Productive but Not Fully Trustworthy: The Auditability of Information Systems in the Age of Probabilistic Generative AI

Abstract

Generative AI is increasingly embedded in organisational information systems, yet its productivity value raises a difficult audit problem. Model-assisted tools can accelerate document work, coding support, service responses, and administrative review, but their probabilistic outputs do not follow the stable procedural logic assumed in conventional audit trails. This study examines how Generative AI affects auditability once generated responses become part of organisational workflows. A directed literature review and qualitative content analysis were conducted on academic studies, technical guidance, and AI governance standards related to Generative AI, information systems, risk management, LLM security, and auditability. The analysis indicates that audit weakness appears less as a single technical defect than as a reconstruction problem across prompt, data, model, output, decision, and oversight conditions. Based on this finding, the study develops the Generative AI Auditability Stack, a conceptual framework that treats auditability as a distributed property of GenAI-based information systems. The framework clarifies why transparency and explainability alone are insufficient for model-assisted work, especially where proprietary systems limit internal visibility. Organisations can still strengthen reviewability by preserving prompt records, data lineage, model versioning, validation traces, and decision evidence across the lifecycle of use. The study contributes to information systems research by shifting the debate from adoption and productivity toward the auditability of probabilistic systems in organisational settings.