AI audit software for branch reviews: agents check, managers sign

AI audit software, in a branch review, is software in which AI agents gather and test the evidence for each checklist item, from the core banking system, the teller platform, the security system, document imaging and the photographs a manager takes on the walk, and present a verdict with its source for a person to accept or reject. Used well, it does the part of a branch audit that is retrieval and comparison, which is most of it. It cannot do the part that is accountability: the performer's attestation, the reviewer's signature, the closing of a finding and the board report all belong to named people under the rules and under any sound control design. Botminds' Branch Self-Assessment is built on that split. Agents complete the checks that live in systems before the branch opens and read every photo on the walk; the branch manager agrees or disagrees with each verdict; a regional manager who did not perform the review signs it.

The figures below come from a fictional sample credit union as it runs through the solution, Norrell Federal Credit Union with 38 branches, and from its sample fourth-quarter review of one branch, Cedar Hollow. They are sample data, not a customer's results.

What is AI audit software, and what does it do in a branch review?

AI audit software is a tool that applies machine reading and reasoning to audit evidence, so that tests a person would perform by pulling a file, reading a log or comparing two screens are performed by software and handed to a person for judgement. In a branch review the tests are well known. The FDIC's examination procedures for cash ask, among other things, whether the vault is opened and closed under dual control, whether over-and-short records are kept for everyone who handles cash, whether currency shipments are counted under dual control and whether vault cash is recorded by amount and denomination (FDIC RMS Manual, section 22.1). Each of those is a question about a record somewhere in the branch's systems or on its paper.

The difference between AI audit software and the audit management software an institution may already own is where the evidence comes from. Workflow software routes a checklist and stores what a person typed and attached. AI audit software goes and gets the evidence, reads it and says what it found, with the source beside the verdict. That changes the economics of a branch review more than any workflow tool, because in a paper review the hours go into finding and comparing, not into deciding. The difference between the three approaches is set out in audit management software for branch reviews: three ways compared.

What can AI check in a branch review?

AI can check anything whose evidence is a system record or a legible document: file samples against the core, cash and consigned items against the teller platform and general ledger, security system events against the program's requirements, and photographs of logs, count sheets, notices and screens. In the sample credit union's checklist, 42 of the 64 checks fall in that group and are done before the branch opens.

The file samples show the kind of comparison that suits software. Of five new memberships sampled for the customer identification program, one had no ID expiration date in the core while the imaged driver's license showed 03/14/2029, and the customer identification rule requires the record to describe the document relied on, including its expiration date where it has one (31 CFR 1020.220). A person comparing screens would catch that on a good day. An agent catches it on every file in the sample, every quarter, and records which image it compared with which field.

What AI cannot check is anything that needs presence or judgement. It cannot tell whether a count was really performed by two people, only whether two sets of initials appear and whether the security system shows two people in the building. It cannot judge whether a fogged camera is a facilities job or a security exception. And it cannot decide what a finding means for the person whose initials are on the log. Those stay with the branch manager, the regional manager and the security officer.

How does AI read photos of logs?

It transcribes them, then tests the transcription against another source. A photographed vault access log becomes a table of dates, times and initials; the agent applies the rule in the branch's own policy (two employees open the vault and both initial the log) and gives a verdict with a confidence. On its own, that is only a reading of what was written. The value comes from corroboration: in the sample review the Security agent laid alarm, door and badge events beside each opening, so the verdict said not just that 9 October had one set of initials, but that the alarm was disarmed at 7:49 a.m. with one employee's code, the vault door opened at 7:52 and nobody else entered the branch until 8:31.

Handwriting is where a reader can be confidently wrong, so the threshold matters. In the sample configuration the Reading agent cannot pass any step under 85% confidence without a person; the manager sees the agent's version number and confidence on every verdict, and can disagree with a reason code or retake the photo. The agent never edits a photo, and internal audit can open the stored image without the agent's marks to judge it independently. How an agent should behave when it cannot read something, and why asking is worth more than guessing, is the subject of internal audit AI use cases at the branch.

How the agents in Branch Self-Assessment prepared the review: every step versioned, every hand-off named

Who signs a branch self assessment? The line the rules draw

A person who did not perform the review signs it, and the agents sign nothing. The rules do not mention AI, but they leave no doubt about where accountability sits. The Federal Reserve's examination manual, describing the board and senior management's responsibility for internal control, is direct: "This overall responsibility cannot be delegated to anyone else. They may, however, delegate the design, implementation, and monitoring of specific internal controls to lower-level management and delegate the testing and assessment of internal controls to others" (CBEM 4500.1). Testing can be delegated, to a person or to software; responsibility cannot.

The security rules make the same point with names. At a bank, the security officer reports to the board on the program at least annually; at a credit union, the president or managing official certifies compliance with Part 748 every year in the Credit Union Profile (12 CFR 748.1(a)). An agent can draft the report and the certification from a year of branch evidence. It cannot be the officer who reports or the official who certifies.

Examiners also expect a second person on the work itself. Among the FDIC's cash and deposit procedures is a check that a supervisor other than the preparer reviews every general ledger and customer account entry (FDIC RMS Manual, section 22.1, item 48; the same test on cash corrections is in reconciliation software for banks). A branch review is a control over controls, and the same logic applies: the branch manager performs, a regional manager reviews and signs. In the solution the sign button is disabled for the person who performed the review, and a review returned to the branch carries a reason.

The sign-off: performed by the branch manager, signed by someone who did not perform it

Can an AI close an audit finding?

It should not, and in Branch Self-Assessment it cannot. Closing a finding is a judgement that the corrective action worked, and a finding closed on the word of the person who owns it is the weakest kind of evidence. In the solution the owner proposes closure with evidence, the Follow-up agent reads that evidence (in the sample vault exception, it checks eleven signed dual-control attestations against the branch's staff list), and a second person, the regional manager or the security officer, verifies and closes.

The branch version of the risk is quiet: an agent that marks an item passed when the photo was unreadable, and a regional manager who signs because the screen is green. That is why every pass in the solution shows the record it rests on and every exception closes only on a second person's check. The best-known public case of software deciding alone comes from disputes rather than branch review, and is told in how to test AI email triage; the lesson carries: software that decides alone is a control failure waiting for an examiner.

Is AI audit evidence acceptable to examiners?

No rule makes AI-gathered evidence acceptable or unacceptable; examiners judge evidence on what it shows, and AI changes only who gathered it. The GAO's 2025 review of AI in financial services put it plainly: "Federal financial regulators primarily oversee AI using existing laws, regulations, guidance, and risk-based examinations" (GAO-25-107197). We found no statement from the OCC, FDIC, Federal Reserve or NCUA on AI in branch reviews specifically, so the safe reading is that the existing expectations apply in full.

Those expectations are practical. Evidence should be re-performable by someone else, attributable to the person or system that produced it, retained, and complete enough to show what was tested and what was found. A photograph stored with its transcription, the agent version, the confidence, the security system extract and the name of the person who agreed meets that test better than a tick on a paper checklist. Evidence the institution cannot export from a vendor's system does not.

Credit unions have one extra question to ask. The same GAO report found that the NCUA "lacks the authority to examine technology service providers" despite credit unions' increasing reliance on them for AI-driven services. A credit union buying AI audit software therefore carries more of the burden of overseeing the vendor itself, and should insist that every piece of evidence lives where its own examiners and Supervisory Committee can reach it.

What are the risks of AI in a branch audit, and which controls answer them?

The risks are misreading, overreach, leakage and drift, and each has a control a buyer can see in a demonstration. The table pairs them.

Ten questions to ask before buying AI audit software for branches

A demonstration on your own checklist answers more than a feature list. Bring last quarter's checklist and three completed reviews, and ask the vendor to show each of these on them.

What Branch Self-Assessment does as AI audit software, and what it does not

Branch Self-Assessment is AI audit software for one job: the periodic review a branch manager runs of their own branch, signed by someone else and followed to closure. It brings the 42 system checks, the guided photo walk, exceptions with owners and due dates, regional sign-off, re-performance by internal audit and the annual security program report into one place. Our estimate for the sample credit union is that a branch manager's time on one quarterly review falls from about six hours on paper to about two.

It is not an enterprise audit management system. It does not plan internal audit's annual program across the institution, manage SOX or IT audits, or replace the audit committee's tracking of findings from external auditors and examiners. It does not replace internal audit's independent testing either; it gives internal audit better evidence to test. And its connections to a particular core, teller platform or security system are the first things to prove in a pilot on your own branches. How one branch's review runs end to end is told in one branch's quarterly self assessment, start to finish, and the solution is at Branch Self-Assessment.

Questions people ask

Can AI perform a branch audit?

AI can perform most of the tests in a branch audit, the ones whose evidence is a system record or a legible document, but not the audit's judgements or signatures. In the sample credit union's checklist, agents complete 42 of 64 checks before the walk and read the photos for the other 22, while a person decides each verdict and another person signs.

What is the difference between AI audit software and audit management software?

Audit management software routes the work and stores what people record. AI audit software also gathers and tests the evidence itself, reading systems and documents and presenting a verdict with its source. An institution can run both: the audit management system for the internal audit program, AI for the evidence-heavy reviews in branches.

Does AI audit software replace internal audit?

No. A branch self-assessment is management checking its own controls, and the banking agencies expect controls also to be tested by units without business-line responsibilities, such as internal audit. AI strengthens the self-assessment's evidence; internal audit still re-performs steps and reaches its own conclusion, recorded next to the original.

How do you validate an AI audit tool before go-live?

Run it on reviews you have already completed and compare its verdicts with yours, step by step, including the photographs. Look at the steps where it disagreed with you and the ones where it asked rather than decided, and keep the comparison as evidence for internal audit.

Can an AI agent change a member record if it finds an error?

It should not. In Branch Self-Assessment the agent prepares the correction, a member service representative enters it in the core, and the branch manager verifies it against the source document, so two people stand behind every change to a member record.