AI Cost Questions Auditors Ask: What Evidence Regulated Enterprises Need

Why cost questions become evidence questions

When an examiner asks about AI spend, the underlying question is rarely about the amount. It is about accountability: what was the organization paying for, who authorized it, what was it allowed to do, and what did it do. Cost is the entry point to a broader request for substantiation.

Published frameworks point the same way. NIST AI RMF MAP 3.2 expects potential costs, including non-monetary costs, resulting from expected or realized AI errors or from system functionality and trustworthiness, to be examined and documented against organizational risk tolerance. That places cost documentation inside risk governance, not only finance. A CRS report notes that AI adoption carries ongoing operating costs such as licensing or service fees, and records that an SEC AI roundtable in May 2025 covered AI benefits, costs and uses, fraud and cybersecurity, and governance and risk management. Examiners are considering cost alongside governance.

The EU AI Act requires a risk management system to be established, implemented, documented and maintained for high-risk AI systems. The NYDFS industry letter on AI-related cybersecurity risk emphasizes robust access controls and notes that, as of November 2025, the Cybersecurity Regulation requires MFA for all Authorized Users, including employees, contractors and TPSPs. Neither is a spend rule, but both assume the organization can show who accessed AI and under what controls.

The five categories below are a practical way to organize the questions. They are an editorial framework, not a list of regulatory requirements, and the objective is substantiation, not cost reduction.

Usage, attribution, authorization, and policy questions

Usage and attribution questions ask which models, agents, and tools were used, by whom, and for what purpose. The evidence is a record per interaction or tool call that names the user or system identity, the model or agent, the tool invoked, and a timestamp. Invoices and cloud billing exports usually aggregate by account, project, or API key. They show that spend occurred but not which person, agent, or workflow drove it, so attribution has to be reconstructed. Reconstruction is slow and hard to defend when an examiner probes a specific event.

Authorization and policy questions ask what the AI was permitted to do and who approved it. Here the evidence has two parts. The first is approval records for each AI tool and agent, showing who approved, when, and for what scope. The second is policy decision records showing which policy applied to a given action and what the outcome was: allowed, redacted, blocked, or escalated to a person. A policy document alone shows intent. A decision record tied to the action shows enforcement.

The gap between the two is the most common weakness. Finance can show spend and security can show a policy, but neither can show that a specific policy version governed a specific interaction. Access control evidence matters here too, particularly for contractors and third-party service providers who use AI tools, which the NYDFS letter highlights.

Third-party exposure, retention and residency, and consistency of records

Third-party questions ask which AI services the organization depends on and what it can demonstrate without the vendor. The Commission's 2021 impact assessment for the AI Act proposal assumed that AI users would mostly rely on in-built functions such as use logs installed by providers. That was a planning assumption, not a statement of what an examiner accepts. An organization that depends only on vendor logs has limited control over what is recorded, how long it is kept, and whether it can be produced on request. Separate what you hold independently from what you can only request.

Retention and residency questions ask how long AI usage and policy decision records are kept, where they are stored, and who attests to those settings. Evidence includes documented retention settings, storage location, and access controls over the records themselves. A retention period that exists only in a policy, with no mechanism applying it to AI records, will not satisfy a follow-up question.

Consistency questions ask whether spend, usage, and policy records agree. If finance reports one set of AI vendors and the usage records show others, or if approvals exist for tools with no matching activity, the examiner will treat the inconsistency as a control finding. Reconciliation across finance, security, and compliance records should be possible before the request arrives. US federal proposals on third-party audits of AI tools and AI impact assessments remain proposals, not enacted obligations, so they should inform planning but not be presented as requirements.

Evidence captured in the execution path versus reconstructed afterward

There are two ways to produce the records above. One is to reconstruct them after the fact from billing exports, vendor logs, and policy documents. The other is to capture them when the action occurs. Reconstruction depends on joining sources that were not designed to align, and it can show spend without showing which policy governed an action. Capture at the time of the action can record the policy decision itself, which is the link auditors look for between permission and activity.

Trussed takes the second approach. It enforces policy in the execution path across models, agents, tools, MCP servers, AI sites, and coding assistants, with actions to allow, redact, block, rate limit, or escalate for human approval at the level of individual interactions and tool calls. Policy is enforced at runtime, not reviewed after the fact, and that enforcement generates audit-ready evidence mapped to frameworks including NIST, NYDFS, NAIC, HIPAA, and the EU AI Act. It can be deployed self-managed in the customer cloud, with configurable retention and data residency.

The approach has limits that are worth stating. It supplies policy-linked evidence of interactions and tool calls, but it does not replace finance's reconciliation of invoices, nor the approval workflows an organization must define for itself. Treat it as one source of evidence that should reconcile with the others.