Staff at a firm may use AI whether leadership approved it or not. Staff paste memo drafts into chat tools, research assistants summarize standards, and bookkeeping software suggests categories. A one-page "AI policy" does not govern any of that. A governance framework does: it names what tools exist, what data each tool may touch, who reviews the output, and how the firm finds out when something goes wrong.
This guide builds that framework on the NIST AI Risk Management Framework, because its vocabulary maps onto what a firm already does under its quality management system.
Start from the NIST AI RMF
NIST released AI RMF 1.0 on January 26, 2023. It organizes AI risk work into four functions: Govern, Map, Measure and Manage. On July 26, 2024, NIST released NIST AI 600-1, the Generative AI Profile, which lists risks that are specific to generative systems and suggests actions under each function. The framework is intended for voluntary use. For a CPA firm, that means it is a defensible benchmark, not a compliance obligation.
Three of the generative AI risks in NIST AI 600-1 matter most in audit work:
- Confabulation. NIST defines it as the production of confidently stated but erroneous or false content, known colloquially as hallucinations.
- Data privacy. Leakage and unauthorized use or disclosure of data that users put into or receive from a system.
- Human-AI configuration. NIST notes that humans may over-rely on generative systems and perceive their content as higher quality than content from other sources, which it calls automation bias, and that this can worsen the risk of confabulation.
The third one is the audit risk that gets least attention. A reviewer who trusts a clean-looking draft reviews it less carefully.
What regulators have said firms are doing
The PCAOB staff's July 2024 Spotlight on generative AI summarized outreach to larger audit firms. It is staff commentary, not a rule. Its observations are a useful picture of where governance sits at firms that have thought about it:
- Firms emphasized policies, procedures, internal controls and training for AI use, much as they do for other technology.
- Some firms limit what information can be uploaded to AI tools so that client data does not become public, and some do not allow generative AI in audit or attest procedures at all because of data privacy and reliability concerns.
- Firms said an engagement team member who uses an AI tool remains responsible for the results and documentation of the work, and supervisors apply the same diligence to reviewing it as to any other work.
None of that requires a large firm's budget. It requires decisions written down.
The framework: six components
1. An AI inventory (Map)
List every AI-enabled tool in use, including features inside software you already own. For each entry, record:
- the tool and its owner at the firm
- what it is used for (research, drafting, data extraction, analytics, bookkeeping suggestions)
- what data it receives
- whether the provider retains or trains on inputs under the contract in force
- the engagements or workflows where it is used
Ask staff directly what they use. Unsanctioned use is the usual gap in an inventory, and a no-blame survey surfaces it faster than a block list.
2. Approved-use tiers by data class (Govern)
Tie permission to the data, not the tool. A workable three-tier scheme:
| Tier | Data | Rule |
|---|---|---|
| 1 | Public information, firm templates, no client data | Any approved tool |
| 2 | Client financial data and workpapers | Only tools with a signed confidentiality agreement, no training on inputs, and controlled access |
| 3 | Tax return information, personal identifiers, credentials | Only tools cleared specifically for that data, with the client consent your professional and statutory obligations require |
The confidentiality analysis behind tiers 2 and 3 is covered in our guide to the AICPA confidentiality rule and AI tools.
3. Vendor intake (Govern and Map)
NIST AI 600-1 flags third-party components as a source of risk: errors in an upstream model or dataset carry downstream. Before a tool moves from "interesting" to "approved," collect the same things you would for any service provider that touches client data: data handling terms, retention, subprocessors, security attestations the provider can produce, incident notification terms and exit terms. Record the decision and the date.
4. A human review standard (Manage)
Write the rule down: the person who used the tool owns the output, and the reviewer reviews AI-assisted work to the same standard as any other work. Then make it testable.
- AI-assisted workpapers identify the tool, the step, the inputs and what the preparer did to confirm the output.
- Any figure, citation or standard reference produced by a tool is traced to source before it goes in a workpaper.
- Reviewers are told which sections were AI-assisted, so the automation bias NIST describes does not do the reviewing for them.
How to document audit procedures covers the re-performance standard that makes this workable.
5. Training (Govern)
Short and specific beats long and general. Cover what data goes in which tier, how confabulation shows up in practice (invented citations, plausible but wrong amounts), and what to do when someone pastes the wrong thing into a tool. Retrain when the approved-tool list changes.
6. Monitoring and incidents (Measure and Manage)
Decide in advance how you will measure whether the policy works:
- a periodic re-run of the staff survey against the inventory
- a sample of AI-assisted workpapers reviewed for the documentation standard
- a defined path for reporting a misdirected upload, with an owner and a timeline for client notification
Feed the results into your system of quality management. Under SQMS No. 1 the firm identifies quality risks, designs responses and evaluates them; AI tools are one more source of quality risk. Our SQMS 1 guide walks through that process, and AI in auditing for small CPA firms covers the practical tool-use side.
What a peer reviewer or client will ask
Expect these questions and have the answers on file:
- Which AI tools does the firm use on client work?
- What client data can go into them, and who decided?
- What contract terms protect that data?
- How is AI-assisted work reviewed, and where is that documented?
- What happened the last time something went wrong?
If you can answer all five from documents rather than memory, the framework is working.
Frequently asked questions
Do we need an AI policy if we do not use AI?
Yes, a short one. Staff use tools on their own, and a policy that says what is prohibited and why is the control that addresses it.
Is the NIST AI RMF mandatory for CPA firms?
No. NIST describes it as intended for voluntary use. It is a recognized structure that makes a firm's approach easy to explain.
Who should own AI governance in a small firm?
One named partner, with a second person responsible for the inventory. Ownership by "the firm" means ownership by nobody.
How often should the inventory be updated?
At least annually, and whenever a tool is approved, retired or changes its data terms.
Sources
- NIST, AI Risk Management Framework (AI RMF 1.0, released January 26, 2023) and Generative AI Profile NIST AI 600-1 (released July 26, 2024): https://www.nist.gov/itl/ai-risk-management-framework
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile: https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence
- PCAOB, Spotlight: Staff Update on Outreach Activities Related to the Integration of Generative Artificial Intelligence in Audits and Financial Reporting (July 2024): https://pcaobus.org/documents/generative-ai-spotlight.pdf
CORAA prepares audit working papers for US CPA firms; the firm reviews and signs. See /us.
Part of CORAA University · Quality management and practice: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error