How artificial intelligence can be used in audit methods and techniques, based on Article 22 of the ALSAI Audit Procedures Regulation

Using artificial intelligence (AI) in the audit methods and techniques of the State Supreme Audit Institution (ALSAI), on the basis of Article 22 of the Audit Procedures Regulation, is about modernising how audit evidence is collected, analysed and assessed. That article governs the choice of methods, techniques and methodological approaches auditors must use to obtain sufficient and reliable evidence.

Within that procedural frame, AI can be applied through the following techniques.

1. Risk analysis and sample selection

Article 22 provides for statistical techniques to draw and define samples. AI changes that step in a material way:

• Auditing 100% of the population. Instead of a limited sample, algorithms can analyse the full population of a public entity’s financial transactions in seconds.
• Predictive risk modelling. AI can review the historical data of audited entities and flag the areas or procurements with the highest risk, so ALSAI staff time is directed there.

2. Detecting anomalies and financial fraud

Within the analytical methods set out in the Regulation, AI can be aimed at unusual patterns:

• Machine-learning algorithms can pick up fine deviations in transactions, such as duplicate invoices, transfers outside official working hours, or breaches of public-procurement thresholds (splitting tenders to avoid open procedures).
• Suspicious-profile analysis. AI compares an institution’s financial behaviour with standards and historical trends and raises red flags immediately.

3. Performance audit through data analysis and language processing

For performance audits, where the volume of documents and reports is very large:

• Natural language processing. AI tools can scan thousands of pages of progress reports, concession (PPP) contracts or board decisions to find legal contradictions or gaps against strategic objectives.
• Public-reaction analysis. AI can collect and analyse citizens’ comments or complaints on public platforms about a state service, and supply methodological evidence on the efficiency and quality of that service.

4. Automated checks across registers

Compliance techniques often require data to be matched across different state systems:

• Register matching. Automated procedures supported by AI can check treasury data against the public-procurement system and the commercial register (QKB), to confirm whether there was a conflict of interest or full legal compliance.

Keeping ALSAI principles and AI ethics

AI is a powerful accelerator, but ALSAI’s ethical and methodological standards, including those of EUROSAI and INTOSAI, stay in force. AI should always be used under this principle: artificial intelligence proposes and assists; the auditor assesses, confirms and bears the final professional responsibility.

How AI can help auditors in compliance audits and financial audits

Examples: statistical help in public-procurement procedures; setting the limit fund from the offers collected; comparing bids submitted by participating operators; checking their arithmetic; whether a works estimate was drawn up against government reference prices; whether estimate items match the design.

The practical guide below is split by task and shows how algorithms reduce the auditor’s manual work.

1. Public procurement: the limit fund and bid analysis

At this stage, AI helps test market value and detect anomalies or collusion.

Checking the limit fund against collected offers

• Technique: regression analysis and clustering.
• Application: AI can scan the offers collected by the contracting authority during market research and compare them with prices of similar transactions in the electronic procurement system. If the limit fund is set artificially above the market average, the system flags it as a risk.

Comparing operators’ bids

• Technique: standard-deviation analysis and anomaly detection.
• Application: AI analyses the price structure submitted by every operator in a tender. If two or more operators show identical or constant price gaps on every item (for example, exactly 2% on each line), AI raises a red flag for collusion.

Arithmetic check of bids

• Technique: automated calculation.
• Application: instead of the auditor reviewing every row of a price table in Excel or PDF, the check multiplies quantity by unit price for every operator and surfaces arithmetic errors that may have affected qualification.

2. Construction works: reference-price checks

Auditing interim statements and estimates in construction needs tabular accuracy.

Automatic comparison with government reference prices

• Technique: data matching and natural language processing.
• Application: AI can be aligned with the government construction price manual. During the audit it scans the contract estimate and compares each item with the official reference code and price. Any breach of the ceiling price, or a wrong zone coefficient, is listed in a summary report.

3. Whether estimate items match the design

This is one of the stages where inflated quantities are often hidden.

Matching the estimate to the technical design file

• Technique: digitised design models (CAD or BIM) and natural language processing.
• Application: if the design is digital, AI can extract material quantities from the drawings (concrete, steel, plaster) and compare them with the estimate. If the estimate provides 500 m³ of concrete but the design shows the building needs at most 400 m³, AI reports a 100 m³ mismatch to the auditor.

Summary table

Checking the execution of works

AI can help auditors compare interim and final statements with the approved estimate, and check whether the site diary has been reflected in the estimated and certified items.

Checking statements and the site diary means cross-referencing data. AI is useful precisely for the accuracy and speed of that cross-check.

1. Comparing statements with the approved estimate

In a traditional audit, the auditor manually compares statement tables with the contract estimate to see whether quantities were exceeded or unforeseen items were added without approval.

• Automatic matching. AI tools can read interim statements 1, 2 and 3 and the final statement, including scanned PDFs or Excel files, and compare them with the base contract estimate.
• Cumulative monitoring. AI adds up the quantities of all interim statements and raises a red flag if the cumulative quantity of an item exceeds the estimate without an additional contract or a record of extra works, or if the unit price on the statement has changed from the signed contract.

2. The site diary and certified items

The site diary is often handwritten or kept in text documents, where the supervisor records each day what was done. This is where works that exist only on paper often appear.

• Digitisation. If the diary is handwritten, AI turns the writing into searchable text.
• Linking text to figures. AI reads a diary sentence, for example “the trench for the pipes was excavated on axis A-B”, and looks in that period’s statement for whether the item “earth excavation” was billed and whether the date matches.
• Chronology check. If “wall plastering” was billed on 15 October but the diary says the walls were built on 20 October, AI flags the mismatch: a wall that does not yet exist cannot be plastered.

Control matrix: diary, statement, estimate

Instead of the auditor spending most of the time adding figures and paging through diaries, AI does the mechanical work. The auditor is left with the physical check on site, only for the items where AI found a mismatch.

Checklist for the IT specialist

An auditor can use this scenario and this list to instruct an IT specialist, or to use data-analysis software, on how to cross-check the documentation of a construction site.

Scenario: construction of the “Dituria” school

• Audited entity: Municipality X
• Contract value: 120,000,000 lek (including VAT)
• Suspected risk: over-billing of concrete and steel quantities, and early billing of external works (asphalt, landscaping) before structural works were finished.

The auditor loads three folders: the base estimate in Excel, the interim and final statements as scanned PDFs, and the site diary photographed or scanned from the site book.

1. Integrity of the estimate and the statements

• Unit prices. Check whether the unit price on every statement is the same as in the original contract estimate. Rule: if the statement price is not equal to the estimate price, flag an unauthorised change.
• Cumulative quantities. Add the quantity of each item across all interim statements and compare it with the estimate. Rule: if the cumulative quantity exceeds the estimate, flag an overrun without a contract amendment.
• Recalculation. Multiply quantity by unit price and add the totals. Rule: if quantity × price is not equal to the written amount, flag an arithmetic error or an inflated total.

2. Chronological cross-check: diary and statements

• Execution dates. For every item certified in a given month, search the diary for a note of that work within that month. If the key words are not found, flag work that exists only on paper.
• Construction sequence. Check whether the statement date for plastering or a road layer is earlier than the diary date for building the wall or for excavation. If it is, flag a chronological anomaly.
• Declared resources. If the diary says “on site today: 2 workers” but the certified volume for that week needs a much larger capacity, flag a mismatch.

3. Government reference prices

Compare estimate item codes with the official construction price manual for the relevant year. If the contract price exceeds the reference price for the same code and zone, flag the overrun.

Example of the report handed to the auditor

The system does not decide. It generates the anomaly table, and the auditor decides.

The auditor takes this report to the site with a target. They do not measure the whole building: they measure the waterproofed area and ask why the statement was signed before the bricks arrived.

Technical guide: AI in financial and compliance audits

A supporting instrument for auditors, to strengthen the assurance behind an independent opinion.

It is useful to define techniques for financial audits as well, mainly for:

• financial management and control in the audited entities;
• whether the payroll system complies with decisions of the Council of Ministers by category;
• auditing bank payments against payment orders, and treasury payments against contracts, because it is almost impossible to check manually whether payments match the contract on quantity, price, value and deadlines, and on that basis to assess the risk in bank payments;
• auditing the financial statements for material misstatement, mainly in tangible assets.

On that basis, the auditor is better supported in giving an independent opinion grounded in reasonable assurance.

Module 1. Financial management and control

Purpose: assess the effectiveness of internal controls and detect breaches of procedure.

Technique: process-trace analysis and defined rules.

The system analyses digital traces in the entity’s financial systems: who created the invoice, who approved it, who executed the payment, and on what date.

• If the same user created the expenditure order and gave the final approval, the system flags a breach of segregation of duties.
• If payments were made before the fund commitment was recorded, the system flags a bypass of procedure.

Module 2. Payroll against government decisions

Purpose: check the entire payroll, to verify that grades, posts and allowances match the ceilings that were set.

Technique: data matching and anomaly detection.

The auditor loads the matrix of the relevant decision (categories, base pay and allowed allowances). The system compares every payroll line, for every month of the year, with that matrix, and lists only the cases where:

• an employee in a given category has base pay above the ceiling;
• allowances (length of service or difficult conditions) were applied at a higher percentage than the act allows.

Module 3. Bank payments, payment orders and the treasury against contracts

Purpose: verify whether treasury or bank payments match the contract on quantity, price, value and deadlines.

Technique: automated three-way matching.

AI extracts data from the contract (terms, deadlines, unit prices), from accepted invoices or statements, and from payment orders executed at the treasury or the bank.

• Price and value risk. A signal if the cumulative amount paid exceeds the total contract value, or if an invoice uses a unit price different from the contract.
• Deadline risk. The contract date for completing the work is compared with the invoice date and the payment date. If payment was late, the risk of late-payment interest is calculated.
• Duplicate payments. Algorithms detect whether the same invoice or the same amount was paid twice under different reference numbers.

Module 4. Financial statements and tangible assets

Purpose: identify material misstatements, overstatements or understatements in non-current tangible assets.

Technique: statistical review of figures and recalculation of depreciation.

• Depreciation. AI recalculates depreciation of assets under the legal rates. Any deviation that affects the opinion is caught at the start.
• Distribution of figures. The distribution of leading digits in the values of purchased assets is analysed. A departure from the expected distribution indicates that prices may have been altered manually.
• Wrong capitalisation. Maintenance expenses are scanned to see whether large costs should have been capitalised as assets but were booked as current expenses, or the reverse.

How this supports an independent opinion

Under the international audit standards (ISSAI), the auditor gives an opinion based on reasonable assurance that the financial statements are free from material misstatement.

1. From a sample to the whole population. The auditor no longer says “I checked 20 treasury payments and they were in order”, but “all payments for the year were checked and only the mismatches were found”.
2. A stronger basis for the opinion. If mismatches in pay or contract payments exceed the materiality threshold, the auditor has evidence for an adverse opinion or a qualified opinion.
3. Lower detection risk. The risk that a material error, hidden in a large volume of data, goes unnoticed is reduced.

In applying Article 22 of the Audit Procedures Regulation, auditors can specify in the official request for information the data structure the entity must submit, so that it can be put through this check.