AI has collapsed the cost of faking your supplier audit

Generative AI has collapsed what researchers call the "filter of effort" that once kept audit fraud rare: fabricating convincing supplier evidence used to demand skill, time and money, and now it demands a prompt. That's the core warning from Cory Searcy of Toronto Metropolitan University and Pavel Castka of Xi'an Jiaotong-Liverpool University, who argue that supply chain audits face a structural trust problem that existing guidance, mostly written for financial audits, doesn't cover.

What exactly is broken?

A supply chain audit runs as a chain of evidence: sampling, inspection, review, attestation, surveillance. AI can attack any link, and — this is the nasty part — generate many pieces of evidence that appear to corroborate one another. A supplier faking organic cotton, as documented in India by GOTS, once had to manually forge transactions and patiently build a fraudulent verification channel. Now the same scaffold can be assembled quickly and cheaply.

The problem isn't hypothetical, and it isn't entirely new. Kobe Steel falsified product quality data for nearly five decades before being caught in 2017 — no AI required. What AI changes is scale and accessibility. AppZen, an expense-auditing firm, has already flagged AI-generated receipts feeding expense fraud. Different domain, same vulnerability: plausible documents for transactions that never happened.

The vulnerabilities cut across all four evidence types:

• Documentary — the clearest weak point; AI rapidly constructs plausible records.
• Visual — photos and video, long treated as proof of physical reality, can now be generated or altered; provenance via metadata, geolocation, timestamps and physical inspection matters more than ever.
• Testimonial — deepfakes have already been used in business fraud (Arup lost $25 million to a deepfake video scam in Hong Kong), and real-time AI coaching can guide interviewees. Not yet documented in an audit context, but the technology is sitting right there.
• Physical — sensors can be compromised and measurements selectively reported, though physical evidence gathered independently of a supplier's own systems remains harder to fake at scale.

Why matching paperwork no longer proves anything

Here the authors land their sharpest point. Internal consistency does not establish independence. Records generated or held by a single party may agree with each other perfectly while the underlying claim is false. The old auditor's question — does this evidence look credible? — no longer works, because generative AI can produce a complete, internally consistent evidence chain that is partly or wholly fabricated.

Auditors, they write, must stop conflating four distinct things: where evidence came from (origin), whether it's been altered (integrity), who stands behind it (identity), and whether what it represents actually happened (truth). No single source of evidence, however convincing, should stand alone.

What does this change for shippers and audit programs in practice? Verification has to reach the source. External confirmations with third parties, unannounced visits, independently recruited worker interviews without management present, backed by identity and location checks. It's the journalist's method, oddly enough: trace the claim to its origin and deliberately hunt for disconfirming evidence.

A note of proportion: unusual metadata or excessive uniformity warrant investigation, but don't by themselves prove fraud. AI also has legitimate uses — summarizing meetings, analyzing data. Suspicion is a trigger for inquiry, not a verdict.

The cost squeeze makes it worse

Since COVID-19, senior supply chain leaders have faced pressure to cut audit costs, pushing programs toward remote and hybrid audits. That runs directly against the fix, because on-the-ground verification and manual evidence review are expensive. The authors' own research on remote auditing technologies aims to strengthen exactly the independent physical evidence that travels poorly.

Their prescription for leadership: banned AI uses, evidence-retention and disclosure rules, enhanced procedures for high-risk claims, and consistent escalation pathways — properly resourced, not just written down. ISO has already produced guidelines for auditing in AI-driven environments plus auditor competency standards, and Castka, a two-decade ISO committee veteran, suggests leaders issue supply-chain-wide guidance on what counts as trustworthy evidence rather than leaving individual auditors to improvise case by case.

The underlying question hasn't changed: can supplier claims be trusted? AI didn't create the motivation to deceive. It just armed more people, more cheaply. As the gap between forged and genuine evidence narrows, audits built on robust verification at the source are the only route back to trust.