How Are AI and Machine Learning Transforming Recovery Auditing?

In brief: AI and machine learning are ending the needle-in-a-haystack era of auditing. Instead of manually reviewing thousands of flagged exceptions, auditors now work from ML scores trained on years of audited decisions, focusing on the claims most likely to be valid. The result: fewer false positives, dramatically faster audits, and human judgment applied where it matters most.

Why has auditing always been a needle-in-a-haystack problem?

Because the volume of transactions has always outrun the people reviewing them. Early auditors sifted paper deal sheets by hand; computers organized the haystack and analytics narrowed it, but auditors were still left combing through thousands of flagged transactions buried under false positives.

For decades, auditing has been like searching for a needle in a haystack. Early auditors sifted through stacks of paper deal sheets manually, combing through endless records to catch errors, fraud, or duplicate payments. Then came computers, bringing spreadsheets and databases that made the haystack more organized, but still massive.

Data analytics helped narrow the search, allowing auditors to filter and sort transactions more efficiently. They could see everything they needed on one screen. But even with these advances, auditors still had to sift through thousands of flagged transactions, often buried under false positives.

Now, machine learning and AI are changing the game. Instead of merely organizing the haystack, AI helps auditors zero in on the needle: flagging the most relevant risks, reducing false positives, and letting auditors focus on real potential.

How does machine learning turn auditor intuition into a score?

By training on the past. SAS’s model learns from years of audited data: it takes a potential exception, compares its key attributes to thousands of similar historical cases, checks how often comparable claims were pursued, and assigns a probability score. Auditor instinct, encoded.

Our auditing process begins by running client data through a routine that generates a large list of potential exceptions. Auditors review the results vendor by vendor, deal by deal, making decisions quickly. The sheer volume means thousands of decisions, with only a few leading to significant findings.

Over the years we streamlined the front end and filtered out as many false positives as logic allowed. But auditors often mention a certain feel they get when evaluating a possible claim: an instinct developed through experience that isn’t easily codified into a simple rule. That question, how to translate intuition into something a machine can use, led us to build our machine learning solution.

In simple terms, the system learns from past decisions to create a pseudo-function for auditing. The model takes a potential exception as input and scores how likely it is to be a valid claim by analyzing key factors in the new data, comparing them to similar cases in the audited data, and determining how often similar claims were pursued in the past. It repeats this thousands of times with different factors, then averages the probabilities so auditors can focus on the most promising leads.

What difference does AI-driven prioritization actually make?

In SAS’s internal duplicate payment audit data, auditors confirmed 26.4% of exceptions scored above 60% as valid claims, compared with 1.26% of all reviewed exceptions. Setting aside exceptions scored 10% or below removes 297,316 items, about 90% of the unreviewed queue. At about a minute per exception, one auditor using the ML score can confirm as many claims in a day as a team of four confirms in just over a week.

Source: SAS internal duplicate payment audit data. Full totals where the image cuts them off: Not Assigned 330,636; Void 303,149; Totals 644,077.

The chart above shows the real-world effect of the machine learning score (SAS internal audit data). Every exception an auditor reviews ends in one of two outcomes: Claimed, meaning a confirmed duplicate payment, or Void, meaning it was ruled out. The retention rate is the number claimed divided by the number reviewed (claimed plus void). Across all scores, auditors reviewed 307,009 exceptions and claimed 3,860, a retention rate of 1.26%. For dupes scored above 60%, the four rows outlined in red, they reviewed 4,267 and claimed 1,127, a retention rate of 26.4%. That works out to one claim for every 4 high-scoring items reviewed and one for every 80 items across all scores.

The chart also shows 330,636 exceptions that no auditor has reviewed yet (the Not Assigned column). Of those, 297,316 scored 10% or below. Reviewed exceptions in that score range became claims 0.5% of the time. Setting them aside leaves 33,320 items in the queue, about one-tenth of the original.

If an auditor takes about a minute to assess a dupe, one auditor can review about 480 in an eight-hour day. At the 26.4% retention rate, that day produces about 127 claims. Finding 127 claims at the 1.26% rate means reviewing about 10,100 exceptions, or 168 hours of work, which would take a team of four just over a week.

Will AI replace auditors?

No. The industry consensus and SAS’s experience agree: AI expands coverage to 100% of the population and strips out noise, but the reliability of anomaly detection still depends on parameters set by experienced auditors, and judgment on every claim remains human.

As Alan Anderson, CPA, told the Journal of Accountancy, traditional sampling means “you’re trying to find a needle in a haystack,” while “AI can give you 100% of the population, which makes anomaly detection extremely reliable when it’s based on proper parameters set by the auditors.” Academic research points the same way: a continual-learning approach to anomaly detection can reduce false-positive alerts and false-negative decisions in financial accounting data (Hemati, Schreyer & Borth, AAAI 2022 Workshop).

Since this post was first drafted, much of the audit and AP software industry has gone “agentic”: KPMG’s 2026 global survey found 75% of senior finance leaders actively using AI in the finance function, up from 30% two years earlier, with agentic adopters reporting a 32-point advantage in finance improvements (Journal of Accountancy, May 2026). SAS has deliberately drawn the line differently: our models score, our auditors decide. As KPMG’s U.S. audit vice chair put it, “the auditor of the future will have to both audit financial statements and provide assurance over the AI systems that help produce them.” In an era when agents approve invoices and clear exception queues on their own, the question for every finance leader is simple: who audits the agents?

We also predicted, in the first version of this post, that AI’s next step would be contextual explanations and data enrichment layered on top of scoring. The industry has since moved toward agentic AI, which Wolters Kluwer defines as advanced systems that use AI agents to perceive context, reason, and act independently. Our roadmap is unchanged: standardized, reusable models across clients and audit types that grow more accurate as data flows in, with explanations and enrichment layered on top.

The bottom line

AI and machine learning in auditing are not about replacing auditors. They’re about giving auditors better tools: filtering out noise, highlighting the most relevant risks, and shifting expert attention from sorting data to making strategic, high-impact decisions.

At SAS, our experienced auditors and our machine learning work as one system: the auditors’ decisions train the models, and the models multiply the auditors’ reach, helping clients discover, recover, and protect their revenue. To see what that looks like on your AP data, please fill out our contact form.

---

Quick Reference

AI and machine learning in recovery auditing at a glance

Topic	Key point
What it is	Machine learning models trained on years of audited decisions that score each flagged exception by its probability of being a valid claim.
Who it helps	Recovery audit teams and the finance leaders whose AP data they audit.
Why it matters	Hundreds of thousands of flagged exceptions hide a small share of real claims; setting aside the lowest scores removes about 90% of the unreviewed queue (SAS internal data).
The 2026 shift	Auditor intuition, once impossible to codify, is now captured from historical audit decisions and applied at machine scale.
The catch	A replacement for auditors: humans set the parameters, review the scores, and make every claim decision.
Bottom line	AI finds the needles; auditors decide which ones matter.

Frequently asked questions

What is machine learning in recovery auditing?

Machine learning is a branch of AI that learns patterns from data instead of following hand-written rules. In recovery auditing, a model trains on years of past audited exceptions and the decisions auditors made about them, then scores each new potential exception by how likely it is to be a valid claim.

How does an ML score reduce false positives in an AP audit?

The model compares each flagged exception to thousands of similar historical cases and calculates how often comparable claims were pursued. Auditors sort by that score and work the high-probability items first, so low-value false positives are deprioritized or skipped instead of consuming days of manual review.

Does AI replace auditors in a recovery audit?

No. AI filters noise and prioritizes leads; auditors still review the scored data and decide what to pursue. Full-population analysis makes anomaly detection more reliable, but it depends on parameters set by experienced auditors, and final judgment on every claim remains human.

How much faster is an AI-assisted duplicate payment audit?

In SAS’s internal duplicate payment audit data, auditors confirmed 26.4% of exceptions scored above 60% as valid claims, compared with 1.26% across all scores. At about a minute per exception, one auditor using the ML score can confirm as many claims in a day as a team of four confirms in just over a week.

What data is used to train an audit machine learning model?

Historical audit results: the exceptions generated on past engagements, the key attributes of each, and whether experienced auditors ultimately pursued them as claims. That accumulated decision history, once an untapped byproduct of audit work, becomes the training set that encodes auditor intuition.

Can machine learning be used beyond duplicate payment audits?

Yes. The same scoring approach extends to other audit types, and the goal is standardized, reusable models across clients. As more audited data flows in, accuracy improves. AI layers can then add context, such as explaining why an exception scored high or enriching it with vendor history.

What is the difference between agentic AI and machine learning scoring in an audit?

Machine learning scoring is decision support: the model ranks exceptions by claim probability and a human auditor reviews and decides. Agentic AI goes further, taking actions autonomously, such as resolving exceptions or answering vendor queries. SAS deliberately uses scoring, keeping expert human judgment on every claim while automation handles the noise.

Glossary

Recovery audit — An independent review of AP and procurement transaction data to find and recover payment errors and identify their root causes.

Duplicate payment — The same invoice paid more than once, typically through data entry variations, vendor master duplicates, or system gaps.

Exception — A transaction flagged by audit routines as a potential error or claim, pending human review.

False positive — A flagged exception that turns out not to be a valid claim.

Machine learning (ML) — A branch of AI in which systems learn patterns from data and make predictions without being explicitly programmed.

Retention rate — The share of reviewed exceptions that auditors confirm as valid claims: claimed divided by claimed plus void.

Full-population testing — Analyzing 100% of transactions rather than a sample, made practical by AI-driven analysis.

Agentic AI — AI systems that act autonomously on tasks, such as resolving exceptions or answering vendor queries, rather than only flagging or scoring them for human review.

Sources

Journal of Accountancy / AICPA — “What AI Can Do for Auditors” (February 2024)

Full-population anomaly detection versus sampling; AI as a tool that enhances rather than replaces auditors. https://www.journalofaccountancy.com/issues/2024/feb/what-ai-can-do-for-auditors/

Hemati, Schreyer & Borth — “Continual Learning for Unsupervised Anomaly Detection in Continuous Auditing of Financial Accounting Data” (AAAI 2022 Workshop)

Research evidence that ML anomaly detection can reduce false-positive alerts and false-negative decisions. https://arxiv.org/abs/2112.13215

Journal of Accountancy / AICPA — “AI for CPAs: From Efficiency Tool to Decision Engine” (May 2026)

KPMG survey data on AI and agentic AI adoption in finance, and the assurance-over-AI-systems quote. https://www.journalofaccountancy.com/news/2026/may/ai-for-cpas-from-efficiency-tool-to-decision-engine/

Wolters Kluwer — “How AI Agents and Agentic AI Are Redefining Tax and Audit” (2025)

Definition of agentic AI, and adoption context. https://www.wolterskluwer.com/en/expert-insights/how-ai-agents-and-agentic-ai-are-redefining-tax-and-audit

Note: all performance figures (claim rates, retention rates by score, exception-volume reductions, and time savings) are drawn from Strategic Audit Solutions’ internal duplicate payment audit data.