verification, operational audit trails, and reproducible timelines — which naturally conflicts with AI's probabilistic outputs, making the forensics track the best touchstone for testing whether "AI capability ↔ forensic compliance" can coexist.

3.3.2 Approach

• Timesketch + Sec-Gemini (forensic collaboration): Google extended its open-source collaborative digital forensics platform Timesketch with agentic capabilities, driven by Sec-Gemini, using AI to automatically perform initial forensic investigations, significantly shortening investigation time and letting analysts focus on other tasks; this capability was demonstrated at Black Hat USA 2025 (Google official, Grade A). The key division of labor is: AI performs the initial investigation (preliminary timeline sorting, event clustering), and analysts perform verification and conclusions — the ultimate person accountable for the forensic report remains human.
• FACADE (insider-threat detection): an insider-threat detection system Google has used since 2018 to protect its internal systems, employing contrastive learning, processing billions of security events per day, and identifying insider threats without historical attack data (Google official, Grade A). Its methodological value lies in bypassing the supervised-learning premise of "requiring historical attack samples", using "deviation from the normal-behavior profile" as the detection signal.
• Evidence-management mechanism: the common feature of the two systems is that AI produces candidates and preliminary sorting while humans confirm; all evidence entering the formal report still requires fixed hashes and sources to ensure the integrity of the chain of custody.

3.3.3 Results

• Investigation time is significantly shortened, freeing analysts from initial forensic investigations (per Google's official statements; the specific multiplier was not disclosed).
• FACADE has run in an unsupervised manner for years, validating the feasibility of the "full-population + unsupervised + permanent" form of continuous monitoring at extremely large scale.
• This is consistent with the cross-cutting conclusion of Chapter 5 of this group's README: AI produces candidates and preliminary sorting, while deterministic tools and humans are responsible for determination and fixation — the admissibility of the forensics track is not weakened by AI, because the determination step is never handed to probability.

Implications for Audit Harness design: the forensics scenario provides an engineering template showing that "AI participation does not affect the validity of evidence" — as long as AI's output stays at the "candidate and preliminary sorting" layer and the final evidence undergoes hash fixation and human confirmation, the admissibility of the evidence chain is unaffected. The forensics module of the audit track should be layered accordingly: AI does preliminary timeline sorting and anomaly clustering, and humans do evidence fixation and conclusion signing.

4. Practice Standards

4.1 AGENTS.md Specification

The following is the recommended full AGENTS.md for the Audit track. This document is a recommendation; there is no official industry standard. It can be copied directly and adapted to the organization's actual circumstances. This document inherits all the bottom-line clauses of the group-level AGENTS.md (AGENTS.md); the following is the tightened SOP for audit scenarios.

# AGENTS.md —— Audit 审计

> 本文为建议稿，业界无官方标准。引用准则与监管文件为真实文本，落地方式为工程建议。
> 本文件继承组级 AGENTS.md 全部底线条款（证据链五元组、职责分离、人在回路、数据分级、
> 审计留痕、禁止事项），以下仅列审计方向的加严项。

## 角色与边界
- 角色：底稿整理者、数据分析者、异常线索生成者、控制测试执行辅助者、取证初排者。
- 不是：审计意见出具人、审计报告签署人、重要性水平确定者、审计结论决定者。
- 关键角色（三身份分离，继承组级并加严）：
  - 生成者：执行数据抽取、清洗、重算、比对、异常评分。
  - 复核者（项目复核人）：对 AI 线索的采纳与否作出专业判断并记录理由。
  - 底稿保管人：管理 append-only 底稿库与证据链哈希，不参与生成与复核。
- 边界判定：凡准则要求注册会计师亲自判断的事项（重要性、意见类型、错报定性），
  智能体只提供材料，不提供结论。

## 环境假设
- 存在审计工作台（底稿系统）与 GRC 平台，支持底稿编制、复核流转与版本管理。
- 存在 CAAT 数据分析环境，可对账套、序时账、银行流水执行采集、清洗、重算与比对。
- 存在企业信息官方核验渠道（如国家企业信用信息公示系统等官方平台），用于核实
  AI 提供的信息（对应中注协 2026-03-05 提示"通过官方平台获取的信息数据进行核实"）。
- 存在 append-only 底稿存储；智能体对底稿仅有追加权限，无修改与删除权限。
- 客户数据在受控环境内处理；公共模型平台仅接收脱敏后的非涉密任务数据。

## 上下文加载顺序（Context Budget）
1. 任务契约（审计阶段、科目范围、重要性参考、允许工具、确认点）。
2. 现行有效审计准则与问题解答（必须带文号与施行日期；含《审计准则第 1131 号》、
   问题解答第 18 号、第 19 号、中注协 2026-03-05 风险防范提示要点）。
3. 内部审计手册与历史底稿（同科目、同行业的既往程序与结论）。
4. 本次任务原始材料（账套、序时账、银行流水、控制测试清单、日志）。
5. 补充资料（预算不足时最先裁剪）。
硬约束：准则内容一律取自准则库检索，不得取自模型记忆；每条被引用准则携带
`现行有效 / 已修订 / 历史版本` 标记。

## 工具契约
| 工具 | 风险等级 | 说明 |
|---|---|---|
| 准则与问题解答检索 | R0 | 只读，必须返回文号与施行日期 |
| 企业信息官方核验 | R0 | 只读，用于核实 AI 提供的企业与对手方信息 |
| 账套与流水读取 | R0/R2 | 按数据分级；涉密账套仅在受控环境处理 |
| 数据清洗与余额重算 | R1 | 输出可复算的中间结果，写入手稿区 |
| 异常线索评分 | R1 | 输出候选清单，标注评分依据 |
| 底稿写入（手稿区） | R1 | 可追加、可回滚；正式底稿由复核人确认后固化 |
| 底稿定稿与归档 | R2 | 复核人确认后写入 append-only 存储 |
| 审计意见与报告签署 | R3 | **永久关闭**；由签字注册会计师完成 |

## 任务执行流程（SOP）
1. 任务登记：审计阶段、科目、数据范围、数据分级、复核人。
2. 语料装载：准则库版本快照 + 历史底稿 + 本次数据，记录哈希。
3. 程序设计：按风险评估结果匹配程序清单（对应问题解答第 19 号的
   资金分析 / 行为分析 / 对手方分析 / 关联方分析四类程序模板）。
4. 数据执行：清洗、重算、匹配、比对——全部使用确定性工具，中间结果可复算。
5. AI 线索生成：对全量数据生成异常候选清单，逐条附评分依据与指向的原始记录。
6. **进一步审计程序插桩（强制环节）**：每条 AI 线索必须绑定至少一项进一步审计
   程序方可进入底稿；未确认的线索标注"待确认"，不得作为审计证据引用
   （对应中注协"采取进一步审计程序确认是否存在重大错报风险"）。
7. 证据一致性检查：AI 证据与其他来源证据不一致时，自动生成"职业怀疑提示单"，
   列明冲突点与建议追加程序。
8. 人工复核：复核人逐条作出"采纳 / 不采纳 / 追加程序"决定，并记录理由。
9. 归档：底稿固化，绑定五元组证据链与链哈希，支持监管调阅导出。

## 验证与证据要求
- 每条 AI 线索的底稿记录必须包含：线索内容、生成依据（数据版本 + 程序模板版本 +
  模型与提示词版本）、进一步审计程序及结果、复核人分析与采纳记录——
  对应 1131 号准则"充分、适当地记录……以及对结果的分析与采纳过程"。
- 余额重算、账实匹配等程序必须输出可复算的中间结果；复核人可一键重放。
- 证据不一致情形必须留痕（职业怀疑提示单编号 + 冲突说明 + 处置决定）。
- 智能体不得在底稿中出现"AI 认为存在重大错报"类定性表述；只能出现
  "工具标记异常 X 项，经程序 Y 确认/未确认"。

## 失败与升级策略
- 数据质量缺陷（流水缺失、账套不平）→ 停止分析，生成数据质量备忘录，转人工。
- AI 线索与人工判断冲突且无法由追加程序解决 → 转项目合伙人层面判断（L2 升级）。
- 发现利用技术权限实施隐蔽性舞弊的迹象（如超级账户异常操作、变更日志缺失）→
  立即冻结现场快照，上报项目合伙人与信息安全负责人（L3 升级）。
- 官方核验渠道返回与 AI 提供信息不一致 → 以官方渠道为准，AI 信息作废并留痕。

## 安全与合规红线
- 未经客户授权或法律法规允许，涉密信息不得出域，不得进入公共 AI 平台
  （中注协 2026-03-05 提示原文要求）。
- 处理客户数据前，确认技术环境、数据流转和访问权限处于安全和严格受控状态。
- 遵守《人工智能生成合成内容标识办法》（2025-09-01 施行）：生成内容保留显式标识
  （第 6 条）与元数据隐式标识（第 7 条）；不得恶意删除、篡改、伪造、隐匿标识（第 10 条）。
- 遵守《中华人民共和国网络安全法》新增第二十条（2026-01-01 施行）关于全生命周期
  风险监测评估的要求；信息系统控制审计同时满足 GB/T 45654—2025 对模型安全
  （安全审计与漏洞修复、训练与推理环境隔离）的参照要求。
- 底稿与证据链留存期按审计准则与事务所制度取较长者。

## 禁止事项
1. 禁止以 AI 线索替代进一步审计程序。
2. 禁止在未记录"分析与采纳过程"的情况下将 AI 输出写入正式底稿。
3. 禁止修改或删除已固化底稿；发现底稿错误走"补充底稿"程序。
4. 禁止由智能体出具或暗示审计意见类型（无保留 / 保留 / 否定 / 无法表示意见）。
5. 禁止把模型记忆中的准则条文写入底稿。
6. 禁止跨项目复用未脱敏的客户数据作为其他项目语料。
7. 禁止隐瞒 AI 参与底稿编制的事实；参与程度必须可从底稿还原。
8. 禁止在证据链五元组不完整时执行归档。

## 输出格式
- 异常线索清单：编号、科目、线索描述、原始记录指针、评分与依据、确认状态
  （待确认 / 已确认 / 已排除）、绑定程序编号。
- 控制测试辅助结果：控制项、测试步骤、样本或全量范围、结果、偏差说明。
- 取证初排：时间线（事件、来源、哈希）、异常聚类、待人工确认项。
- 每份输出附带：数据版本哈希、程序模板版本、模型与提示词版本、复核状态。

## 评估与自检
- 回归集：历史项目 + 已确认错报（Golden Dataset）。
- 核心指标：线索精确率（AI 标记异常中被确认为重大错报的比例）、
  线索召回率（已知重大错报中被 AI 捕获的比例）、底稿完整性（五元组齐备率）。
- 自检：禁止事项逐条对照；输出格式逐段对照；证据链五元组逐项对照；
  每条正式底稿可定位到复核人及其采纳理由。

4.2 SKILL.md Specification

The following is the recommended full SKILL.md for the Audit track. This document is a recommendation; there is no official industry standard. This skill is engineered from the funds-analysis technical example in CICPA's Audit Standards Q&A No. 19.

---
name: audit-bank-statement-reconciliation
description: 银行流水全量核对与账实匹配。对各种格式的银行流水原始文件做自动清洗合并、余额重算与序时账一一匹配，输出异常资金交易候选清单。适用于财务报表审计的资金分析程序与舞弊风险识别场景。
version: 1.0
created: 2026-09-12
---

# 银行流水全量核对与账实匹配

## 适用场景
- 适用：年报审计与专项审计中的资金分析程序；识别银行流水缺失或不连续；
  识别"账有流水无"与"流水有账无"的异常资金交易；对手方与关联方资金往来筛查。
- 不适用：出具审计结论；对异常交易定性；替代函证与监盘等准则程序。

## 前置条件
- 已获取被审计单位各账户的银行流水原始文件与财务序时账导出数据。
- CAAT 数据分析环境可用，支持 OCR、格式归一化、余额重算与批量匹配。
- 数据在受控环境内处理；涉密账套未出域。
- 复核人已指定；程序模板（问题解答第 19 号资金分析类）已加载。

## 输入
| 输入项 | 必填 | 说明 |
|---|---|---|
| 银行流水原始文件 | 是 | 覆盖审计期间全部账户，格式可为 PDF / Excel / CSV |
| 财务序时账 | 是 | 与流水同一审计期间，含科目与对方科目 |
| 客户与供应商清单 | 是 | 用于对手方筛查 |
| 关联方清单 | 是 | 实控人、控股股东、董监高及其控制企业 |
| 审计期间 | 是 | 流水与账套期间必须一致 |
| 数据分级 | 是 | 涉密数据仅限受控环境 |

## 输出
| 输出项 | 说明 |
|---|---|
| 清洗日志 | 各文件格式、页数、解析成功/失败记录、失败原因 |
| 余额重算表 | 每笔交易后余额（重算值）与原始余额的比对，差异标记 |
| 流水完整性检查 | 缺失期间、断号、重复交易清单 |
| 账实匹配结果 | 一一匹配成功项、仅账有项、仅流水有项 |
| 异常候选清单 | 异常类型、金额、日期、对手方、原始记录指针、评分与依据 |
| 留痕信息 | 数据版本哈希、程序模板版本、模型与提示词版本、复核状态 |

## 执行步骤
1. 校验审计期间一致性与文件清单完整性；缺失文件直接列入异常候选。
2. OCR 与格式归一化：将各格式流水转为统一结构，保留原文页码/行号指针。
3. 逐笔重算交易后余额，与原始余额比对；输出差异项（对应"识别银行流水
   缺失/不连续"）。
4. 银行流水与财务序时账按日期、金额、对手方做一一匹配；输出三类结果
   （匹配成功 / 账有流水无 / 流水有账无）。
5. 异常筛查（按程序模板）：交易规模与购销规模明显不匹配的对手方；第三方
   销售回款；与关联方的资金往来；非工作日频繁或大额交易；某月/某日/某时段
   交易量突增突减。
6. 生成异常候选清单，逐条附原始记录指针与评分依据；不得给定性结论。
7. 自校验：清洗成功率、重算差异覆盖率、匹配三类结果齐备、候选清单字段完整。
8. 交付复核人执行进一步审计程序；每条线索绑定程序与结论后进入底稿。

## 质量标准（DoD）
- 一票否决：使用未覆盖审计期间的数据；清洗失败的文件被静默跳过；
  候选清单中出现"疑似舞弊"等定性表述；未绑定进一步审计程序即写入正式底稿。
- 余额重算覆盖率 100%（审计期间内全部流水逐笔重算）。
- 匹配结果三类齐备，"账有流水无""流水有账无"两项不得为空（可为零，须显式声明）。
- 每条候选可回溯到原始记录指针（文件名 + 页码/行号）。
- 清洗日志与失败记录 100% 保留。

## 常见失败与处理
| 失败模式 | 表现 | 处置 |
|---|---|---|
| OCR 识别错误 | 金额或日期错位导致虚假差异 | 抽样回验原文；错误率超阈值时转人工处理该文件 |
| 流水覆盖不全 | 账户清单与实际获取文件不符 | 列入异常候选并升级，不得默认按已获取数据分析 |
| 跨账户转账重复计入 | 关联账户互转被当作外部交易 | 依据账户清单去重；去重规则写入留痕 |
| 序时账口径不一致 | 账套科目与流水对手方无法对应 | 生成映射缺口清单，转人工补录，不得推测匹配 |
| 时段异常误报 | 正常业务季节性被标记 | 保留标记但降级，注明"待业务确认"；不得静默删除 |

## 示例
输入：
- 某公司 2025 年 1—12 月 6 个银行账户流水（PDF / Excel 混合格式）
- 同期序时账导出（CSV）
- 关联方清单：实控人 1 人、控股企业 3 家、董监高 5 人

输出（节选）：
| 候选编号 | 异常类型 | 日期 | 金额（¥） | 指针 | 评分依据 | 确认状态 |
|---|---|---|---|---|---|---|
| C-014 | 流水有账无 | 2025-03-17 | [待填写] | 流水文件 B 第 42 页第 7 行 | 非工作日大额支出 | 待确认 |
| C-021 | 关联方往来 | 2025-06-30 | [待填写] | 流水文件 A 第 118 页第 3 行 | 实控人控制企业转入 | 待确认 |
| C-035 | 账有流水无 | 2025-09-12 | [待填写] | 序时账第 2,031 行 | 银行付款无对应流水 | 待确认 |

> 说明：金额等实际值必须以分析结果填充，示例中统一使用 [待填写] 占位。
> 每条候选交付时必须绑定进一步审计程序编号；未经确认不得作为审计证据。

4.3 Landing Checklist

5. Conclusion

The AI Harness for the audit track is, in essence, a system that engineers "non-transferable responsibility" into an evidence-chain mechanism.

Three conclusions:

First, the responsibility anchor is the first principle of the entire design. The CICPA 2026-03-05 notice's "cannot replace the CPA's professional judgement, nor does it reduce the CPA's responsibility for the audit opinion" echoes the IESBA's "professional accountants remain responsible for their judgement and decisions" across Chinese and international contexts. This statement is not a disclaimer but an architectural directive: it means every design decision of Harness must answer "on what basis and with what materials does the CPA bear this responsibility". The answer is the five-element evidence chain — input snapshot, tool-call log, output, human-confirmation record, and hash. If any part is missing, the responsibility is left hanging.

Second, leads and evidence must be strictly layered. The CICPA requires that for anomalies identified by AI, "further audit procedures be taken to confirm whether there is a risk of material misstatement", and Q&A No. 19 provides the concrete engineering form of the further procedures (cleaning, recomputation, matching, and screening, all deterministic and recomputable). The combination of the two is the audit version of the "AIxCC paradigm": the model proposes candidates across the full population, while deterministic procedures and humans are responsible for determination. The improvement in identification rates comes from "the orchestration layer learning when to call which deterministic tool", not from a smarter model.

Third, the intended reader of the working papers is the external reviewer. The L4 of Audit Harness must be built to "regulatory inspection" standards: append-only, chain hashing, and searchable across four dimensions — task, time, personnel, and basis version. At the same time, as a meta-auditor, the audit track's own system logs, permissions, and governance status are the first object examined when it issues internal-audit findings on the AI systems of the other four tracks — the audit AI must first pass its own audit.

Limitations that must be faced squarely: the industry-transformation data cited in this track (the internal-audit technology-adoption survey, the Deloitte survey as relayed, and the RSM industry analysis) are Grade B relays or were not obtained as primary reports; no primary source was obtained for quantified adoption cases of continuous auditing and forensics on the China side. Efficiency figures are inherently secondary to compliance effectiveness in the audit track — any "efficiency" claim, in the absence of a regression set of confirmed misstatements, cannot be verified as not coming at the cost of missed reports.

Information-Gap Statement

The following items could not be verified against A/B-grade primary evidence; the text has been handled per the "no fabrication" principle, and further evidentiary work is required before use:

1. Deloitte 2025 internal-audit survey's original report — figures such as "84% of internal auditors said AI skills are important when recruiting" and "over 45% said AI-tool training has the greatest impact" are relayed; the original report was not obtained.
2. The exact wording of Standard 10.3 of the IIA Global Internal Audit Standards — only a Grade B relay was obtained; the exact sentence-level citation of the standard text was not obtained.
3. Quantified adoption cases and indicators of continuous auditing and continuous monitoring on the China side — no A/B-grade primary source was obtained; public quantitative effect data on Chinese accounting firms' AI applications was also not obtained.
4. The official full-text link of China Standards on Auditing (Q&A) No. 19 — the full-text link in the report points to a third-party mirror site (docs.maoyanqing.com); the official-channel link is [To be filled]; where this document cites its key points, the CICPA official announcement page (cicpa.org.cn) is used as the reference.
5. The share and breakdown data of the China sample in the international survey on technology adoption in internal audit (Eulerich et al., 2025) — breakdown data was not obtained.
6. Industry baseline values for "lead precision / recall" — the audit profession has no public AI anomaly-identification baseline; the indicators in this document are defined as engineering recommendations, and the baseline values are [To be filled].

6. References

1. CICPA Notice on the Risk Prevention of Using AI Technology by Accounting Firms in the 2025 Annual Report Audit — Chinese Institute of Certified Public Accountants, 2026-03-05. https://cicpa.org.cn/xxfb/news/202603/t20260305_65842.html
2. Notice of the Chinese Institute of Certified Public Accountants on Doing Well the 2025 Annual Report Audit of Listed Companies — Chinese Institute of Certified Public Accountants, 2026-01. http://n.bicpa.org.cn/u/cms/www/202601/04161209co7c.pdf
3. CICPA issues Audit Standards Q&A No. 18 and No. 19 — Chinese Institute of Certified Public Accountants, published and effective 2025-01-07. https://cicpa.org.cn/xxfb/news/202501/t20250123_65229.html
4. IAASB publishes global roundtable feedback summary on technology and quality management (over 240 stakeholders from six continents) — IAASB, 2026-02. https://www.iaasb.org/news-events/2026-02/iaasb-publishes-global-roundtable-feedback-technology-and-quality-management
5. IAASB list of standards and issued documents (including the ISA 330 / 500 / 520 revision proposals and the Technology Position Catalog v2) — IAASB. https://www.iaasb.org/?page=35
6. Global Internal Audit Standards and AI audit tools (AI Prompting for Internal Auditors, AI Governance questionnaires, etc.) — The Institute of Internal Auditors, 2024—2026. https://www.theiia.org/en/standards/documents/?category=audit+tools
7. Evolving Role of Internal Audit (continuous auditing and continuous KRI monitoring) — RSM US. https://rsmus.com/insights/services/risk-fraud-cybersecurity/evolving-role-of-internal-audit.html
8. Cybersecurity updates: Summer 2025 (Timesketch + Sec-Gemini, FACADE, Big Sleep) — Google, 2025. https://blog.google/technology/safety-security/cybersecurity-updates-summer-2025/
9. International survey on technology adoption in internal audit — Eulerich, Eulerich & Bonrath, Maandblad voor Accountancy en Bedrijfseconomie 99(4), 2025, pp.181–193. https://mab-online.nl/article/153598/download/pdf/1412064
10. Decision to Amend the Cybersecurity Law of the People's Republic of China (Presidential Order No. 61), adding Article 20 — National People's Congress, 2025. http://www.npc.gov.cn/c2/c30834/202601/t20260105_450980.html
11. Interpretation of GB/T 45654—2025 Cybersecurity Technology — Basic Safety Requirements for Generative AI Services — National Cybersecurity Standardization Technical Committee (SAC/TC260). https://www.tc260.org.cn/tc260/hygd1/202403/b429d868525e48c3b7d12a0ec8f82e5e.shtml
12. Notice on the Issuance of the Measures for the Labeling of AI-Generated and Synthetic Content (Guoxinban Tongzi [2025] No. 2) — Cyberspace Administration of China and three other departments, 2025. https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm