Clients are starting to use AI inside their accounting process: drafting policy memos, suggesting transaction categories, building reconciliations, summarizing contracts for lease and revenue analysis. Each of those outputs can end up as an input to the financial statements, and each one lands on your desk as something the client says is right.
The auditing framework for this is not new. An AI-generated schedule is information produced by the entity. What is new is that the way it was produced can be opaque, inconsistent from run to run, and wrong in a confident tone. This post sets out how to handle it.
What clients are actually doing
The PCAOB staff's July 2024 Spotlight recorded what preparers at public companies told it. They used generative AI to create initial drafts of internal documents, such as summaries of accounting standards and interpretations, and to help with less complex, repetitive processes such as preparing account reconciliations or identifying reconciling items. The preparers also named the obstacles: the "black-box" nature of some tools and inconsistent output, which they said raise questions about the auditability of AI-created output. Some were testing individual use cases to learn what controls they would need before wider use.
The staff also recorded a point that is easy to miss: preparers said human supervision and review of AI output remains important, and some firms noted AI use by preparers could amplify existing IT risks such as segregation of duties.
Step 1: find out where AI touches the numbers
Ask the question directly in planning, and put it in the walkthrough for each significant process:
- Which steps in the close, reconciliation, estimate or disclosure process use an AI tool, including features embedded in software the client already owns?
- Who uses it, and who reviews the output?
- Does the output feed a journal entry, a schedule you will audit, or a disclosure?
- Is any client data leaving the client's environment?
Record the answers in the risk assessment. Audit risk and the inherent, control and detection model frames where this fits. If the tool materially affects how a number is produced, it is part of your understanding of the entity's information system, not a footnote to it.
Step 2: treat the output as information produced by the entity
The reliability framework in AU-C 500, as revised by SAS No. 142 (effective for audits of periods ending on or after December 15, 2022), applies to any information you use as audit evidence, notwithstanding its source or the procedures used to obtain it. SAS No. 142 added attributes the auditor considers when evaluating reliability, including authenticity and susceptibility to bias. Information the entity produced is never accepted as reliable on its face.
For AI output, translate that into three questions:
- Is the input complete and accurate? A model that summarizes a lease abstract or categorizes a ledger only sees what it is given. The PCAOB's April 2024 inspection Spotlight shows how often this basic step is missed: about 17% of the comment forms in each of the 2021 and 2022 inspection cycles contained deficiencies where the auditor did not perform sufficient procedures to test the accuracy and completeness of information produced by the company. Its example: without testing the completeness of a listing of fixed asset additions, the auditor may not detect fictitious additions.
- Is the processing consistent? If the same input can produce different outputs on different days, a single review of one run does not support the others.
- Does a person with the right competence own the result? If nobody at the client can explain how the figure was derived, you cannot rely on a management review control over it.
Step 3: choose the evidence
You have three families of response, usually in combination:
- Test the output directly. Re-perform the calculation, agree amounts to source documents, or recompute the reconciliation independently. For a reconciliation an AI tool prepared, tie the reconciling items to bank, subledger and cutoff evidence yourself. The tool's work is a lead, not evidence.
- Test the controls around the tool. Access to the tool and to the data it sees, change management for prompts or configurations, and review of its output. Controls over the underlying data are ordinary IT general controls. The IT audit and ITGC guide covers the program.
- Rely on the underlying documents. If the AI summarized a contract, read the contract. If it categorized a population of transactions, test the categorization on the transactions that matter, not on the summary.
Where the tool feeds an accounting estimate, apply the estimate framework as well: understand the method, data and assumptions, and evaluate management's bias. Auditing accounting estimates under AU-C 540 sets the structure, and a model is one more method.
Step 4: test the management review control honestly
The weak point is almost never the tool. It is the reviewer. NIST's Generative AI Profile describes automation bias as excessive deference to automated systems, which can worsen the risk that confabulated content is accepted. A reviewer who sees a polished, well-formatted AI schedule is more likely to tick it than to challenge it.
When a client relies on a review control over AI output, ask for evidence of precision, not only of sign-off:
- what the reviewer compared the output against
- what threshold triggers investigation
- examples of items the reviewer changed or rejected
- whether the reviewer works from the output or from the source
A review that has never rejected anything is a signal. Test it with an item you have independently assessed.
Step 5: document what you did
Your workpaper should let an experienced auditor with no connection to the engagement understand which output you relied on, how you established it was complete and accurate, and what you concluded about the controls. How to document audit procedures covers the standard. Where you used AI on your own side, record that as well, as described in AI in auditing for small CPA firms.
Communicate
If AI use at the client creates a control deficiency, such as no review of output that feeds a significant balance or no restriction on who can alter configuration, treat it like any other deficiency in the information system and communicate it under your normal process.
Frequently asked questions
Is there a separate standard for AI-generated information?
No. The general framework for evaluating reliability of information used as audit evidence applies. SAS No. 142 expressly contemplates automated tools and techniques.
Can we rely on the client's AI tool vendor's assurances?
Vendor statements are inputs to your understanding, not tested evidence. If the tool is a service organization relevant to financial reporting, the SOC report review process applies.
What if the client cannot explain how the AI produced a number?
Then there is no control you can test over that step, and you rely on direct testing of the number against source evidence, or you consider the effect on your report.
Sources
- PCAOB, Spotlight: Staff Update on Outreach Activities Related to the Integration of Generative Artificial Intelligence in Audits and Financial Reporting (July 2024): https://pcaobus.org/documents/generative-ai-spotlight.pdf
- PCAOB, Spotlight: Inspection Observations Related to Auditor Use of Data and Reports (April 2024): https://assets.pcaobus.org/pcaob-dev/docs/default-source/documents/data-and-reports-spotlight.pdf
- NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (July 2024): https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence
- Journal of Accountancy, "New audit evidence standard recognizes evolving nature of business" (SAS No. 142; July 2020): https://www.journalofaccountancy.com/news/2020/jul/audit-evidence-standard-enables-technology-aided-audit-procedures/
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error