Audit season is a scramble for the same reason every year. The evidence exists, but it's scattered. The reconciliation is in a spreadsheet, the support is in someone's email, the explanation for the variance is in the head of a person who's on vacation, and the auditor's question arrives on a Friday. Most of the scramble is assembly, not analysis.
The Audit and Assurance category in my NetSuite AI Prompt Library has fourteen prompts, and I've split them across two posts. This one covers the six that are about preparation and investigation: auditing reconciliations, answering auditor questions, investigating the audit trail, preparing workpapers, generating compliance checklists, and analyzing compliance gaps.
If you're new to the library, it's a set of 150 prompts for NetSuite finance work that I released in January. Each one is a structured system prompt that you paste into Claude or ChatGPT along with your NetSuite data, and it turns the model into a specific kind of analyst with a defined method, a required output, and rules about what it's not allowed to make up.
Account Reconciliation Auditor
This prompt casts the model as a senior financial auditor whose job is to verify balances rather than prepare them. It works through the balance sheet by account class, matching the general ledger to the subledger for receivables and payables, checking bank reconciliation status and aged uncleared items, and running a variance analysis across balance sheet accounts. Five SuiteQL queries ship with it, one for each of those.
The risk model is simple and it's the right one: a large variance with aged items gets full testing, a moderate variance gets a targeted review, and an immaterial one gets analytical review only. The output is a reconciliation status by account, a list of reconciling items with age, and an assessment of the reconciliation process itself, which auditors care about more than most preparers realize.
Audit Question Responder
This is a writing prompt, and it's one of the ones in the library that I use most. The model becomes a controller who has managed external audits for years, and its job is to draft responses to auditor inquiries, PBC requests, and confirmations. The framework classifies the request first: routine, substantive, control-related, judgment and estimate, or sensitive. Each class gets a different response strategy, because a question about a related party is not answered the way a question about a policy is.
The deliverable is a response package: the draft response, an index of the supporting documentation, and internal review notes that flag where the answer needs a decision from a person. The prompt is explicit that it drafts and doesn't send. Language that affects the company's position goes to a human before it goes to an auditor.
Audit Trail Investigator
This is the forensic prompt in the group. The model becomes a forensic accounting investigator and works through six blocks: transaction history, user activity, change analysis, anomaly detection, relationship mapping, and evidence assembly. Its queries read the system notes for a record's modification history, summarize user activity by type and time of day, screen for round amounts and after-hours and weekend entry, look for sequential duplicates, and review dormant user accounts that still have activity.
The thresholds are about patterns rather than single events. Occasional after-hours activity is low risk, a pattern is medium, and extensive after-hours activity is high. Round amounts under 5% of transactions are low risk and over 15% are high. An undocumented override is medium, and a repeated one is high. And the prompt is careful about attribution: the user id on a record is treated as an assumption to be verified, not a fact.
Audit Workpaper Preparer
Where the reconciliation auditor verifies, this one prepares. The model becomes a staff accountant with a decade of audit support behind it, and the deliverable is a workpaper with a proper header, a balance summary that ties to the schedule, a roll-forward from the prior audited balance through additions and disposals to the ending balance, assertion coverage for existence, completeness, valuation, rights, and presentation, and a conclusion with sign-off lines. It's the document the auditor wants to receive on day one.
Compliance Checklist Generator
The compliance checklist prompt builds a calendar. The model becomes a compliance manager and generates a checklist tailored to the entity's type and jurisdictions: financial reporting, tax, statutory filings, SOX and internal controls, and regulatory requirements, each with an owner, a deadline, and the evidence that proves it was done. The output is a master checklist, a calendar view, evidence requirements, and a certification form for management to sign. It's a framework prompt rather than a data prompt, and its value is in not forgetting anything.
Compliance Gap Analyzer
The gap analyzer is the data-driven companion to the checklist. The model becomes a compliance officer and tests the account against requirements it can actually check from NetSuite: revenue recognition compliance, tax setup, period close discipline, vendor 1099 readiness, and document retention. Five queries, one per area. Gaps are rated critical, high, or medium, and the output is a remediation plan with a monitoring framework so that the gap stays closed. Like everything in this category, the ratings are evidence for a person's judgment, not a substitute for it.
Who They're For
Controllers and accounting managers heading into an audit. Internal audit teams who want a consistent way to test. And consultants who get called in to get a NetSuite account audit-ready and need to know where to start. All six are in the NetSuite AI Prompt Library, under Audit and Assurance. The second post in this pair covers the other six: control documentation, cutoff testing, journal entry testing, management assertions, reconciliation documentation, and sample selection.
Update, September 2026
I ran the Audit Trail Investigator prompt from this group against one of my NetSuite test accounts, with the queries executed through Chartstone and the analysis done by Claude, and formatted the report to one of my branding guidelines. Here's what it found.
The account holds 2.09 million system notes, so the first thing the run did was scope: posting transactions from the trailing twelve months, 3,361 of them, plus the system notes and login events for the same window. And then it found the thing that reframes everything else. The entire year of transaction history was entered between September 2 and September 30, 2026. Eighty-three percent of the documents were created more than 30 days after their transaction date, the median gap was 125 days, and 172 documents were created before the date they carry.
That's a bulk load, and the report says so plainly. The after-hours rate is 53% and the weekend rate is 37%, which under the prompt's thresholds would be extensive and high risk. The report explains instead that the hour histogram shows a script running in sessions at five in the morning and four in the afternoon, and that the patterns describe the load, not the business. I'd rather have a prompt that knows when its own thresholds don't apply than one that fires on everything.
Two findings survived the caveat. Ninety-eight percent of the documents have no creator, so attribution rests entirely on the system notes, which point to a Suitelet run by the account owner. And the duplicate screen found 45 candidate pairs, two of which are same-day duplicates worth a look: two invoices to the same customer for $16,884 on August 27, and two payments from the same customer for $934.78 on August 31. It also caught eight creation timestamps dated in October, after the run itself, and flagged the timestamp field as unreliable. The verification section shows two failed tests, which is the honest answer.
You can read the full report here: Audit Trail Investigation. The names and numbers are test data.