How to Validate AI Output Before It Goes in the Engagement File

Staff at most CPA firms already use AI to pull data from K-1s, summarize leases and draft memos. When a reviewer, peer reviewer or IRS examiner looks at that work, the question is what a person did to confirm the output before it went in the file. AI output validation is that step, and this guide shows how to run it and document it.

What is AI output validation on an engagement?

AI output validation means checking every number, fact, citation and conclusion the tool produced against a source outside the tool, then recording who checked it, how and when. Until that happens, the output is an unverified draft, and it does not belong in the engagement file as support for anything.

The reason is how generative AI fails. NIST's Generative AI Profile, NIST AI 600-1, defines confabulation as "the production of confidently stated but erroneous or false content." The same document notes that large language models "sometimes provide logical steps for how they arrived at an answer even when the answer itself is incorrect." A clean, well-reasoned explanation is not evidence that the answer is right. A reviewer who reads the AI's reasoning and finds it persuasive has checked the writing, not the work.

Which professional standards apply to AI output in the file?

No standard carves out an exception for AI. The firm and the engagement partner stay responsible for the work, and the existing standards on quality management, supervision and due diligence apply to AI-assisted work the same way they apply to work done by staff.

• Audit and attest work. On October 13, 2026, the AICPA released the practice aid Artificial Intelligence (AI) Considerations for Financial Statement Auditors. Its second section covers how audit firms use AI tools on engagements, including firm quality management policies, engagement team competence, planning for AI use, and partner responsibility for approving and supervising AI tools. As AICPA chief auditor Jennifer Burns put it in the release, "Ultimately, the auditor remains responsible for the audit and the audit opinion."
• Quality management. SQMS No. 1 includes a quality objective that appropriate technological resources are obtained or developed, implemented, maintained and used to support the system of quality management and the performance of engagements. Firms had to design and implement their systems by December 15, 2025, and the first evaluation is due within one year, by December 15, 2026. A documented validation step for AI output is the kind of response that evaluation can test.
• Tax work. Circular 230 section 10.22(a) requires due diligence in preparing returns and in determining the correctness of representations to clients and to Treasury. Section 10.22(b) presumes diligence when a practitioner relies on "the work product of another person" and used reasonable care in engaging, supervising, training and evaluating that person. The rule does not mention AI tools. Section 10.37(a)(2)(v) adds that written advice must relate applicable law and authorities to facts. The revised AICPA Statements on Standards for Tax Services, effective January 1, 2024, also address when members may reasonably rely on tools used in tax services.
• Client data you extract. Section 10.34(d) lets a practitioner rely in good faith on information furnished by the client, but requires reasonable inquiry when that information appears incorrect, inconsistent or incomplete. When an AI tool reads a client's documents and produces a data table, the table is the tool's reading of what the client furnished. Checking it against the original documents is how you know the two match.

Which checks fit which kind of AI output?

The right check depends on what the tool produced. Match the test to the output type, and never ask the same tool to confirm its own answer.

• Extracted data (W-2s, K-1s, 1099s, bank statements, invoices): agree key fields to the source document, compare the number of documents in with the number of records out, and tie totals to a control figure such as a statement ending balance.
• Calculations and analytics: recompute the result independently in the tax software, a spreadsheet or the trial balance. Confirm the tool used the right period, entity and inputs.
• Summaries of contracts, leases, minutes or loan agreements: read the source sections that drive the accounting or tax conclusion. Look for omissions as well as errors, since a summary can be accurate and still leave out the covenant or term that matters.
• Research and citations: open every authority at its primary source, confirm it exists and says what the output claims, and cite the source rather than the AI answer. Our guide to using AI for tax research and documenting the sources covers this in more detail.
• Drafted narrative (memos, workpaper descriptions, client letters): trace each factual statement to evidence already in the file. Delete anything you cannot trace.

How do you validate AI output step by step?

Use the same short routine every time, so reviewers can see at a glance that it happened. Eight steps cover most engagement work.

1. Confirm the tool is approved for this task and that the data you used is allowed in it. The AICPA Code's rule on disclosing information to a third-party service provider, ET 1.700.040, applies before any client data goes in.
2. Save the input files, the prompt and the output, with the date and the tool name.
3. List every claim in the output that matters: amounts, dates, names, classifications, conclusions and citations.
4. Trace each claim to a source document or authority outside the tool.
5. Recompute key figures independently.
6. Test for gaps: compare document counts, scan for skipped pages or periods, and check that exceptions were flagged.
7. Correct the output and note what you changed and why.
8. Sign off: preparer name and date, reviewer name and date, and the extent of the review.

What should the engagement file show when AI was used?

The file should let a reviewer, peer reviewer or examiner see what the tool did and what a person did to confirm it. A one-line note that "AI was used" does not do that.

At a minimum, record the tool and the step it performed, the source documents it worked from, the checks performed and their results, any errors found and how they were resolved, and who reviewed the work and when. Keep the original output alongside the corrected version when the differences matter to the conclusion. If the firm also uses AI to help review workpapers, see how to use AI to review engagement workpapers safely.

If the firm uses Microsoft 365 Copilot or other AI apps covered by Microsoft Purview, retention policies for Copilot and AI apps can keep prompts and responses under the firm's retention rules, so the record does not depend on a staff member saving a chat.

How much checking is enough?

Scale the checking to how much the conclusion depends on the output. Amounts that go onto a return or into financial statements, and anything that supports a significant judgment, warrant a full tie-out. Lower-risk uses, such as a first-pass summary a senior will rewrite, can use targeted checks.

Track what reviewers find. If validation keeps turning up errors in one task, tighten the checks or stop using the tool for that task. If errors are rare, the record of clean reviews supports the firm's SQMS No. 1 monitoring and AI documentation. Either way, the decision rests on evidence rather than on how confident the output sounds.

What to do this quarter

Busy season leaves little room to design a process, so set the routine now.

• Write the eight-step validation routine into your engagement procedures and workpaper templates, with a sign-off field for AI-assisted work.
• Map each approved AI tool to the tasks it may perform and the checks each task requires.
• Train preparers and reviewers on output types and matching checks, using one real example per service line. Our AI training guide for accountants covers how to keep staff from over-relying on AI.
• Turn on retention for AI prompts and responses where your platform supports it.
• Add AI validation to the evidence you gather for the December 15, 2026 SQMS No. 1 evaluation and later monitoring.

How s90 helps

s90 sets up the technology side of this for CPA firms in Los Angeles and Orange County: approved AI tools inside your Microsoft 365 tenant, data loss prevention that keeps client files out of unapproved tools, and retention and audit logging so the evidence of review is there when a peer reviewer asks. If you want a second look at how your AI tools fit your engagement workflow, we are happy to talk it through.