# Turning firm knowledge into a competitive AI asset
A senior manager at a mid-sized accounting firm retires. With them goes the memory of how the firm handled a tricky revenue recognition issue for a SaaS client in 2019, where the working papers live, and which partner signed off. That knowledge was never written down in a findable place. It walked out the door.
Now multiply that by every departure over twenty years. This is the hidden cost of scattered knowledge, and it is exactly what a well-built internal AI system can recover.
Most professional services firms are not short on knowledge. They are drowning in it. Decades of engagement files, memos, tax positions, audit workpapers, and client correspondence sit across shared drives, email inboxes, a document management system (DMS: the software that stores and versions client files), and people's heads.
The problem is retrieval. A first-year associate researching a lease accounting question cannot easily find the three prior engagements where the firm already solved something similar.
AI changes the economics of retrieval. A well-governed system lets that associate ask a plain-language question and get an answer grounded in the firm's own prior work, with citations back to the source files.
But "well-governed" is doing heavy lifting in that sentence. Get the guardrails wrong and you leak confidential client data, breach professional obligations, or feed the model garbage and get confident nonsense back.
The dominant pattern here is called RAG (Retrieval-Augmented Generation). Instead of asking a general AI model to answer from memory, you first retrieve relevant passages from your own documents, then hand those passages to the model and ask it to answer using only that material.
Think of it as an open-book exam. The AI is not recalling from training. It is reading your firm's files in real time and summarizing.
Here is the flow in five steps:
1. Ingest: pull documents from the DMS, shared drives, and approved sources.
2. Chunk and embed: split documents into passages and convert each into a numerical fingerprint (an "embeddingembeddingAn embedding is a numerical vector that represents data (text, images, or items) in a way that captures meaning, so similar items sit close together in space.Voir la définition complète →") that captures meaning.
3. Store: put those embeddings in a vector databasevector databaseA vector database stores data as high-dimensional numeric vectors (embeddings) and retrieves items by similarity rather than exact matches, powering semantic search and AI applications.Voir la définition complète → that can search by meaning, not just keywords.
4. Retrieve: when a user asks a question, find the most relevant passages.
5. Generate: the model answers using the retrieved passages and cites them.
A simplified retrieval step looks like this:
# User asks a question; system finds relevant firm documents
query = "How did we handle SaaS revenue recognition under ASC 606?"
results = vector_db.search(
query_embedding=embed(query),
top_k=5,
filters={"practice_area": "audit", "user_clearance": "manager"}
)
answer = llm.generate(question=query, context=results, cite_sources=True)Notice the filters line. That single parameter is where permissioning lives. It decides which documents a given user is even allowed to retrieve. More on that below.
For a clear, non-technical walkthrough of this architecture:
An AI system inherits the quality of what you feed it. Professional services firms have three specific hygiene problems.
Superseded versions. Your drives hold draft 1 through draft 14 of the same memo. If the system retrieves an outdated draft with a position the firm later reversed, the associate gets wrong guidance. Fix: ingest only final, signed-off versions, and tag documents with status.
Client-specific advice masquerading as general. A tax position that was correct for one client's facts can be wrong for another. The system must present prior work as "here is what we did for a similar situation," not "here is the rule." MetadataMetadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition). (data describing the document, such as client, date, jurisdiction, practice area) makes this distinction possible.
Stale regulation. A 2018 memo may cite a standard that has since changed. Tag documents with dates and flag anything referencing superseded guidance.
The practical rule: curate a governed knowledge base, do not point AI at the whole file server. A smaller, clean, well-tagged corpus beats a giant messy one every time.
The NIST AI Risk Management Framework is a free, widely used reference for thinking through data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.Voir la définition complète → and risk in AI systems. It is worth skimming before any deployment.
This is where most firms get nervous, and rightly so.
Professional services carry duties of confidentiality. In accounting, auditor independence and client confidentiality are core professional obligations. An AI system that lets a junior on the retail team read a manufacturing client's sensitive files is not a productivity tool. It is a breach.
The principle is simple: the AI must respect the exact same access controls as the underlying documents. If a user cannot open a file in the DMS, the AI must not retrieve, quote, or summarize it for them.
Practical mechanisms:
user_clearance filter in the code above enforces this at query time.A useful test: if an associate cannot justify seeing a document by opening it directly, the AI should never expose it either. AI is not a permissions shortcut.
Two more concerns keep partners awake.
Where does the data go? If your firm uses a public AI tool, you must know whether prompts and documents are used to train the vendor's models. For confidential client work, use enterprise arrangements with contractual guarantees that your data is not used for training and stays within your tenancy. Read the data processing terms, do not assume.
Hallucination and over-reliance. Even a grounded system can misstate. The output is a starting point, not a signed conclusion. Build in:
The associate still owns the work. The AI just gets them to a first draft faster.
Vérification des acquis
1. What core problem does a well-built internal AI system primarily address for a professional services firm?
2. In the RAG (Retrieval-Augmented Generation) pattern, how does the model generate its answer?
3. Why does the lesson emphasize that a knowledge AI system must be 'well-governed'?
4. Select ALL correct answers about how RAG differs from asking a general AI model to answer from memory.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers describing where scattered firm knowledge typically resides and why it becomes unusable.
Sélectionnez toutes les réponses correctes.
Do not attempt a firm-wide rollout on day one. The firms that succeed start narrow.
Phase 1: pick one practice area with clean, high-value knowledge. For example, a specific tax specialty where prior memos are well-organized and questions recur. Small scope means you can curate the corpus by hand and check the outputs.
Phase 2: curate and tag. Assign a subject-matter expert to select the final, authoritative documents. Add metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition).: client (or anonymized), date, jurisdiction, practice area, status, clearance level. This is unglamorous and it is the whole game.
Phase 3: pilot with a small user group. Have experienced staff stress-test answers. Track where the system is wrong or surfaces the wrong document. Every failure improves the tagging and retrieval rules.
Phase 4: measure, then expand. Track time saved on research, accuracy of citations, and user trust. Only expand to a new practice area once the first one is reliable.
The competitive asset is not the model. Anyone can license a model. The asset is your governed, tagged, permission-aware knowledge base. That is proprietary, and it compounds. Every well-documented engagement makes the next query better.
A technically perfect system fails if senior staff will not contribute knowledge or juniors do not trust the output.
Two moves help. First, make good documentation part of engagement close-out so the knowledge base keeps growing. Second, be honest with junior staff: this tool speeds up research, it does not replace judgment, and their review is still required. Framed that way, adoption follows.