On October 13, the AICPA published a practice aid that asks auditors two questions at once: how does a client’s use of AI change the audit, and how does the firm’s own use of AI change its responsibilities? Plan to answer both.
The practice aid has two halves, and each one lands on a different desk
The AICPA’s Artificial Intelligence (AI) Considerations for Financial Statement Auditors is built in two sections. The first covers an organization’s use of AI in financial reporting: how AI differs from ordinary automation, how the quality and completeness of data affect reliability, and the new risks AI can introduce, including data risks, model risks, hallucinations, explainability and bias. It also points to the controls foundational to an entity’s internal control system that may relate to its AI use.
The second section turns to the audit firm. It covers quality management policies and procedures for AI tools, the competence of the engagement team, planning for intended AI use on specific engagements, and the maintenance of supervision, review, professional judgment and professional skepticism.
The AICPA describes the guidance as nonauthoritative. It is a guide to applying professional standards, not a standard itself. In a mid-size firm the first half belongs to engagement teams and the second to whoever runs quality management. Treat them as one conversation.
A client’s AI is a risk assessment question before it is a technology question
Section one asks auditors to determine whether the company’s AI use affects financial reporting, and whether the audit team has the skills to assess it. The AICPA lists the blend practitioners may need: auditing expertise, AI knowledge, data skills, professional skepticism and specialist support.
The places where client AI touches the ledger are mundane. PCAOB staff, after outreach to preparers, reported uses such as initial drafts, summaries of standards, benchmarking and less complex, repetitive tasks like account reconciliations. Preparers also described the “blackbox” nature of some tools and a “lack of consistent output” as auditability concerns. That was a staff observation of what companies said, not a standard, but it names the exact spots where an auditor should ask.
The AICPA says more guidance will be added, including on assessing the risk of material misstatement and evaluating audit evidence when a company uses AI. Until that arrives, the first move is a question your firm can ask today: where does AI touch the ledger?
Your own tools carry the duties you are about to test in your clients
Ultimately, the auditor remains responsible for the audit and the audit opinion.
Section two is where the practice aid gets personal. It outlines engagement partners’ responsibilities for the AI tools their teams use on an engagement. Jennifer Burns, the AICPA’s chief auditor, put the liability frame plainly: “Ultimately, the auditor remains responsible for the audit and the audit opinion.” That sentence applies equally to a spreadsheet macro and a generative AI assistant.
The PCAOB staff heard the same expectation from firms in 2024. Firms said they expect generative AI to “augment, but not replace, humans,” and that an engagement team member using a tool “is still responsible for the results and documentation of the work.” Some firms limit what information can be uploaded to their tools, and some do not allow generative AI on audit or attest procedures at all.
A tool that no one has registered cannot be approved, and a tool that no one has approved cannot be supervised. The first test of your own firm is simple: can a partner name the AI tools the team used on an engagement?
One intake question and one tool register, before the next engagement letter goes out
Neither step needs new software. Each needs an owner and an afternoon. The point of writing them down is that an engagement partner can answer two questions from the file, without calling the team: what AI does this client run near its books, and what AI did we run near this client’s work? An answer that lives in someone’s memory will not survive a staff change, a peer review or a claim.
Work through these steps this week, in this order.
- Add one question to client intake and planning: where does AI touch the ledger? Cover reconciliations, drafting, summaries and estimates, and record the answer in the planning file.
- Build a firm tool register that lists every AI tool in use, who approved it, which engagements it may touch and what data may go into it.
- Require the engagement partner to confirm each tool is on the register before the planning memo is signed.
- Write down the review for each use: who checks the output and what they are checking, so supervision and professional skepticism leave a trace in the file.
- Put the follow-on AICPA guidance on the quality management calendar and update the intake question and the register when it lands.
Firms that already run quality management will find most of this familiar. The change is that AI tools now sit on the same list as every other resource the firm relies on to reach an opinion.
A register also gives you something to say to clients. When your intake form asks where AI touches the ledger, you signal that the firm treats the answer as part of the risk assessment, and clients who have not yet inventoried their own tools get a prompt to do so. When you can say which approved tools your own team uses, you answer the next question before it is asked, whether it comes from a client’s audit committee or a peer reviewer.
The practice aid asks auditors to understand a client’s AI before relying on the client’s numbers. It also covers the firm’s own AI, because the auditor remains responsible for the opinion. A firm that can answer the first question about a client and not about itself has not finished reading it.