AICPA releases practice guide for auditors dealing with AI
- Key insight: Find out how the AICPA’s new practice aid addresses AI use in financial audits.
- What’s at stake: Auditors risk failing to fulfill their critical roles if they cannot mitigate AI-related risks.
- Forward look: The AICPA will expand this practice aid with additional AI-related guidance.
The AICPA has released a new practice guide to help auditors understand how current audit standards do and do not apply to the use of AI, both in terms of entities that used it to draft their financial statements as well as practitioners using the technology during the audit itself.
Processing Content
“AI tools are already benefiting the efficiency and effectiveness of both financial statement preparation and the audit in a number of ways,” said Amy Pawlicki, the AICPA’s vice president of assurance and advisory innovation, in a statement. “But as powerful as they are, these tools can introduce new risks that auditors must be cognizant of in fulfilling the critical role they play in performing financial statement audits. This practice aid is intended to help auditors understand and mitigate these risks in a rapidly evolving environment.”
The first section notes that the entity’s use of AI does not change management’s responsibility for the financial statements. Overall, it goes over how an entity’s use of AI may affect acceptance or continuance decisions in terms of the nature and circumstances of the engagement and management’s integrity and ethical values; management’s skill sets and competencies; and the competence and capabilities of the engagement team.
In this area, the guidance notes that the more the entity relies on the outputs of AI in its financial reporting process, the more information the auditor may need to inform their acceptance or continuance decisions, such as their ability to actually gather audit evidence: for example, AI agents might be used in business processes without traceable workflows. The AICPA noted that heavy AI use might even impede management’s ability to understand its own finances.
“When an entity’s use of AI plays a significant role in its financial reporting process, considerations may be similar to those for entities who use external specialists and complex valuation models,” said the practice aid. “If management doesn’t have the understanding of those models and the potential risks arising from the use of those models necessary to take responsibility for the outputs, that may indicate a lack of appropriate skill sets and competencies. The same is true for AI.”
It then goes into how AI might affect an auditor’s understanding of the entity itself, its environment and its system of internal control, to supplement other risk assessment–related resources, such as the
The guidance indicates that the auditor should perform procedures to obtain an understanding of certain aspects of the entity and its environment, including “the entity’s organizational structure, ownership and governance, and its business model, including the extent to which the business model integrates the use of IT.” The use of IT would include the entity’s use of AI. It asks the auditor to consider how the structure of the entity can influence how AI is deployed and monitored, as well as whether the entity has the necessary resources to support and manage the integration of AI.
This includes organizational structure and governance, as a complex organizational structure can amplify challenges in AI governance and integration, particularly if multiple departments or third parties rely on AI. In such cases, it is important for the entity to demonstrate clear lines of accountability — for example, designating individuals who decide whether to rely on a particular output from AI for financial reporting activities and individuals who monitor risks, such as those related to model governance and security.
Business models can also play a role, as they influence how the entity integrates the use of IT in its interactions with customers, suppliers, lenders and other stakeholders through IT interfaces and other technologies. New or different business risks might arise when an entity uses AI — these risks may be relevant to the auditor’s understanding of the business model.
The auditor is also expected to understand how AI can affect the financial reporting process itself, which, in turn, demands an understanding of how AI affects, and is affected by, the entity’s system of internal control. Such considerations could include:
- How oversight responsibilities related to AI are carried out by management, how the entity has assigned authority and responsibility related to AI;
- Whether individuals with AI responsibilities have the appropriate knowledge and training, whether the entity has a process in place to identify AI used by vendors and other third parties and to evaluate the effect that use may have on financial reporting;
- Whether the entity has policies regarding hiring, developing and retaining individuals who are knowledgeable about applicable development, deployment, monitoring and use of AI: or
- What mechanisms are in place to hold individuals involved in initially evaluating, approving, training, using and monitoring AI responsible for following documented procedures.
The guidance also emphasized how a comprehensive risk assessment is critical to the entity’s ability to manage risks associated with the entity’s use of AI in financial reporting. The introduction of new technology such as AI brings the potential for unique risks, so it ‘s important for the auditor to understand how the entity’s risk assessment process considers the new or updated risks introduced by the entity’s use of AI and how the entity has responded to such risks. One key aspect of addressing these risks, said the guidance, is having an appropriate level of human involvement in the process.
“Human involvement, such as human-in-the-loop review or validation, may assist in addressing risks related to data and the use of algorithms, and it may be necessary for the entity to integrate human judgment and expertise into decision-making processes, particularly in areas where AI may have limitations. Determining whether the level of human involvement is appropriate involves consideration of the nature and extent of that involvement, as well as whether the right individuals are involved. For AI that is used in the financial reporting process, it is critical that the human involved has the right knowledge and expertise to determine the reliability of the AI outputs,” said the guidance.
It also emphasized the need to be especially aware of AI-enabled fraud risk, such as personnel intentionally altering the AI training data or algorithm to generate bias within the model or editing attributes within the model to classify fraudulent transactions as legitimate. AI may also be leveraged in more common fraud schemes, such as generating fictitious documents to support nonexistent or fraudulent transactions.
Auditors were also encouraged to consider other risks such as model drift (which can degrade the quality of AI models over time), data governance (as bad data can produce inaccurate results that might impact the entity’s finances) fairness (as an entity might receive financial penalties for biased AI outputs), cybersecurity, and information flow (it noted that, in many instances, AI performs tasks, either in the operation of a process or control or in the generation of information, that were traditionally performed by humans.)
Control activities can also be highly impacted by AI. The type of AI — including whether deterministic or probabilistic — and how it is used will influence the nature of the control activities implemented by the entity. Alternatively, the auditor may identify controls operated by AI or that use information generated by AI that respond to risks of material misstatement. Overall, if AI is involved in a control activity, the auditor needs to not only understand the control activity but the AI mechanism underlying it. For instance, some AI may assist in categorizing expenses or preparing accruals based on invoice patterns or the entity may use AI-operated controls to review entries for anomalies.
Auditors were also urged to remember that AI risks can vary greatly depending on the type of AI used (e.g., deterministic or probabilistic), the specific use case, whether the AI was developed internally versus purchased, or whether there’s an agentic structure layered on top of the AI model. Further, while the current guidance encompasses many AI risks, the guidance noted that a simple 1:1 translation cannot always be applied, as some risks that are inherent to a particular class of transaction may have changed due to the entity’s use of AI. Other risks may be created by the entity’s use of AI (e.g., risks related to data, model transparency, or model drift).
As for how auditors should respond to these risks, the guidance noted that in some cases an auditor may be able to substantively test AI outputs, but if doing so alone cannot provide sufficient audit evidence, then the auditor should design and perform tests of controls to obtain sufficient appropriate evidence about the operating effectiveness of controls. In some cases, more traditional controls (like human review or monitoring) may reduce AI-related risk to an acceptable level. In other cases, AI-related controls, such as controls over data quality, model performance, and safeguards, may need to be tested.
However, the auditor cannot just rely on tests of controls. Because some AI models can continuously learn, drift and have probabilistic outcomes, the strategy for testing and relying on controls operated by AI may be different from the strategy for testing and relying on traditional automated controls. The strategy may also differ for controls that use information generated by AI as compared to traditional IT-dependent manual controls.
Meanwhile, traditional general IT controls may not address all AI-specific risks, so AI-related IT controls may need to be tested. However, the auditor’s ability to perform certain procedures may be limited when the AI is purchased from a third party. Alternative procedures may need to be considered, such as obtaining a SOC report or other attestation or third-party report.
The guidance added that when an entity uses a service organization to provide AI services or uses a service organization that uses AI within the system, a service auditor’s report often becomes important audit evidence. If the user auditor cannot obtain sufficient appropriate evidence from the service auditor’s report, additional procedures may be necessary, such as obtaining AI-related representations from management, such as identification of AI used by the entity.
When considering audit evidence, the guidance said that the less insight the auditor has into the process of how the output was delivered, the more difficult it may be to become comfortable with the output (e.g., the AI black box), so the auditor may need to determine ways to establish relationships between inputs and outputs. The AICPA recognized there is judgment involved in where to gather information to be used as evidence, and that nontraditional sources of information may need to be explored.
When auditors themselves use AI in an engagement, the guidance noted they are still subject to quality management requirements. When a CPA firm uses an AI tool to obtain audit evidence, depending on the use case, it may want to implement certain quality management policies and procedures such as establishing who in the firm is responsible for creating internally developed AI tools or acquiring commercial third-party AI tools; establishing a process for authorizing AI tools and communicating that information internally; establishing policies regarding the use of AI and what is and is not an acceptable use of specified AI tools; and communicating that information internally or establishing a process or controls for periodic revalidation and monitoring of the performance of the AI tools used.
When planning an audit, the guidance said teams might brainstorm opportunities to use general-use AI tools in the audit (for example, using chatbots for research) and for performing various audit procedures for the purpose of obtaining audit evidence or determining which areas of the audit present the greatest opportunity to improve quality or generate efficiency through the use of AI tools.
The guidance also said that, in an audit of financial statements, one AI tool may be used to help the auditor evaluate whether another AI tool is performing correctly. Auditors might use one AI tool to perform a procedure and another AI tool to review whether the procedure was performed correctly and whether the results of the procedure make sense. In such situations, the second AI tool does not reduce or take the place of the auditor’s responsibilities for supervision and review.
Finally, the AICPA said that when the auditor plans to use AI in the performance of the engagement, AU-C section 210 does not require disclosure of the specific tools or technologies to be used in the audit, including AI. AI is treated like other audit tools and techniques, such as Excel and audit software. The engagement letter focuses on what the auditor does, not on how the auditor plans to perform procedures.
However, while AU-C section 210 does not require the auditor to disclose in the engagement letter that the auditor will be using AI in the audit, disclosure may be required by applicable laws, regulations, contractual agreements or firm policies. For example, some states have established laws requiring licensed professionals to provide advance disclosure to their customers of certain uses of AI; such disclosures may be included in the engagement letter.
More guidance, including a deeper dive into assessment of the risk of material misstatement and evaluation of audit evidence when a company is using AI, will be added to section one of the guidance in the future. In addition, more Q&As are expected to be added to the section on the implications of using AI in the audit process.
Introductory bullet points created by AI with editorial review.
