AI Accounting Glossary: 25 Terms Your Auditor Asks About
An AI accounting glossary for controllers: 25 terms, from LLM and agentic AI to replay and ITGCs, each defined in one line and paired with the question an auditor will ask.
Your vendor says its AI is "agentic, grounded and explainable." Your auditor will ask what each of those words means for the numbers in your ledger. This AI accounting glossary defines 25 terms in one line each, and pairs every term with the question an auditor is likely to ask about it.
TL;DR: An AI accounting glossary should do more than define buzzwords. For each term below you get a one-line definition a controller can quote, plus the audit question it triggers. The terms that matter most for evidence are audit trail, data lineage, replay, model versioning and review threshold, because they decide whether an AI result can be checked.
Why does a controller need an AI accounting glossary?
Because vendors, auditors and your own team now use the same words to mean different things. "Explainable" can mean a confidence score on one product and a full record of inputs and rules on another. If you cannot pin the word down, you cannot test the claim.
Most glossaries in this space either define general accounting terms or list AI terms without saying what an auditor would want to see. The PCAOB's staff noted in July 2024 that some generative AI tools have a "blackbox" nature, "which raise questions around the auditability of certain GenAI-created output" (PCAOB staff Spotlight, July 2024). That is a staff view from limited outreach, not Board guidance, but it names the problem this glossary is built around.
How to use this list: read the definition, then ask the vendor or your team the audit question underneath. If nobody can answer it with a document, a log or a query, treat the feature as unproven.
How does the AI actually work? (terms 1 to 5)
1. Generative AI: AI that produces new content, such as text, a journal entry description or a draft reconciliation note, based on patterns learned from training data.
Auditor asks: which outputs in the close were generated, and who reviewed them?
2. Large language model (LLM): a generative AI model trained on large amounts of text to predict the next word, which lets it read documents and write answers.
Auditor asks: what is the LLM allowed to decide on its own, and what does it only suggest?
3. AI agent (agentic AI): an AI system that plans and carries out multi-step tasks, such as pulling a bank file, matching lines and drafting an entry, with limited prompting.
Auditor asks: what actions can the agent take without approval, and where is each action logged?
4. Retrieval-augmented generation (RAG): a setup where the model first retrieves documents from a defined source, such as your policies or invoices, and then answers using them.
Auditor asks: which documents did it retrieve for this answer, and can you show them?
5. Rules engine: software that applies explicit, written rules, such as "match on reference, then amount within $0.01," so the same input always gives the same result.
Auditor asks: where are the rules written down, and who approved the current version?
How much should you trust the output? (terms 6 to 12)
6. Hallucination: output that is fluent and confident but false. NIST calls it confabulation, "the production of confidently stated but erroneous or false content" (NIST AI 600-1, July 2024).
Auditor asks: what control stops an invented figure from reaching the general ledger? We cover practical controls in catching AI hallucinations before posting.
7. Grounding: tying an AI answer to specific source records, so every figure points back to a row, a document or a balance.
Auditor asks: for this number, which source record supports it?
8. Confidence score: the system's own estimate, often 0 to 100, of how likely an output is correct.
Auditor asks: how was the score calibrated, and what happens below the threshold? A score is a routing signal, not evidence.
9. Deterministic AI: a system that returns the same output every time it gets the same inputs, rules and version.
Auditor asks: if I rerun last quarter's match today, will I get the same answer? More in deterministic AI in accounting.
10. Probabilistic output: an output that can vary between runs on the same input, which is normal for LLMs.
Auditor asks: if the result can change, what did you store at the time so the original decision can be shown?
11. Explainability: the ability to show, in terms a reviewer understands, why the system produced a specific output.
Auditor asks: show me the reason for this one match, not a general description of the model.
12. Glass box vs black box: a glass box system exposes its inputs, rules and steps for each decision; a black box shows only the result.
Auditor asks: can I trace this output without asking the vendor? We turned this into five tests for a glass box.
Want every AI result to come with the source rows, the rule and the SQL behind it? Join the Yoraito waitlist for early access.
What evidence should the AI leave behind? (terms 13 to 16)
13. Audit trail: a time-stamped record of what the system did, to which records, under which rule or model version, and who approved it.
Auditor asks: can you export the trail for this account for the full period? Our AI audit trail checklist lists the fields.
14. Data lineage: the documented path a number took from source system to report, including every transformation along the way.
Auditor asks: walk me from this balance back to the bank file.
15. Replay: rerunning a past AI decision with the stored inputs, rules and version to confirm it produces the same result.
Auditor asks: can you replay it now, while I watch? A replay check can be a single query:
-- Replay check: rerun stored decisions and flag any that differ
SELECT d.decision_id, d.output_hash AS stored, r.output_hash AS replayed
FROM ai_decisions d
JOIN replay_run r ON r.decision_id = d.decision_id
WHERE d.period = '2026-09'
AND d.output_hash <> r.output_hash;
An empty result means every decision for the period reproduced exactly.
16. Model versioning: recording which version of the model, prompt and rules produced each output, so a later change does not rewrite history.
Auditor asks: which version was live on the date of this entry, and what changed since?
Where do humans stay in control? (terms 17 to 21)
17. Human in the loop: a design where a person must review or approve AI output before it takes effect. PCAOB staff wrote that "human involvement remains essential for auditors and preparers and is needed to review the output from GenAI" (PCAOB staff Spotlight, July 2024).
Auditor asks: who reviewed this, and what did they see when they approved it?
18. Review threshold: the rule that decides which AI outputs need human review, set by amount, account, confidence or risk.
Auditor asks: who set the thresholds, and when were they last reviewed?
19. Review by exception: a workflow where people review only the items that fail a rule or fall outside a threshold.
Auditor asks: how do you know the items that passed were right?
20. Automation bias: the tendency to accept a system's output without enough scrutiny because it came from a system.
Auditor asks: how do you show the reviewer actually checked, rather than clicked approve?
21. Straight-through processing: a transaction handled from start to finish with no human touch.
Auditor asks: which transaction types are allowed to go straight through, and what is the dollar limit?
How will auditors test an AI-assisted process? (terms 22 to 25)
22. IT general controls (ITGCs): the controls over access, program changes and IT operations that make automated controls reliable.
Auditor asks: who can change the AI's rules or model, and how is a change approved and tested?
23. SOC 1 report: an independent auditor's report on a service organization's controls that are relevant to its customers' financial reporting.
Auditor asks: does the vendor have one, what period does it cover, and which complementary user entity controls fall on you? See what to ask an AI vendor about SOC 1.
24. Full-population testing: testing every transaction in a population against a rule, instead of a sample.
Auditor asks: what did the test cover, what did it flag, and how was each flag resolved?
25. Technology-assisted analysis: the PCAOB's term for analyzing information in electronic form with technology-based tools. Its amendments on this topic apply to audits of fiscal years beginning on or after December 15, 2025 (PCAOB).
Auditor asks: is the data the tool used complete and accurate, and how do you know?
Which five questions cover most of these terms?
If you remember nothing else, take these five questions into every AI vendor review or internal walkthrough. Between them they touch almost every term above.
- What went in? Data lineage; grounding; RAG.
- What rule or model ran? Rules engine; model versioning; confidence score.
- Can you rerun it? Replay; deterministic AI; probabilistic output.
- Who checked it? Human in the loop; review threshold; automation bias.
- Is the system controlled? ITGCs; SOC 1 report; audit trail.
Frequently asked questions
What is the difference between deterministic and probabilistic AI in accounting?
Deterministic AI gives the same output every time for the same inputs, rules and version. Probabilistic AI, including most LLMs, can give different outputs on the same input. For accounting, probabilistic output is usable only if the original inputs, output and version are stored so the decision can be shown later.
Is an AI hallucination the same as an error?
Not quite. An error can come from bad data or a wrong rule. A hallucination is content the model generates that has no basis in the source, stated with confidence. Both need controls, but hallucinations need a check that every figure ties to a source record.
Does agentic AI mean no human review?
No. Agentic describes what the system can do, not what it should be allowed to do. You still decide which actions need approval through review thresholds and access controls.
Do auditors accept AI-prepared reconciliations?
Auditors evaluate the evidence, not the tool. A reconciliation an AI prepared is easier to accept when it comes with source data, the rule applied, the reviewer's sign-off and a way to reproduce the result.
What should you do next?
Take the five questions above into your next vendor demo or internal walkthrough of an AI-assisted process, and ask for the evidence, not the description. If the answer to "can you replay it" is no, you have found the gap to close first.
To hear when Yoraito opens up, join the waitlist.