Workpaper Automation: Where It Helps and Where Review Stays Human

Most of the hours in a small firm's audit go to work that is structured: building lead schedules from a trial balance, footing, cross-footing, tying figures to the statements, rolling forward prior-year files and formatting. These tasks automate well. Other tasks, such as evaluating a going concern plan or judging whether a related party disclosure is complete, depend on judgment. The firm's job is to automate the first group fully and to protect the second group from being treated as the first. This article sets out how.

Tasks that automate well

Tasks that need people

• Risk assessment: understanding the entity and its environment. See SAS 145 risk assessment.
• Evaluating management's estimates and bias. See auditing accounting estimates.
• Fraud inquiries and the brainstorming session. See fraud risk assessment.
• Evaluating misstatements, materiality and disclosures.
• Going concern judgments. See going concern assessment.
• Forming the opinion and drafting communications with those charged with governance.

Software can support these tasks with data and drafts, and the decisions stay with the engagement team.

Reviewing automated output

Automation changes what the reviewer reviews. The reviewer cannot re-add every footing, so the reviewer needs reasons to trust the process:

1. Validate the tool before relying on it. Test it on a prior-year file with known results, and record what was tested and the outcome. Re-test after software updates.
2. Check inputs. The data imported is complete and accurate: the trial balance ties to the general ledger and to the financial statements the client approved.
3. Review the mapping. An account mapped to the wrong lead schedule is carried through every report, so review mapping at the start of each engagement and when accounts change.
4. Review exceptions, not just totals. A tool that flags a handful of items out of thousands has done the filtering. The reviewer examines the 40 and reviews the filter.
5. Sample the unflagged. Pick some items the tool did not flag and test them, to check the criteria.
6. Look for what the tool cannot see. Missing entries, unrecorded liabilities and off-book arrangements do not appear in data that was never recorded. See search for unrecorded liabilities.
7. Keep review evidence in the file: who reviewed, what was checked and when.

Documenting an automated procedure

An experienced auditor with no connection to the engagement should be able to understand the procedure. For an automated step, record:

• The objective and the assertion addressed.
• The tool, the version and the configuration, such as criteria and thresholds.
• The population and its source, with completeness and accuracy checks. See information produced by the entity.
• The results, including exceptions and how each was resolved.
• The reviewer's conclusion in their own words.

See how to document audit procedures and audit data analytics.

Protecting professional skepticism

Automation can encourage automation bias, the tendency to accept the output because it looks precise. Guard against it:

• Ask reviewers to write one sentence on what they would expect before looking at the output.
• Rotate who reviews which schedule.
• Run occasional manual reperformance of an automated step and compare. See reperformance.
• Treat tool failures as learning events and record them.
• Keep the engagement team in the loop on why a test exists, not only what it returns.

Controls over the tools

The tools hold client data, so the controls in cybersecurity for CPA firms apply: role-based access, multi-factor authentication, vendor oversight and logs. Generative AI features are governed separately. See using AI in workpaper preparation and auditing AI-generated inputs to financial reporting.

Rolling it out

1. Pick one task with clear rules and measurable effort, such as tick and tie or rollforward.
2. Baseline the hours the task takes under the manual process.
3. Pilot on one engagement, with manual reperformance in parallel.
4. Compare results, record differences and fix the configuration.
5. Write the procedure and the review expectations.
6. Train the team, including the reviewers.
7. Roll out to more engagements, and track hours and errors.
8. Reinvest the time in higher-risk areas, which is the purpose. See engagement economics.

Quality management link

The firm's system of quality management should cover technological resources: how they are acquired, implemented, maintained and monitored. See SQMS 1 quality objectives and risk assessment process and audit software categories.

FAQ

Does automation reduce the need for review?

It changes what is reviewed. Review of inputs, configuration and exceptions replaces review of arithmetic.

Can automated testing replace sampling?

Full-population tests can cover more than a sample, and the auditor still evaluates the results and the population.

Who is responsible for an automated step?

The engagement team, which owns the conclusion.

CORAA prepares ready-to-review audit files for US CPA firms; see /us.

Sources

• FTC, Standards for Safeguarding Customer Information (Safeguards Rule), 16 CFR Part 314: https://www.ecfr.gov/current/title-16/part-314
• NIST, AI Risk Management Framework: https://www.nist.gov/itl/ai-risk-management-framework
• IRS, Publication 4557, Safeguarding Taxpayer Data: https://www.irs.gov/pub/irs-pdf/p4557.pdf

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error