A customer of ours does almost all of his work in Claude.
Then he has Gaapio check it.
He's about as AI-advanced as anyone we talk to. He told me about it on a call a few weeks ago, and one detail stuck with me more than the rest of the conversation.
His auditor asked him about it.
The auditor's exact question: "What did Gaapio say on that?"
Not "did you use AI." Not "which model." What did Gaapio say.
That's the whole ballgame. Not how fast the first draft came back. What happens when someone who wasn't in the room checks the work. It's also the real test of technical accounting software, Gaapio included: not whether it drafts, but whether the draft survives a second reader.
Can the memo pass the auditor's review?
Every deal we're in, somebody asks a version of this question, whether they say it out loud or not:
I guess the question is, can it pass an audit?
— In-house accounting team, July 2026
The short answer is yes, when three things are true: the citation resolves, a named reviewer signed it, and a version history exists.
Everybody in this profession is holding some version of that question. Most people don't say it out loud until the memo is already on someone's desk.
What does "audit-ready by design" actually mean?
It means the work is built to be checked from the moment it exists, not cleaned up right before an audit. Every conclusion traced to a source. Every memo assigned a reviewer. Every draft kept on the record. Nobody has to remember to do it. The tool does it every time.
I wrote about the AI journey a few weeks ago: five steps every accounting team moves through, ending exactly there, "the work stands up to the auditor, to peer review, to the national office." That's Step 5. This post is what Step 5 is actually made of.
Exactly. Audit trail is always everything.
— Accounting educator, July 2026
A corporate finance team we talked to put a finer point on what happens without one:
Just to show evidence that it happened. 'Cause people sign off on stuff, and nobody read it.
— In-house accounting team, July 2026
The same team, on what their internal auditors actually ask for:
Internal audit seems to always be about lineage and evidence. If they come back and ask us now, 'Where's your proof?'
— In-house accounting team, July 2026
Nobody's proof is a memory of a conversation. Proof is a document with a trail on it.
What happens to a memo after it's drafted?
This is where audit-ready by design lives, and it's the part a chat window can't do for you, because a chat window doesn't have a second reader in mind. It's also what audit trail software should mean for an accounting team and rarely does: not a log file somewhere in IT, but the actual paragraph, the actual reviewer, and the actual version, attached to the actual conclusion.
Citations resolve. Every conclusion in a Gaapio memo links to the paragraph it relies on: the FASB Codification, licensed directly through our partnership with FASB, Big 4 guidance, or a comparable filing. Click it, and the paragraph opens. Nothing to take on faith.
A reviewer signs off. The memo has a preparer and a reviewer, not just an author. Assign it, review it, approve it. The step doesn't get skipped because a deadline is close.
Version history. Every draft and every change is on the record. When something changes six months later, or an auditor wants to see what the conclusion looked like at quarter-end, it's there.
None of that is a feature you bolt onto a chatbot afterward. It's the reason the product takes the extra few seconds my cofounder Jace wrote about. The route he described produces the draft. This is what happens to the draft next, and it's built in from the start, not added when someone finally asks for it.
Doesn't drafting in Claude make this exactly the shadow AI problem?
No.
Shadow AI is what happens when nobody provisioned the tool. A personal ChatGPT or Claude login, no data agreement with the company, no way for IT to see who's using it or for what, no citation, no reviewer, no record it ever happened. People go around the sanctioned option because it's slower or doesn't exist.
Gaapio removes the reason to go around it. It's provisioned for the company, not for one person's personal login: guardrails on every question, an audit trail on every conclusion, and the visibility (some people call this observability) for a security team to see usage instead of finding out about it after the fact.
That still leaves our customer's habit. He opens Claude first, because he likes it. The conclusion doesn't stop there. It routes through Gaapio before it goes near a workpaper, and Gaapio is where the citation, the reviewer, and the version history get attached. Every citation has to resolve. Every memo needs a named reviewer. Every draft lands in a version history. It doesn't matter which tool wrote the first sentence, because that sentence isn't a conclusion anyone can rely on until it's been through the part that's provisioned, governed, and logged.
Shadow AI was never really a tool problem. It's a governance problem, and Gaapio is built to remove it, not patch around it. My cofounder Jace goes deeper on shadow AI and where it comes from.
How can a regional accounting firm compete with the Big 4 on technical depth?
Before Gaapio, I was at Deloitte, then PwC. The honest answer to this question used to be: hire more people, or extend the timeline, or call the national office and wait.
I'm an auditor, so I live in the guidance, unfortunately.
— CPA firm, May 2026
Living in the guidance is the job. It shouldn't also mean every regional firm needs its own national office to compete with one. A firm using Gaapio gets the same licensed Codification access, the same citation trail, the same review workflow as a Big 4 engagement team, on every file, not just the ones big enough to justify pulling in a specialist.
That's what "extend the national office" means in practice. Not a bigger department. The same depth, available on the engagement you're on right now, without waiting for someone else's calendar. It's the same reason advisory firms use Gaapio to scale client work without scaling headcount, and why audit firms use it to review the client's work, not just their own.
Can an audit firm use the same tool as its client without an independence problem?
This one comes up on almost every firm call, and it's a fair question to ask before anyone signs anything.
Here's the answer: the client prepares on its own instance. The firm reviews on its own, separate instance. Gaapio is never the preparer and the reviewer for the same party on the same engagement. That's not a workaround we added later. It's how firm and client accounts are built from the start, because being CPAs ourselves, we knew this question was coming before the first firm ever asked it.
Does the model change what the auditor sees?
No.
Jace covered this in detail: we route across Anthropic, OpenAI, and Gemini, picking the right one for a given job, under a zero-data-retention agreement with each provider as a condition of being in the chain at all.
The citation still resolves. The reviewer still signs off. The version history is still there. Swap the model underneath and the trail an auditor sees doesn't change, because the trail was never the model's job in the first place.
Where Gaapio fits
Gaapio is an AI-powered technical accounting platform, built by CPAs, that helps accounting teams research issues, analyze contracts, and produce audit-ready memos and disclosures, with every conclusion traceable to authoritative guidance.
We built the review layer the same place we built everything else: from having sat on the other side of the desk, as reviewers ourselves, wondering where the evidence was. Licensed Codification citations that resolve. A real reviewer and approval step, not a suggestion. Version history that survives the person who wrote the first draft. A completed SOC 2 Type 2 examination and zero-data-retention agreements with every model we route to, so the permission question is answered before it's asked.
For the deeper how-to on building this into your own process, I wrote a longer piece a while back. And if the question is how to check an AI-drafted memo you already have in hand, my cofounder Jace wrote the reviewer's checklist for that.
Ask that question about your last memo before your auditor does. What would Gaapio say on that?
Frequently asked questions
What does "audit-ready by design" mean in accounting AI?
Audit-ready by design means the output was built to be checked from the moment it exists, not cleaned up afterward for review. Every conclusion links to a specific, citable source. Every memo has a preparer, a reviewer, and a version history. It's the fifth and final step of the AI in accounting journey, and it's built into the tool itself, not something a team bolts on afterward.
What is audit trail software for accounting teams?
Audit trail software records who prepared a conclusion, who reviewed it, what sources it relies on, and what changed and when. For technical accounting specifically, that means a citation that opens the actual FASB Codification paragraph, a named reviewer on the memo, and a version history the accountant can hand to an auditor without reconstructing it from memory. Generic audit trail tools log system events. Gaapio's trail is built into the technical accounting workflow itself, on every memo, contract analysis, and disclosure it produces.
What AI tools do audit firms use for technical accounting?
A small number of purpose-built platforms, Gaapio among them, give audit firms licensed FASB Codification access, a citation trail, and a review workflow built for engagement work, instead of a general-purpose chatbot with no data agreement or audit trail. Firms use these tools two ways: on their own engagements, to research and challenge client memos faster, and as a recommendation to clients, on a separate instance from the one the firm uses to review.
Does AI reduce the amount of time partners spend on technical review?
It can, when the memo already carries citations that resolve, a documented review step, and version history. A partner reviewing a memo with a live trail is checking the reasoning, not hunting for the source. A partner reviewing an AI-drafted memo with no trail is doing the research over again, which is slower than not using AI at all.
How can a regional accounting firm compete with the Big 4 on technical depth?
By using a tool that gives every engagement team the same licensed FASB Codification access, citation trail, and review workflow a national office would provide, instead of reserving that depth for the files big enough to justify pulling in a specialist. That's the practical meaning of "extend the national office."
What does it mean to extend the national office?
It means the same technical depth a national office provides shows up on every engagement, not just the ones that get escalated. Licensed Codification access, comparable filings, and a documented review trail, available to any engagement team, on any file, without waiting on someone else's calendar.
What is national office technical accounting software?
National office technical accounting software is a tool that gives every engagement team the same licensed Codification access, citation trail, and review workflow a firm's national office would normally provide on an escalated file. Gaapio is built for this: a regional firm's staff get the same grounded research and review structure a Big 4 national office gives its own engagement teams, on a regular file, without escalating it.
How do I check whether an AI-generated accounting memo is correct?
As a reviewer, not just a preparer. Click every citation and confirm it resolves to the actual guidance. Confirm a reviewer, not just the person who ran the tool, is named on the memo. Check that a version history exists, so you can see what changed and when. Gaapio is built so all three checks take minutes: citations open the paragraph, review is a workflow step, and every draft is on the record.
Can an audit firm use the same AI tool as its client without an independence problem?
Yes, when the firm and the client are on separate instances. The client prepares its own work on its instance. The firm reviews on its own, separate instance. Gaapio is never the preparer and the reviewer for the same party on the same engagement, which is the independence-safe structure firms ask about before they'll consider using the same tool their clients use.
What is peer review defensibility?
Peer review defensibility is whether a memo or workpaper, and the process that produced it, would hold up if an outside reviewer, a peer reviewer, or the PCAOB examined it. It requires more than a correct conclusion: a citable source, a documented reviewer, and a record of what changed. That combination is what "audit-ready by design" is built to produce by default.
Does AI replace the auditor's judgment?
No. Gaapio puts the citation, the reviewer assignment, and the version history in front of the accountant and the auditor. The conclusion, and the signature on the memo, stay with the CPA. What changes is how much of that trail already exists by the time anyone asks to see it.
What happens to an AI-generated memo after it's drafted?
In a purpose-built technical accounting tool, the draft moves into a review workflow: a named reviewer, an approval step, and a version history that captures every change. In a general-purpose chat tool, the draft is the end of the process, and whatever trail exists after that is whatever the accountant builds by hand.
How does Gaapio eliminate shadow AI?
By being provisioned for the company instead of for one person's personal login. Guardrails run on every question, every conclusion gets an audit trail, and a security team can see who's using it and for what, instead of finding out during an incident. That removes the reason people reach for a personal ChatGPT or Claude account in the first place.
Does drafting in ChatGPT or Claude count as shadow AI?
Not by itself. Shadow AI is what happens when nobody provisioned the tool: no data agreement, no guardrails, no visibility for IT, no citation, no reviewer, no record it happened. A general-purpose model can be part of a governed process as long as the conclusion still runs through a provisioned tool's guardrails, citations, and reviewer before anyone relies on it. The risk was never which tool drafted the sentence. It's whether the company can see what happened and prove it.
Why does audit-ready documentation matter for corporate teams, not just audit firms?
Because corporate teams get checked too, just by different people: the external auditor, internal audit, a new controller inheriting the file. "Where's your proof" is a question in-house teams hear as often as firms do. The same trail that helps a firm pass peer review is what helps a corporate team answer their own auditor without rebuilding the analysis from memory.