What Evidence Should Bankers Keep to Audit an AI-Assisted Deal Deliverable?

Start with the reviewer’s reconstruction question

An audit-ready file answers a simple question: how did this sentence, number, chart, or recommendation get into the deliverable? The reviewer should be able to move backward from the final file to the source record, the analyst’s reasoning, any AI assistance, the corrections made, and the human decision to release it. That does not require saving every exploratory prompt or creating a duplicate data room. It requires a deliberate chain of evidence for material content.

Define the review boundary before work starts. For a buyer list, the boundary may include the approved company description, inclusion criteria, source dates, and human acceptance of each proposed entry. For a confidential information memorandum, it may include the financial workbook, management-approved facts, draft history, and sign-off on disclosures. The accountable deal team member should state what is in scope and what is not, rather than leaving a later reviewer to guess.

Keep a source register, not just a final attachment

The source register is the foundation of provenance. Give each source a stable identifier and record its title, origin, retrieval or received date, version, relevant page or cell, authority level, and confidentiality status. For a company-provided workbook, retain the file name and version alongside the relevant worksheet and range. For a public filing, record the issuer, filing date, document type, and locator. For an interview note, record who supplied the information, when it was received, and whether it was confirmed.

Use the source-of-truth designation explicitly. If revenue in a draft comes from management’s latest workbook while a public filing contains an older period, the record should show both and explain which one supports the current statement. Do not silently merge figures with different periods, definitions, currencies, or adjustment bases. A source register also helps limit confidential duplication because the working paper can point to an authorized repository instead of copying the entire document into every AI or drafting folder.

Capture the draft and instruction trail

Save meaningful versions of the deliverable, not only the final PDF. A useful version label includes the date, stage, and owner, such as initial draft, fact-checked draft, client-review draft, or approved release. Keep a short change note for each material transition. If a reviewer sees a claim disappear, a number change, or a risk factor added, the change note should identify why and point to the supporting source or decision.

When AI is used, record the actual task instruction in enough detail for a reviewer to understand the intended operation. Include the tool or model name and version when the interface exposes it, the date of use, the input category, and the output’s role in the workflow. A concise prompt record is usually more useful than an unstructured transcript. Do not assume that rerunning the same instruction will reproduce identical text. Model updates, hidden context, retrieval changes, and stochastic generation can alter the result, so the retained output and the human review record matter more than a claim of repeatability.

Separate AI assistance from authorship and approval. A tool may summarize an authorized source, suggest headings, extract fields, or flag inconsistent wording. It should not be treated as the person who verified the underlying fact or authorized a disclosure. The record should name the accountable human role, such as deal lead, financial-model reviewer, or compliance reviewer, without exposing unnecessary personal information in a public-facing archive.

Log material corrections and rejected output

A correction log should focus on changes that could affect a reader’s understanding or a decision. Record the original statement or output category, the correction, the reason, the supporting source, and the person who made or checked the change. Typical entries include a period mismatch, a duplicated customer, an unsupported market assertion, a formula error, an omitted qualification, or a confidentiality restriction. The log need not preserve every spelling correction.

Rejected output is also useful when it explains a material control. Note when an AI suggestion was discarded because the source could not be verified, the wording overstated certainty, the input was outside the approved confidentiality boundary, or the requested task crossed into an unapproved action. This turns a vague statement that ‘a human reviewed it’ into evidence of what the review actually tested. It also prevents a later team member from reintroducing an output that had already failed a stated check.

Attach checks to the type of deliverable

The evidence should reflect the risk of the task. For a financial summary, reconcile each material figure to the source workbook or filing, check period and unit labels, and preserve the calculation basis. For a market map or buyer screen, record the inclusion rule, source date, duplicate handling, and human decision on borderline entries. For narrative sections, verify names, ownership descriptions, transaction facts, and statements that could be read as forecasts or assurances.

Use stopping conditions before an AI-assisted task begins. Stop and escalate when a source is missing, a permission is unclear, a material number cannot be reconciled, the model produces conflicting answers, or the output would require an unapproved disclosure. A pilot should end rather than expand when reviewers cannot trace material claims, when correction rates are not understood for the task, or when the team cannot keep confidential inputs within its approved environment. These are workflow controls, not claims that any tool guarantees accuracy, security, or compliance.

Control confidentiality and permissions

Before sending information to an AI tool, classify the input and confirm that the intended use is permitted by the engagement, the firm’s policy, and any applicable contract. Prefer the minimum information needed for the task. Remove names, account identifiers, and irrelevant personal data when they are not required. Record whether the tool was approved for confidential material, whether retention or training settings were checked, and who authorized the selected boundary. If those facts are unavailable, do not treat the tool as approved by default.

Keep the provenance record itself access-controlled. It may contain source locations, internal comments, or explanations of rejected output that are more sensitive than the final deliverable. Retention should follow the firm’s records policy and applicable engagement requirements. FINRA’s guidance says its existing obligations continue to apply when member firms use GenAI and points to technology governance, privacy and integrity, reliability, and accuracy considerations [2]. That is a reminder to map the workflow to the firm’s actual status and use case, not a universal rule for every boutique adviser or transaction.

Make human approval specific and evidenced

A useful approval record states what was reviewed, against which sources or checklist, what exceptions remain, and whether the reviewer authorized the next step. ‘Reviewed’ alone is too vague. A stronger entry might say that the deal lead checked the financial summary against the approved workbook, the compliance reviewer checked the identified public communications, and the client-facing draft remains subject to management confirmation of two open facts. The reviewer’s authority should match the decision being recorded.

For firms subject to FINRA rules, the exact supervisory and recordkeeping obligations depend on the firm and activity. FINRA Rule 3110 includes written supervisory procedures and requires certain investment-banking transaction and communication reviews to be evidenced in writing [3]. FINRA’s notice also says firms should evaluate GenAI tools before deployment and maintain a supervisory system tailored to the business [2]. Other firms should consult their own policies and qualified counsel rather than importing a rule designed for a different regulatory perimeter.

NIST’s GenAI profile is a voluntary, cross-sector resource rather than a legal safe harbor. It frames trustworthy AI as a lifecycle concern involving design, development, use, and evaluation [1]. For a deal team, the practical translation is to assign ownership at each stage, record the evidence needed for later evaluation, and revisit the workflow when the task, tool, or source environment changes.

Use a compact provenance checklist

Before release, the workflow owner can ask: Is every material claim linked to an identified source or calculation? Are source versions and retrieval dates clear? Is the AI task, tool identifier where available, and output role recorded? Are material corrections and rejected suggestions explained? Are permissions and confidentiality choices documented? Is there a named human reviewer with authority for the approval? Are open issues, stopping conditions, and next actions visible? Does the retained record fit the firm’s lifecycle and access policy?

The checklist should be short enough to use consistently and specific enough to produce evidence. Store it with the deliverable’s review record, not as a detached policy that nobody completes. If a required field is unavailable, mark it as unavailable and state the consequence. A visible gap is more useful than a fabricated model version, an assumed approval, or a claim that a source was checked when it was not.

What the record proves, and what it does not

A provenance record can show the basis for a deliverable, the controls applied, and the human decisions made. It can help a reviewer reproduce the reasoning path even when the AI output itself cannot be regenerated. It cannot prove that every statement is correct merely because a prompt and approval are present. It cannot create privilege, waive a confidentiality obligation, or replace a firm’s legal, regulatory, records-management, or information-security requirements.

Acquivo is a software platform that delivers the entire sell-side M&A process, valuation, marketing materials, buyer matching, and deal management, on one platform for business owners, M&A attorneys, and boutique investment banks. In practice, the user-operated workflow still needs an accountable owner to choose permitted sources, check AI-assisted work, record corrections, and approve the deliverable. The implementation outcome is a provenance checklist and review record that links sources, AI assistance, and human decisions without duplicating more confidential material than the retention policy requires.