The agentic audit: transforming procedures into reliable AI skills

Executive summary

For the past two years, the professional services industry has focused on 'chatting' with AI, asking questions and hoping for accurate summaries. We are now entering the era of 'agentic AI', where the model moves from a passive reader to an active participant that executes specific workflows.

To achieve this, we must transition from writing prompts to building 'agent skills'. An agent skill is essentially a package of AI-optimised scripts combined with relevant professional context. It allows the AI to perform a complex audit procedure, like a going concern assessment, with the same rigour as a human associate following a detailed work programme.

The table below highlights the difference between a standard conversational approach and an agentic skills approach.

1. Introduction

In a traditional audit engagement, you would never hand a new junior associate a set of financial statements and simply say, "Check if they are fine." You would provide them with an audit programme. This programme contains specific checklists, references to the International Standards on Auditing (ISA), and templates for documenting their findings.

Yet, when using generative AI, this is often exactly what we do. We paste a document into a chat window and write a generic prompt: "Review the going concern assumption." We are treating the AI like a creative consultant rather than a procedural auditor.

To integrate AI effectively into regulated workflows, we need to move beyond conversation. We need to define 'agent skills'. This approach treats the AI not just as a text generator, but as an orchestration engine that uses a structured package of files to execute a procedure from A to Z.

2. What is an agent Skill?

In simple terms, an Agent Skill is an AI-optimised script combined with relevant context.

It is a digital container that holds everything the AI needs to perform a specific task. Unlike a standard prompt which is just text, a Skill is a structured directory of files that functions like a mini-software application for the AI.

Think of it as the digital equivalent of an audit file. It contains the instructions (the standard), the tools (the calculator), and the paper (the memo). When we equip an agent with a skill, we are not asking it to guess; we are forcing it to follow the logic defined in that package.

3. The Anatomy of a Skill

To understand how this works, we can look at the actual file structure of a typical Agent Skill. It is not a single line of code, but a folder containing four distinct components.

isa570-skill/
├── SKILL.md (main instructions)
├── FORMS.md (form-filling guide)
├── REFERENCE.md (detailed API/ISA reference)
└── scripts/
    └── calculate_ratios.py (utility script)

isa570-skill/
├── SKILL.md (main instructions)
├── FORMS.md (form-filling guide)
├── REFERENCE.md (detailed API/ISA reference)
└── scripts/
    └── calculate_ratios.py (utility script)

isa570-skill/
├── SKILL.md (main instructions)
├── FORMS.md (form-filling guide)
├── REFERENCE.md (detailed API/ISA reference)
└── scripts/
    └── calculate_ratios.py (utility script)

1. SKILL.md (the instructions)
This is the "audit programme". It tells the AI exactly what to do, step by step. For a going concern assessment, this file would contain instructions such as: "First, extract the current assets and liabilities. Second, run the liquidity script. Third, review the Board Minutes for keywords regarding financing."

2. FORMS.md (the output)
This is the "workpaper". It defines exactly what the final output must look like. It forces the AI to fill in a structured template, for example, a specific going concern memo format, rather than writing a generic essay.

3. REFERENCE.md (the context)
This is the "standard". It contains the relevant extracts from ISA 570 or specific firm methodologies. The AI uses this to ground its judgment, ensuring it cites the correct paragraphs of the standard when flagging a risk.

4. Scripts (the tools)
These are Python scripts that perform the hard logic. An LLM is bad at maths, so we don't ask it to calculate ratios. Instead, the calculate_ratios.py script performs the division for the current ratio and quick ratio. The AI simply provides the numbers to the script and reads the accurate result.

4. Real-world case: ISA 570 going concern assessment

Let us apply this structure to a real audit scenario: the going concern assessment.

The old Way (prompting)
You upload the Financial Statements and ask: "Is there a going concern risk?"
The AI might write a convincing paragraph. However, it might hallucinate the ratio calculation, miss a subtle breach of debt covenants mentioned in the notes, or fail to reference the specific requirements of ISA 570 paragraph 16.

The agentic way (skills)
We equip the agent with the isa570-skill defined above. The workflow becomes deterministic:

• Step 1 (instruction): The agent reads SKILL.md and identifies that it must first assess liquidity.

• Step 2 (tool use): It extracts the financial data and passes it to scripts/calculate_ratios.py. The script returns: "current ratio: 0.85".

• Step 3 (context): The agent checks REFERENCE.md (ISA 570). It notes that a ratio below 1.0 indicates a material uncertainty.

• Step 4 (completion): It opens FORMS.md and fills out the "material uncertainty" section of the memo, citing the calculated ratio and the relevant ISA paragraph.

By converting the audit procedure into a skill, we have removed the ambiguity. The AI did not "think" about the math; it used a script. It did not "remember" the standard; it read the reference file.

5. Conclusion

The future of professional AI is not about building a smarter chatbot; it is about building a better toolkit. By packaging our audit methodologies into AI-optimised scripts and context, we transform the AI from a creative assistant into a reliable operator.

For audit firms, the immediate opportunity is to translate their standard checklists into this file structure. A "going concern" checklist becomes a SKILL.md; a "ratio analysis" spreadsheet becomes a script. This transition ensures that when the AI performs a task, it does so with the transparency, consistency, and accuracy required for the audit file.