Generative AI can draft a memo, summarize a contract and propose a tickmark in seconds, and it can do each of them wrongly with the same confidence. A CPA firm that uses it on workpapers has to answer three questions before the first prompt. What client data is allowed into the tool? Who checks the output and how? How is the use recorded in the file? This article gives a policy-level answer. It complements the firm-wide treatment in AI governance framework for CPA firms, the audit-practice view in AI in auditing for small CPA firms and the confidentiality analysis in AICPA confidentiality and AI tools with client data.
Principle one: client data is protected wherever it goes
Anything typed or uploaded into an AI tool is information the firm has handed to a third party. The FTC Safeguards Rule, as the FTC describes it, requires a firm to oversee its service providers, to put security expectations in contracts and to encrypt customer information on its system and in transit. Publication 4557 tells tax professionals to limit access to taxpayer data to those who need it. An AI vendor that receives client data is a service provider for those purposes. See FTC Safeguards Rule for CPA firms.
Before a tool touches client data, the firm should know and document:
- Where the data is processed and stored, and for how long.
- Whether the vendor uses inputs to train models, and whether that can be turned off by contract.
- Who at the vendor can access the data.
- Whether data is encrypted in transit and at rest.
- What the vendor commits to after a security incident, including notice to the firm.
- What happens to the data when the contract ends.
Where the firm cannot get clear answers, the tool should not receive confidential client information. A tiered rule works in practice: public information may go into any approved tool, client information only into tools that have passed vendor review, and personally identifiable information only into tools approved for that class of data, with masking where possible.
Principle two: a person is responsible for every conclusion
AI output is a draft. The reviewer remains responsible for the workpaper, the procedure and the conclusion. For audit work, that means the evidence, not the model's statement, supports the conclusion, and professional skepticism applies to the tool's output as it does to management's representations. For tax work, Circular 230 requires competence and diligence in a practitioner's own advice, and a cited authority the model produced must be located and read in the primary source before it is relied on. See Circular 230 section 10.35 competence and delegation and professional skepticism.
Specific review rules:
- Verify every number that came from the model against source documents.
- Verify every citation against the standard or the statute.
- Check for omissions. A summary may drop the one clause that matters.
- Do not let the model decide scope or risk. It can suggest, and the engagement team decides.
- Keep reasonable evidence of review in the workpaper, signed and dated.
Principle three: document what was done
The audit documentation standard asks for enough detail that an experienced auditor with no prior connection can understand the procedures performed, the evidence obtained and the conclusions reached. That holds for AI-assisted work. See how to document audit procedures and audit documentation. For each AI-assisted workpaper, record:
- The tool and version, if relevant to reliability.
- The task: what the tool was asked to do.
- The inputs, by reference to source documents, and not copies of confidential material beyond what the file already holds.
- The output used.
- The review procedures the person performed and the corrections made.
- The conclusion, in the reviewer's words.
Prompts and outputs that affect the conclusion are part of the evidence trail, and the firm should decide retention for them. See audit record retention.
Principle four: use a risk framework
NIST's AI Risk Management Framework is a voluntary framework to help manage risks to individuals, organizations and society from AI, and it has four functions: govern, map, measure and manage. NIST released the Generative AI Profile, NIST-AI-600-1, on July 26, 2024, to help organizations identify risks specific to generative AI. NIST's AI RMF page states that AI RMF 1.0 is being revised as part of the White House AI Action Plan, so confirm the current version before adopting it. A firm can use the functions as a policy skeleton:
- Govern. Name an owner, approve the policy, set what is prohibited.
- Map. List each AI use case, the data involved and who is affected.
- Measure. Test accuracy on firm tasks, track errors found in review.
- Manage. Act on findings, retire tools that fail, update training.
See the glossary entry on NIST AI RMF.
What to prohibit
- Entering client confidential information into consumer tools that are not approved.
- Using AI output as audit evidence without corroboration.
- Letting AI generate conclusions, opinions or representations on the firm's behalf without review.
- Using AI to sign, or to complete sign-off fields.
- Uploading another client's information to a tool trained on a shared workspace.
Disclosure and engagement terms
Consider telling clients when AI is used on their data and how it is protected, and put the commitment in the engagement letter where the firm chooses to do so. When the tool is an offshore or third-party service, the consent and disclosure rules for tax return information and for confidential client information apply. See section 7216 consent for offshore preparation and ET 1.700 confidentiality and offshore.
Training and monitoring
Train staff on the policy at onboarding and annually. Share examples of errors found. Review the usage logs on a schedule, if the tool provides them, and check for use outside the approved list. Include AI in the firm's risk assessment and the incident response plan. See cybersecurity for CPA firms.
FAQ
Can AI-generated work be relied on without review?
No. A person must review and take responsibility for the conclusion.
Does the FTC Safeguards Rule apply to AI vendors?
An AI vendor with access to customer information is a service provider the firm must select carefully, bind by contract and oversee.
Is the NIST framework mandatory?
No. NIST describes it as voluntary.
CORAA prepares ready-to-review audit files for US CPA firms; see /us.
Sources
- NIST, AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework
- FTC, Standards for Safeguarding Customer Information (Safeguards Rule), 16 CFR Part 314: https://www.ecfr.gov/current/title-16/part-314
- IRS, Publication 4557, Safeguarding Taxpayer Data: https://www.irs.gov/pub/irs-pdf/p4557.pdf
- IRS, Circular 230 (Treasury Department Circular No. 230), section 10.35: https://www.irs.gov/pub/irs-pdf/pcir230.pdf
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error