A finance manager receives the management letter in April. One point says a vendor was paid twice for the same invoice the previous May. The payment is eleven months old, the person who approved it has changed roles, and the question in the board meeting is not what happened but why nobody saw it for a year. Nothing in that audit was done badly. It was done late, by design.
That design is the subject of this comparison. The ACFE’s 2026 Report to the Nations found that the median occupational fraud lasts 12 months before it is detected, and that tips, not audits, were the top detection method in 43% of cases. The case for testing all year rather than once is made in why an annual audit misses eleven months; this article takes the AI angle and puts the two approaches side by side, so you can decide what to keep, what to change and in what order.
What is continuous auditing with AI?
Continuous auditing with AI is the practice of testing every ledger transaction against defined audit rules shortly after it is posted, using automated tests and AI models to rank risk, and routing each exception to a named person who reviews it against evidence. Two words carry the weight: every, and named. Coverage becomes the full population; accountability stays with a person.
It helps to separate it from continuous monitoring. Monitoring is owned by management and is part of the control itself, for example a payables supervisor who reviews a daily duplicate report. Auditing is owned by an independent function, internal audit or an outsourced provider, that tests whether those controls work. Both fit COSO’s Principle 16, which calls for ongoing and separate evaluations of internal control. For the wider map of where AI sits in finance, start with our practical guide to AI in accounting.
How does continuous auditing differ from a traditional audit?
| Dimension | Traditional audit | Continuous auditing with AI |
|---|---|---|
| Timing | After the period closes, once or a few times a year | Daily or after each posting run, throughout the year |
| Coverage | A sample selected under ISA 530, plus targeted items | Every transaction in the defined population, ranked by risk |
| Detection lag | Months: the error is found after the books are closed | Days: the error is found while the period is still open |
| Evidence | Documents requested and inspected during fieldwork | Ledger records with their ids, linked to source documents and stored with the finding |
| Output | An opinion (external) or a periodic report (internal) | A live exception queue, with periodic reports built from it |
| Who decides | The audit team, at the end of fieldwork | A named reviewer per exception, escalated by materiality |
| Main weakness | Sampling risk and stale findings | Alert fatigue, data quality and the quality of the test design |
Continuous auditing does not remove risk; it exchanges one kind for another. Sampling risk shrinks for the attributes you test, because nothing is left out, a shift explained in detail in our guide to moving from sampling to full-population testing. In its place come the risks of a badly designed test, an incomplete extract and a reviewer who stops reading alerts.
An external auditor still forms an opinion under the ISAs and decides how far to rely on anyone else’s work. Better internal evidence makes that reliance easier to justify, not automatic. The standards themselves are moving: in August 2026 the IAASB issued exposure drafts revising ISA 500, ISA 330 and ISA 520 to address the increased use of technology, with comments due by 15 December 2026. They are drafts, so do not build methodology on wording that may change.
What does AI actually do in a continuous audit?
Three layers do different jobs, and confusing them is a frequent design mistake.
Rules: the known patterns
Deterministic tests answer yes or no questions and run first, because they are cheap, explainable and repeatable. The patterns we find most often in continuous-audit work are:
- Duplicate and near-duplicate payments to the same vendor.
- Near-duplicate vendors: the same supplier set up twice under slightly different names.
- Approvals outside the approval matrix, including approvals by the person who raised the request, a test that depends on clean segregation of duties, including AI agents as users.
- Cut-off errors, where the document date and the posting period disagree.
- Inventory valuation drift between the valuation report and the ledger.
- Manual journal entries posted late at month-end in round amounts, the population ISA 240 expects auditors to examine when testing journal entries.
Models: what rules miss
A rule finds an exact duplicate. A model finds the bill that is not identical to anything but is unusual in several ways at once: a new vendor, an unusual posting hour, a user who rarely posts to that account. The output is a ranking, not a verdict. Its value is that the reviewer reads the riskiest twenty exceptions first rather than the first twenty.
Language: explaining and drafting
Language models are good at turning an exception into a readable draft finding and at pulling the related documents together. They are also capable of stating a number that is not in the books. The control is simple and non-negotiable: every statement in a draft must cite the records it came from, or it is rejected. We call that rule evidence or silence, explained in our article on AI provenance and the audit trail. And a flag is a question, not a conclusion; AI-based fraud detection explains why a red flag is never proof of fraud.
What does a continuous audit cycle look like in practice?
- Extract new postings since the last run through a dedicated read-only API user, as described in connecting AI to Odoo for continuous auditing.
- Reconcile the extract to the trial balance for the same period, so you know the population is complete before you test it.
- Run the rule tests, then the model scoring, on the new population.
- Suppress only patterns that have been explained before, and record who approved each suppression and why.
- Assign every remaining exception to a named reviewer, who checks it against the source document.
- Raise a finding with condition, criteria, cause, owner and due date, or close the exception with the evidence that explains it.
- Draft any correction for a person to approve, with a second approver above the ISA 320 materiality threshold, as set out in our note on materiality thresholds.
- Report monthly: open findings, ageing, repeats of earlier findings, and tests that produced nothing (which may mean the test is broken).
Where does the traditional audit still win?
A continuous test sees only what was recorded. It cannot count stock in a warehouse, obtain a bank confirmation, read the tone of a management meeting, or see a side agreement that was never entered. Accounting estimates, going concern, related parties outside the books and the plausibility of management’s explanations remain judgement work. The ACFE’s 2026 report also found that more than half of cases involved a lack of internal controls or an override of existing ones, and an override performed by someone with the right access can look perfectly normal in the data.
There is also a dependency the traditional auditor checks first and a continuous programme often forgets: the IT environment. ISA 315 (Revised 2019) requires auditors to understand general IT controls because ledger data is only as reliable as the access rights behind it. Odoo’s 20 release notes say changes to user groups are now logged in the user’s chatter, which gives a reviewer a trail of who received which access and when. Test that trail before you trust the transactions.
What are the risks, and how do you control them?
- Alert fatigue. Control: thresholds linked to materiality, and a weekly review of the ten most suppressed patterns.
- Incomplete data. Control: reconcile every extract to the trial balance and stop the run if it does not agree.
- Silent test failure. Control: a test that returns zero exceptions for three cycles is reviewed, not celebrated.
- Loss of independence. Control: the people who own the process do not edit the tests, and every rule change is logged with an approver.
- Invented explanations. Control: drafts without record citations are rejected and never presented as facts.
- Usage cost. If you use Odoo’s native AI, Odoo’s 20 release notes say all AI features consume IAP credits billed per request, so budget by volume of runs.
A finding that arrives eleven months late is a history lesson, not a control.
Where should a finance team start on Monday?
Pick one process with high volume and clear rules, usually payables. Choose three to five tests from the list above. Run them backwards on the last closed quarter and compare the results with what your last audit sample found; that comparison calibrates thresholds and tells you which tests produce noise. Then run weekly, assign a named reviewer, and keep the working papers ISA 230 expects: what was tested, what was found and how each exception was resolved. Widen to a second process only when the first queue is being cleared on time.
This is how we run it. MFT’s seg-audit platform reads the books straight from the ERP, read-only, scores every transaction by risk instead of sampling a few percent, and keeps each finding on record with its evidence and severity; a finding cannot be closed without a named, registered approver. Our Auditor agent drafts findings and correcting entries for a person to approve, and our internal audit service supplies the licensed reviewers when you do not have them in-house.