Can an AI write an audit report: what it can draft, and what it cannot sign

The question is asked as one question and is really three, and most arguments about it fail because each side is answering a different one.

Can it draft the document — the scope, the method, the findings by process, the executive summary, in the shape a reader expects? Yes, within a boundary that this piece will draw precisely: from evidence supplied, against a findings log that was itself written by someone who did the fieldwork.

Can it form the audit opinion — the judgement that this management system conforms, or does not, against the criteria? No. An opinion is a person’s, and the person who holds it is the person who can be asked to defend it.

Can it sign — issue the report as a conclusion, or issue a certificate? No, and not for a reason that better software would change. A certificate is an accredited certification body’s act, and the signature on a report is an accountable person’s.

Those three answers are not a compromise between the optimistic and the sceptical positions. They are what the work actually divides into, and the division is old: audits have always separated the person who gathers evidence from the person who writes it up, and have never allowed either to be replaced by the other’s paperwork.

What a report has to contain

ISO 19011:2018, at clause 6.5, sets out what an audit report should contain: the audit objectives; the scope, identifying the units or processes audited and the period covered; the client, the audit team and the auditee’s participants; the dates and locations where the audit activities were conducted; the audit criteria; the audit findings and the evidence behind them; and the audit conclusions.

That list has a property worth noticing, because it decides what can be drafted. Every item on it is either a fact already recorded elsewhere or a judgement built on facts already recorded. The objectives and criteria come from the audit plan. The dates, locations and participants come from the schedule and the attendance record. The scope comes from the plan. The findings and their evidence come from the log. The conclusions come from the findings.

A report is therefore not a document that creates anything. It is an assembly of things that already exist, arranged for a reader who needs to reach a judgement quickly, and its quality is bounded above by the quality of what it assembles. That is the whole basis of the drafting case, and it is also the whole limitation.

What drafting from evidence means

The distinction that matters in practice is between a drafter that writes from evidence and one that writes about a subject. Given a log with six entries, the process names they attach to, the criteria cited and the dates, a report can be produced section by section, and every sentence in it can be traced back to a line in the log. Given a description of an organisation and a standard, the same tool will produce fluent paragraphs about internal auditing that are worth nothing, because nothing in them is evidence. The log is the instrument in the middle, written entry by entry to a form that can be answered — the form set out in the piece on audit findings — and the report can be no better than those entries are answerable.

Table 1. The sections of an audit report, where each one’s content comes from, and what a drafter may and may not add. Source: ISO 19011:2018 clause 6.5 for the contents; the division of labour is the office’s method.

The right-hand column is the boundary, and it is not a list of things the tool is too weak to do. It is a list of things no drafter may do, human or otherwise, because doing them would make the report a source of evidence rather than a summary of it. A report that contains a finding the log does not is an audit that happened in a document.

The opinion is not a drafting task

The audit conclusion is the part of the report that a reader will rely on, and it belongs to a person for a reason that is structural rather than sentimental.

Clause 9.2.2 requires auditors to be selected and audits conducted so that objectivity and impartiality are ensured, and nobody audits their own work. Those requirements attach to people: a named auditor can be checked for a reporting line to the process owner, can be asked how a judgement was reached, and can be wrong in a way that has consequences for them. An assembly has no reporting line, no history and nothing at stake, which is why it cannot be the object of an independence test — there is no relationship to be independent of.

The opinion is also the one sentence in the report that cannot be checked against a source. Everything else cites a log entry. The conclusion cites the auditor’s judgement over the whole body of evidence, including the evidence that was absent, the explanations that were unconvincing and the two entries that were nearly withdrawn. That reasoning is not in the document and cannot be; it is the part that the signer holds.

A drafter can help that judgement by putting the log in front of it in a useful order. It cannot make it, and a report that presents a generated conclusion as though it were the auditor’s is worse than no report, because it lends the appearance of a considered opinion to something nobody considered.

What a certificate is, and why the drafting question does not touch it

Certification is a third-party decision taken under ISO/IEC 17021-1. The initial audit runs in two stages: stage 1 reviews the documented system, the scope and readiness; stage 2 tests whether the system works as described. The certificate then runs for three years, kept valid by surveillance audits in years one and two and a recertification audit in year three, and it is issued only after a certification decision taken by personnel of the body who did not conduct the audit.

Two consequences for this piece. The first is that an internal audit report, however well drafted, is not an input the certification body is obliged to accept; it is evidence that the organisation audits itself, which the body examines as part of the system. The second is that no drafting capability touches the certificate at all, because the certificate is a decision by a body that did not write the report and is not accountable to the organisation that did.

Nothing here is accredited, nothing acts in a regulated capacity, and a role named for a standard is a job description rather than a qualification. The certificate is an accredited body’s to issue and the audit opinion is a person’s to sign, and an assembly that says otherwise is selling a document with a status it does not have.

Drafter, auditor and signer

The cleanest way to hold the boundary is to ask, of every sentence in a report, who is entitled to write it. Five sentences do most of the work.

Table 2. Five sentences, and who may write each. Source: the office’s method, read against ISO 9001:2015 clause 9.2 and the certification requirements described in ISO/IEC 17021-1.

The second and third rows are where a drafter’s output has to be treated differently from the rest of the document. A proposed conclusion is a draft for the signer to accept, amend or reject, and it should be marked as one until it is signed. The difference between “the drafter proposes” and “the auditor concludes” is a single act of reading, and it is the act that makes the report an audit.

The last row is the one people ask about most and it is the simplest: a certificate’s scope, dates and validity are the body’s record. No document produced inside the audited organisation can state them, and a draft that fills in a plausible expiry date is wrong in the only way that matters.

What the drafting costs

The rate is measured, not listed: $0.00700 a call for deepseek-v4-flash on Base under exact with a short prompt, read from the live 402 challenge on 31 October 2026 outside the service’s weekday peak windows of 01:00–04:00 and 06:00–10:00 UTC. The $0.00875 that circulates for this service is Qwen’s rate, and it appears here only as the figure that circulates.

Drafting a report from an illustrative log of twenty-four entries across six processes: two calls for the executive summary, one for scope, criteria and period, one for method and evidence base, six for the findings by process — one a process — two for the readiness conclusion, drafted twice so the signer has two readings to choose between, three for a consistency pass over the finished document, and four for the rewrite after the signer’s comments.

2 + 1 + 1 + 6 + 2 + 3 + 4 = 19 calls, and 19 × $0.00700 = $0.13300, which is $0.01900 for each of the seven sections and $0.00554 for each of the twenty-four entries the report has to carry.

Three bounds. At the circulated rate the same nineteen calls cost $0.16625, which is $0.03325, or 25 per cent, more. At the metered ceiling of $0.00955 — a long prompt under exact, or upto at max_tokens: 1000 — they cost $0.18145, which is $0.04845, or 36 per cent, more. The 0.50 USDC opening balance buys seventy-one calls at $0.00700, so the draft uses nineteen and leaves fifty-two, worth $0.36400.

Two things follow from the figure, and the second is the one that matters.

The first is that drafting a report is not where the money goes. Nineteen calls is a quarter of one opening balance and a fifth of the calls in the audit that produced the log; the log itself, the fieldwork and the signer’s reading are the work.

The second is that the price of the report is not the price of the opinion. Nineteen calls buy a document. The conclusion in it is one sentence, it is not for sale at any price, and if the person asked to sign it will not, the nineteen calls have produced an exhibit rather than a report.

Where the drafting stops

A draft is not a review, and the distance between them is where this piece stops making claims.

The draft inherits every error in the log. If an entry cites the wrong clause, groups two separate failures into one line, or states evidence that does not exist, the report will carry the error in better prose. The drafter has no way to test a log entry against the evidence behind it, because the evidence is a register in a room, not a string. This is not a defect that a larger model corrects; the information is not in the text.

The draft cannot see what was never written. A finding the auditor chose not to record, a process that was not sampled, an interview that did not happen — none of these appears in a document assembled from a log, and the report will read as complete because it is complete relative to its source. Coverage is the auditor’s claim to make and the signer’s to defend.

The draft will produce confident prose for thin evidence. That is the specific failure mode to guard against, and it is a property of drafting as such: the same register that summarises six well-evidenced entries summarises one badly evidenced entry with equal fluency. The only reliable guard is mechanical — every sentence that asserts a fact must resolve to a log entry, and where it does not, the sentence comes out.

And no accuracy figure is offered here, because none has been measured. This piece does not claim that drafting reduces error, that it is faster than a competent human report writer, or that the draft is likely to be right. It claims something narrower and checkable: that a report can be assembled from a log, that the assembly can be verified line by line against that log, and that the conclusion cannot be assembled at all.

The decision

Decide who signs before the first call is made, and write the name in the plan. That decision fixes everything downstream: the log has to be written to a standard a named person can defend, the drafter’s output is addressed to that person rather than to the auditee, and the report has one reader whose judgement it exists to inform.

Then make the signature real. The person signing reads the log, not only the report, and reads it before accepting the drafts of the conclusion rather than after. Where the report’s prose and the log disagree, the log wins and the prose is rewritten, because the log is the record and the report is a summary of it.

And state the arrangement in the report’s own method section, in a sentence the reader can check: this report was drafted from the findings log and reviewed and signed by the person named, who holds the opinion and answers for it. That sentence costs nothing, and it is the difference between a document that borrows the authority of an audit and one that has it.

Where this goes

• The pillar: x402.review/2026/10/31/quality-and-compliance/ — the job, the six artefacts and the certificate no agent issues
• The role: studio.x402.press/roles/iso_auditor — the agent, its parts and its running cost
• The service it buys: x402.press/services/deepseek/ — the canonical price, seven chains
• The review: x402.review/2026/10/31/deepseek-review/ — the measured handshake and what it does not promise

Method note

The price was read from the live 402 challenge on Base on 31 October 2026, outside DeepSeek’s weekday peak windows of 01:00–04:00 and 06:00–10:00 UTC; the catalogue figure of $0.00875 was checked against it, found to be Qwen’s rate, and is used here only where it is named as the figure that circulates. The nineteen calls are a planning assumption for a report over a twenty-four-entry log, stated section by section and repeated in the arithmetic; the log is the one described in the piece on grading a finding, and no real engagement is described. ISO 19011:2018 clause 6.5 is cited for the contents of an audit report, ISO 9001:2015 clause 9.2.2 for the selection of auditors and the reporting of results, and ISO/IEC 17021-1 is described in outline for the two-stage initial audit, the certification decision and the three-year cycle. No accuracy, speed or error-rate claim is made for drafting, because none has been measured; the boundary described — a draft from evidence supplied, an opinion and a signature that are not — is the limit of what is asserted here.

x402.review is written and edited by N.P. Vincent. The publication is connected to x402.press, which sells the services reviewed here; that interest is disclosed on every piece that touches a service, and it is stated here rather than left to inference.

Filed under Jobs