PCAOB standards govern audits of issuers and broker-dealers. If your clients are private companies, AICPA standards apply to your audits, not PCAOB standards. Yet the PCAOB's recent work on generative AI and technology-assisted analysis is worth reading closely, because it states, in specific terms, what regulators expect of an auditor who relies on technology and on data the client produced. Peer reviewers and sophisticated clients read it too.
This post separates what the PCAOB has said into three layers: staff observations, adopted standards and an enforcement policy statement.
Layer 1: the July 2024 staff Spotlight
In July 2024 the PCAOB staff published a Spotlight titled "Staff Update on Outreach Activities Related to the Integration of Generative Artificial Intelligence in Audits and Financial Reporting." It carries a disclaimer that it represents the views of staff and is not a rule, policy or statement of the Board.
The staff spoke mainly with larger firms: the U.S. global network firms and several U.S. non-affiliated firms that audit more than 100 issuers. That limits how far the findings generalize, but the observations are specific:
- Use was mostly administrative and research. Firms described staff using generative AI for administrative documents and initial drafts of memos and presentations, and deploying tools to help staff research internal accounting and auditing guidance. Global network firms were further along than non-affiliated firms.
- Potential audit uses were named. Firms pointed to summarizing accounting policy and legal documents, evaluating the completeness of audit documentation, performing certain risk assessment procedures, scoping the audit, evaluating the completeness of financial statement disclosures, and comparing financial statement amounts with audited amounts.
- Standards were not seen as an obstacle. Most firms said PCAOB auditing standards are not currently viewed as impediments to developing and using generative AI in the audit.
- Responsibility did not move. Firms said the team member who uses a tool is still responsible for the results and documentation, and supervisors review AI-assisted work with the same diligence as other work. Some noted their supervision and review policies had not changed.
- Reliability concerns were stated plainly. Firms noted that generative AI can generate content that is false or misleading ("hallucinations") or skewed, and some designed tools to document the underlying source data used. Some firms did not allow generative AI in audit or attest procedures at all, citing data privacy and reliability.
- Preparers raised an auditability issue. Company representatives pointed to the "black-box" nature of some tools and inconsistent output, which raise questions about the auditability of AI-created output. The staff also recorded that preparer use of generative AI could amplify existing IT risks such as segregation of duties.
For a small firm, the first takeaway is that the uses firms reported are the ones where a human can check the result quickly.
Layer 2: the technology-assisted analysis amendments
The PCAOB adopted amendments to AS 1105, Audit Evidence, and AS 2301, The Auditor's Responses to the Risks of Material Misstatement, on June 12, 2024. The SEC approved them on August 20, 2024. They are effective for audits of financial statements for fiscal years beginning on or after December 15, 2025, so calendar-year 2026 audits are the first affected.
The SEC's approval order lists what the amendments do:
- clarify the description of a test of details
- specify auditor responsibilities when identifying items that require further investigation in tests of details
- specify that when an auditor uses a procedure for more than one purpose (risk assessment, test of controls, substantive procedure), the auditor should achieve each objective of the procedure
- specify responsibilities for evaluating the reliability of external information provided by the company
- emphasize the importance of controls over information technology
- emphasize appropriate disaggregation or detail of information to the relevance of audit evidence
The item on external information is new paragraph .10A of AS 1105. It applies where the company gives the auditor information in electronic form that it received from an external source, such as cash receipts, shipping documents and purchase orders. To use that information as audit evidence, the auditor evaluates reliability by (a) understanding the source and the company's process for receiving, maintaining and processing the information, including any modifications made before it reached the auditor, and (b) either testing whether the company modified the information, or testing controls over receiving, maintaining and processing it, including IT general controls and automated application controls where applicable.
Layer 3: the paragraph .10A policy statement
Commenters said .10A(b) could be read to require testing in every case. On September 18, 2025, the PCAOB issued Release No. 2025-004, a policy statement on implementing .10A. It says that, depending on the assessed risk of material misstatement, the importance of the information to the planned response and the results of other procedures (including those under .10A(a)), an auditor may not need separate .10A(b) testing. If the auditor concludes there is no more than a remote possibility that the information was modified in a way that would make it unreliable for the audit, the PCAOB will not treat the absence of separate testing as noncompliance in inspection or enforcement. It adds that due professional care and audit documentation requirements continue to apply.
The practical reading: the requirement is principles-based and scales with risk, but the auditor has to reach and document the "no more than a remote possibility" conclusion. Silence does not satisfy it.
Why the data findings matter more than the AI findings
The PCAOB's April 2024 Spotlight on inspection observations reported that, across the 2021 and 2022 inspection cycles, about 17% of inspected audits had deficiencies where the auditor did not sufficiently test the accuracy and completeness of information produced by the company, or controls over it, or other data and reports including information produced by service organizations. The staff's example is plain: without testing the completeness of a listing of fixed asset additions, an auditor may not detect fictitious additions.
An AI tool that ingests a trial balance, general ledger or subledger export inherits that exact risk. If the input is incomplete, every downstream conclusion is.
What to do in a nonissuer practice
- Adopt the .10A mindset for bank, customer and vendor data. When the client hands you electronic copies of bank statements, remittances or shipping records, document where they came from and how they were handled.
- Document the data check before the tool step. Population completeness and accuracy come first. Audit evidence under AU-C 500 covers the reliability attributes.
- Hold the line on supervision. Tool output is a draft. Your review standard is the same, as laid out in our AI in auditing guide.
- Put it in your quality system. Technology used on engagements is part of what the firm evaluates under SQMS No. 1.
Frequently asked questions
Do PCAOB standards apply to my private-company audits?
No. They apply to issuer and broker-dealer audits. They are persuasive context for what good practice and inspection scrutiny look like.
Has the PCAOB banned generative AI in audits?
No. The staff reported that firms did not view PCAOB standards as impediments to its use, and the Spotlight is not a rule.
What is paragraph .10A in one sentence?
It requires an auditor who uses company-provided electronic information from an external source as evidence to understand the source and the company's handling process, and to test for modification or test the relevant controls.
Sources
- PCAOB, Spotlight: Staff Update on Outreach Activities Related to the Integration of Generative Artificial Intelligence in Audits and Financial Reporting (July 2024): https://pcaobus.org/documents/generative-ai-spotlight.pdf
- SEC Release No. 34-100774, Order Granting Approval of Amendments Related to Aspects of Designing and Performing Audit Procedures that Involve Technology-Assisted Analysis of Information in Electronic Form (August 20, 2024): https://sec.gov/files/rules/pcaob/2024/34-100774.pdf
- PCAOB Release No. 2025-004, Policy Statement Regarding Implementation of Paragraph .10A of AS 1105, Audit Evidence (September 18, 2025): https://assets.pcaobus.org/pcaob-dev/docs/default-source/rulemaking/docket-052/pcaob-release-no-2025-004.pdf
- PCAOB, Spotlight: Inspection Observations Related to Auditor Use of Data and Reports (April 2024): https://assets.pcaobus.org/pcaob-dev/docs/default-source/documents/data-and-reports-spotlight.pdf
CORAA prepares ready-to-review audit files for US CPA firms from client accounting records; the firm keeps the client relationship, the review and the signature. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error