FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Auditors
AI document matching reads invoices, contracts and bank records and pairs them with audit samples, but the FRC expects the file to show the input data was complete and accurate. A wrong match accepted as valid evidence is still a gap in the audit.
Part of: AI in Auditors
In short
Document matching is one of the uses the FRC lists as common in practice. Tools combine optical character recognition with AI to extract dates, amounts and names, then match them to ledger items. That saves time but introduces new failure points: misread figures, matches made on partial data, and documents the client supplied that were never genuine. The FRC 2025 guidance expects the file to record why the tool was appropriate and how input completeness and accuracy were checked. If a mismatched or false document is accepted, a claim will ask what the team checked beyond the tool.
Vouching means checking that a recorded transaction is supported by evidence: an invoice, a contract, a bank statement line. AI tools speed this up by reading scanned or uploaded documents, extracting the key fields and matching them to the sample. The team then reviews exceptions. Some tools also flag documents that look altered, or duplicates submitted for different items.
The FRC lists document matching and arithmetic checks among the uses it sees in practice in its 2026 factsheet. These may be among the first AI tools smaller firms adopt, often as features within third-party audit software.
Under the FRC's June 2025 guidance, the audit file should record the tool's description and purpose, the tool and model version, why using it was appropriate (including checks on the completeness and accuracy of the input data), central approval and how outputs informed judgements. That reflects ISA (UK) 230 paragraph 8 and ISQM (UK) 1 paragraphs 32(f) and (g).
For third-party tools, the FRC says firms should still get evidence on how the tool meets auditing and ethics requirements, versioning and updates, and assurance reports can help. Under the ethics Code, R320.11 requires a decision that using the output is appropriate for the intended purpose.
Illustrative scenario: a team uses a matching tool to vouch a sample of purchase invoices. The tool reports all items matched. In fact, for several items it matched on supplier name and date, and the OCR misread the amounts, so the invoice totals were never compared with the ledger. Separately, two invoices supplied by the client were fabricated, and the tool had no way to know. The client later discovers a payments fraud, and the question is why the audit evidence did not reveal it.
Matching confirms consistency between documents and records; it does not confirm the documents are genuine or that the client gave you all of them. Treating a 'matched' status as proof of occurrence is the misuse of output the FRC warns about.
Image quality is another weak point. Photographs of paper invoices, handwritten amendments and multi-page scans can all reduce OCR accuracy, and the tool may report a confident match regardless. Teams should know how their tool signals low-confidence reads, and whether those reads are routed to a person or quietly accepted.
A claim that the auditor accepted inadequate evidence would usually be handled as audit negligence under the firm's PI policy, subject to its terms. Fraud by the client's staff can raise questions of causation and contributory fault, which may reduce the damages; see AssetCo v Grant Thornton on contributory negligence. The defence will rely on what the file shows about how the tool was checked. If the same tool fault affected several audits, aggregation may matter. See audit firm PI cover.
Related: full-population analytics, AI translation of overseas evidence and certifying AI tools.
Apex arranges PI for audit firms, including smaller practices using AI features in bought-in audit software. A broker can check how your policy treats claims connected to those tools. See the AI in audit hub.
Not on its own. It shows consistency between a document and a record, based on what the tool extracted. The auditor still needs to consider whether the document is reliable and complete, and should check the tool matched on the right fields.
The FRC 2025 guidance expects the file to record checks on the completeness and accuracy of input data. For vouching, that includes confirming all sample items and documents were processed and that extracted values, especially amounts, were read correctly.
Some tools flag signs that a document may have been altered or duplicated, which can help. They cannot confirm a document is genuine, and a clean result is not evidence of authenticity. Where fraud risk is higher, evidence obtained directly from third parties remains important.
Yes. The FRC says firms using third-party tools should still obtain evidence on how they meet auditing and ethics requirements, versioning and updates. The audit file record is the same whether the tool was built in-house or bought.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
