AICPA issues two-part AI guidance for financial auditors

The American Institute of CPAs has issued a practice aid on artificial intelligence for financial statement auditors, covering both company use of AI in financial reporting and auditor use of AI in audit work.

The publication sets out a framework for assessing how AI affects financial statement audits, focusing on risk, controls and audit responses. It is divided into two sections: one on how an organisation's use of AI can affect financial reporting, and another on how audit firms use AI-related tools during engagements.

The guidance comes as businesses and audit firms adopt AI to varying degrees in accounting, reporting and assurance work. Auditors are advised to determine early in an engagement how far a company relies on AI in its financial reporting, whether directly in accounting processes or indirectly through other business functions.

Issues covered include the distinction between AI and standard automation, and how that difference may affect an auditor's risk assessment. The document also highlights the importance of data quality, accuracy, completeness, relevancy, and diversity in determining whether an auditor can rely on an AI system.

It also addresses audit team composition, noting that firms may need a mix of audit knowledge, AI understanding, data skills, professional scepticism, and specialist support when dealing with AI-related audit issues.

The practice aid points to specific risks that may arise when AI is used in financial reporting, including data risks, model risks, hallucinations, explainability and bias. Auditors are advised to consider how these factors could affect a company's financial reporting and the application of professional standards during the audit.

Two-part guidance

The first section examines how a company's use of AI may affect the audit of its financial statements. It includes discussion of internal controls that underpin an organisation's financial reporting system and may be linked to its use of AI.

The second section looks at audit firms' use of AI-related technological resources. It states that while AI may improve audit quality and efficiency, auditors remain responsible for supervision, review and audit conclusions.

It also outlines expectations for firm-level quality management policies and procedures related to AI tools. These include engagement-team competence, planning for the intended use of AI in specific audits, and the responsibility of engagement partners to understand the tools being used, confirm that they have been approved by the firm and ensure staff use them correctly.

"AI tools are already benefiting the efficiency and effectiveness of both financial statement preparation and the audit in a number of ways," said Amy Pawlicki, Vice President of Assurance and Advisory Innovation at AICPA.

"But as powerful as they are, these tools can introduce new risks that auditors must be cognizant of in fulfilling the critical role they play in performing financial statement audits. This practice aid is intended to help auditors understand and mitigate these risks in a rapidly evolving environment," Pawlicki said.

The institute said it will add further material to the first section, including more detailed guidance on assessing the risk of material misstatement and evaluating audit evidence when a company uses AI. Additional questions and answers are also expected for the section on the use of AI in the audit process.

Broader AI work

The new publication is part of a wider body of AI-related material produced by the institute over the past year. Other work has included guidance on how a service organisation's use of AI may affect SOC 1 and SOC 2 engagements, as well as an ethics-focused article for members.

The expansion of this material reflects a broader shift in the audit profession, as firms weigh the benefits of AI tools against questions of accountability, evidence and oversight. Regulators, standard setters and firms have been grappling with how established audit principles apply when automated systems are involved in producing financial information or supporting audit judgments.

One practical challenge for audit firms is deciding where AI can be used without weakening professional judgment. The guidance makes clear that AI does not displace the auditor's core responsibilities and that firms must maintain quality management systems around any technology used in engagements.

"This section provides practical guidance to auditors when using AI, including considerations for quality management, appropriate supervision and review, and continued attention to professional judgment and professional skepticism," said Jennifer Burns, Chief Auditor at AICPA.

"Ultimately, the auditor remains responsible for the audit and the audit opinion," Burns said.