Answers · bookkeeping
How can a CPA audit what an AI agent did in the books?
Last updated
TL;DR: Start by finding out how the agent gets into the books, because the accounting software may not say 'agent' anywhere. In QuickBooks Online, changes sent by a connected third-party app show in the audit log as System Administration, the same profile QuickBooks uses for its own automatic changes, and an agent working through a person's login looks like that person. In Xero, each change is recorded under a user name, and System Generated covers only a few automatic cases. So list each agent, the login or app connection it uses and what it can change; pull the audit log or History and notes for the period; match the agent's own run log to those entries in both directions; and test agent-made entries back to source documents and approvals, and source documents forward into the books. Treat the agent's log as information produced by the client: how much you can rely on it depends on whether anyone, the agent included, could have edited it.
What should I check, step by step?
1. Get a list of every AI agent or automation that can read or write the books: the product, the QuickBooks or Xero user or app connection it uses, what it can create, edit, delete or pay, and who set it up and controls its instructions.
- QuickBooks Online: review the connected apps and ask who connected each one and what it writes. Intuit's developer help says only master or company admin users can connect an app.
- Pull the QuickBooks Online audit log for the period (Settings > Audit log, admin access). It can't be turned off and events are available for two years, so export it each year. Filter by the agent's own user, if it has one, and by System Administration.
- Xero: run the History and notes report for the period and read the history on the bills, invoices and bank transactions the agent touched. Each entry has the user and the date and time.
- Ask for the agent's own run log: run id, time, tool called, the id of the record it created or changed, amount, payee and who approved. Match those ids to the audit log both ways. Entries in the books with no matching run, and runs with no matching entry, are your exceptions.
- Vouch a sample of agent-made entries to source documents (vendor invoice, receipt, bank line) and to the approval. Trace a sample of source documents forward into the books to test completeness.
- Check that the agent can't approve its own work or edit its own log: whether its access lets it approve bills, release payments or change vendor bank details, who can change the log, and whether copies or hashes of the log are held outside the client.
- Check changes over time: when the agent's permissions, prompts or rules changed and who changed them, and whether closed periods were locked before it ran.
Why the audit log may not name the agent
Intuit's help says that when a connected third-party app sends data to QuickBooks or changes existing data, the audit log shows a System Administration event. QuickBooks also uses System Administration for its own automatic changes, such as recurring transactions, bank-feed updates and knock-on edits to linked records, so the log alone won't separate an agent's work from QuickBooks' own.
- If the agent signs in with a person's login or drives a browser session, its changes are recorded under that person. Ask the client to give each agent its own user or app connection so its work can be filtered.
- Xero records the name of the user and the time for every change to a transaction. Its help lists only four System Generated cases (online invoices saved as bills, repeating invoices, bills from the Xero to Xero network and bills from Xero Expenses), so other entries carry a user name: find out which one the agent works under. Notes added to a transaction's history can't be edited or deleted.
Treat the agent's log as client-produced evidence
PCAOB AS 1105, the audit evidence standard for public-company audits, says that when using information produced by the company, the auditor should test its accuracy and completeness, or test the controls over it, including IT general controls and automated application controls where applicable. Amendments effective for audits of fiscal years beginning on or after December 15, 2025 add requirements for external information the company provides in electronic form.
- AS 1105 also says evidence from a knowledgeable source independent of the company is generally more reliable than evidence from internal sources only. An agent log on the client's own server, which the client or the agent could rewrite, is internal. A log whose entries were sealed or timestamped by an outside party as they happened is easier to rely on, because a later edit would show.
What a usable trail for an AI agent looks like
One record per action with the run id, the agent and its version, the tool, the record it created or changed in the books, the amount and payee, and the approval it relied on.
- Approvals made by someone other than the agent, with a timestamp, and bound to the exact amount and payee so a changed amount doesn't pass on the same approval.
- Hashes of the log committed outside the client on a schedule, so you can check that the excerpt you were given hasn't changed since.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Check the approval behind this agent-paid bill and whether the vendor, bill, amount and currency in the books match what was approved.”
{
"tool": "verify_human_approval",
"arguments": {
"receipt": "<decision receipt the client gave you>",
"signature": "<the receipt's signature>",
"action": {
"type": "pay_bill",
"vendor_ref": "V-1042",
"bill_ref": "BILL-2219",
"amount_minor": 184000,
"currency": "USD"
}
}
}- Free, no key. With {id} alone it returns the approval request and decision receipts. With the receipt, its signature and the action details, it also says whether those details hash to what was approved (action_matches). The details must be given exactly as the agent submitted them.
- verify_ai_run (free) checks a signed receipt of a model run and, given the prompt or output text, whether it matches the recorded hashes. verify_recorder (free) checks that a disclosed run of an agent's hash-chained log ends at a head committed earlier, and says when.
- GET /v1/mirror-entries/{id} (free, no account) returns a bookkeeping entry sealed on Rightshold's mirror ledger as it was sealed, its hash-chain check and its anchor status.
Rightshold doesn't connect to QuickBooks or Xero, read the books or perform audit procedures. It verifies records that agents and owners created through Rightshold, and only for agents that used it. An approval decision shows that the account's owner key decided, not which person used it. Not audit, legal, tax or accounting advice.
What are the sources?
- QuickBooks Online: Use the audit log (System Administration events for third-party apps, two years)
- Intuit Developer: Which users can subscribe to QuickBooks Online apps?
- Xero Central: View history and add notes to transactions
- PCAOB AS 1105: Audit Evidence
- PCAOB: Amendments related to technology-assisted analysis (effective for fiscal years beginning on or after December 15, 2025)
Related
- How to prove small business books weren't edited after the fact
- How to keep segregation of duties when an AI agent pays bills
- How to audit which human authorized an AI agent action
- How to log every AI agent tool call for audit
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'