How do I organize AI work records before an annual client audit?
Organise along the path an auditor walks: the client index on top, deliverables beneath it with their acceptances recorded, then the supporting sets in audit order: scope and changes, access inventory, costs matched to invoices. Review the receipt and actual deliverable before accepting a handover.
Client audits of AI-assisted work are new enough that both sides are improvising, which rewards the prepared disproportionately. The auditor's questions follow a stable logic even when their checklist is fresh: what was delivered, who decided it was acceptable, what changed along the way, who and what had access, and what it cost. Organising in that order means the audit proceeds as a walk through your structure instead of a series of excavations.
The index is the audit's front door, and its completeness is the first impression that colours the rest: gaps marked honestly read as control; gaps discovered read as concealment. Deliverables come next, and the acceptance layer does quiet work here, because an auditor who sees the client's own recorded decisions on the records stops asking whether the client knew, which retires a whole category of finding before it forms.
The rehearsal sample is the step practices skip and regret. Pick three deliverables the way an auditor would (one large, one changed, one ordinary), open each from index to receipts, and fix in private what the walk exposes: the missing change note, the access entry nobody updated, the cost that matches no invoice. An audit whose surprises were all rehearsed is an audit that ends in a compliment about record-keeping, and those get quoted in renewals.
Checklist: the pre-audit organisation
1. Index: the client's year complete, gaps marked with causes. 2. Deliverables: each with handover, acceptance, and export reachable from the index in two clicks. 3. Changes: scope changes and change notes in date order, matched to the deliverables they touched. 4. Access: the inventory for the year, with joiners, leavers, and revocations shown. 5. Costs: AI costs and agent spend matched to the invoices and periods they belong to. 6. Rehearsal: three sampled deliverables walked end to end; findings fixed and logged before the audit date.
Worked example
One deliverable's walk in miniature: from the index to https://zambo.dev/handover/45434a17-4afc-486a-9646-e689bcee4297 , steps openable, acceptance recorded, receipts recomputing at the verify page. An auditor's sample that lands on records of this shape, three times in a row, changes the meeting's temperature by the second sample.
Frequently asked questions
The audit is next week and our records are patchy. What is the honest play?
Organise what exists, mark the gaps plainly in the index, and prepare the summary of what changed in your process since. Auditors distinguish between a practice with a dated boundary and a practice pretending completeness; the rehearsal sample still applies, to the records that exist.
Should we give auditors direct access to the record system?
Scoped, read access to the audited client's records is usually the fastest route and signals confidence; the production packet alternative (exports under your control) suits stricter engagements. Decide from the contract, and log whichever route is used on the audit file.
What do auditors ask that practices least expect?
The access question in AI form: which agents could touch our data, and when was that access granted and reviewed. Practices drill the delivery story and improvise the access story; this checklist puts the access set in the walk for exactly that reason.
By Brennan Zambo, founder of Zambo.
Last verified: 2026-10-17.
Try a handover
A handover gives your client one proof link with verifiable receipts to review, then Accept or Flag.
try it: say 'use zambo to hand this over to <client>' in your ai