Highlights
- AI use in audit falls under existing documentation requirements, so firms must be able to explain and support it.
- PCAOB inspectors and peer reviewers will likely ask which tools were approved, what went in, and who reviewed outputs.
- Firms can manage risk with an approved tool list, a usage policy, staff training, and clear review accountability.
AI is already entering audit workflows, whether firms have formally adopted it or not. Staff may use AI to conduct research, summarize documents, identify anomalies in financial data, or perform other tasks. The challenge is ensuring that firms can explain and support its use if an engagement comes under scrutiny.
For firms subject to Public Company Accounting Oversight Board (PCAOB) inspection, this means understanding the risk of AI in audit and being prepared to demonstrate how it was used, what information fed the tool, what it produced, and who reviewed the results. Smaller firms face a similar issue during peer review.
To help firms navigate the complexities, this article explores the use of AI in auditing, what PCAOB inspectors and reviewers are likely to ask, and steps firms should consider to mitigate risks.
Jump to ↓
Why AI use is now an audit inspection question
What are PCAOB inspectors and peer reviewers likely to ask about AI usage in audits?
What is the risk of staff using unapproved AI tools in audit engagements?
What should you document when AI is used on an audit?
How audit firm owners can set the ground rules about AI
Why AI use is now an audit inspection question
AI is becoming increasingly embedded in the audit workflow and reshaping how work is performed. However, the firm’s responsibility to document, support, and defend that work remains unchanged.
According to the Thomson Reuters Future of Professionals 2026 report, 81% of tax and audit professionals use AI at least several times a week. At the same time, 35% said they use AI tools their firms haven’t authorized for work, creating new governance and operational risks.
If the firm can’t reconstruct what information the auditor provided to the tool, what the tool returned, and whether anyone evaluated the output, it becomes difficult to explain AI’s role in the engagement later. This is especially critical if a regulator or peer reviewer challenges the work.
It’s important to note that the fundamental audit documentation requirements haven’t changed because AI has entered the workflow. And, at least for now, there are no specific PCAOB or peer review requirements that broadly address “AI use” as a separate category. The focus remains on whether the firm has met its existing requirements for documenting and supporting the audit work.
That doesn’t mean AI falls outside the existing framework. Guidance is beginning to address the use of technology and its outputs, including guidance in the AICPA’s professional materials and recent PCAOB activity on audit procedures and information in electronic form.
This guidance tends to focus on technology outputs or the use of information in electronic form, rather than creating a separate set of rules specifically for AI. As a result, AI-generated information can fall within requirements and expectations that already apply to technology-assisted audit work.
What are PCAOB inspectors and peer reviewers likely to ask about AI usage in audits?
AI introduces a new dimension to questions that peer reviewers and PCAOB inspectors already ask about the firm’s governance, audit procedures, evidence, supervision, and professional judgment.
Inspectors and reviewers are likely to ask which AI tools were formally approved and included in the firm’s technology policies and resources. They may also want to understand how the technology was validated, who owns it, and who has the authority to change it. As firms adopt new AI tools, they should make sure their quality management documentation reflects those changes.
“The current quality management standards require firms to note what technological resources should be used to complete engagements, and so firms need to make certain that they have updated their documentation for the adoption of any new technology. So, with a lot of firms adopting AI recently, whether you’re doing private company audits or whether you’re doing public company audits, make sure that you do that update,” said Stephanie Lanke, CPA, Principal Consultant for Thomson Reuters.
That creates two related areas of focus: firm-level governance and engagement-level use. At the engagement level, the fundamental questions are much the same as those a reviewer would ask about any audit procedure. For instance, they may ask:
- What did AI do, and what did the auditor do?
- Was the AI output used as audit evidence or to assist with the audit work? What information was provided to AI?
- Was the data valid, accurate, and complete?
- How did the team respond to items identified by AI?
- How was the output reviewed?
The quality of the underlying data warrants particular attention. Audit teams have long had to assess whether the information used in testing is relevant and reliable, and peer review and inspection findings have raised questions about the data’s validity, accuracy, and completeness. AI can amplify this issue. “That output is only going to be as good as the reliability of the inputs,” Lanke said.
Auditors also need to watch for automation bias. Automation bias is the tendency to place too much weight on an electronic or automated result simply because technology generated it. “We don’t want it replacing auditor judgment, and that’s in all of the stages,” Lanke said.
What is the risk of staff using unapproved AI tools in audit engagements?
Firms should clearly identify approved tools and establish policies for handling unapproved ones. They should also train staff on these requirements so they understand which tools are permitted and the risks of using others. Why? Without proper guardrails, unapproved tools can put the firm and its client data at risk. “If firm staff are using [a tool] that’s not approved, that’s potentially a quality management issue,” Lanke said.
That risk is compounded when client information is involved. For example, an auditor might upload confidential client information or a large dataset used in an audit procedure to a tool the firm has not evaluated for security, privacy, or appropriate use. Staff should understand which tools they can use, what information they can enter, and why certain applications are not permitted.
Choosing those tools means looking beyond what AI can do to how it protects information and supports professional accountability. That is the idea behind Fiduciary-Grade AI™, the Thomson Reuters standard for high-stakes professional work that informs CoCounsel Audit & Accounting, an AI assistant built for auditors.
“Client confidentiality is a non-negotiable in audit, and CoCounsel was built with that in mind. Customer data is not used to train CoCounsel or third-party AI models, or to generate output for other customers, and it includes enterprise-grade security and privacy controls,” said Lisa Carroll, Director of Product Marketing, Audit at Thomson Reuters. “Firms don’t have to choose between innovation and trust. They can take advantage of AI while maintaining that confidentiality, security, and accountability that their clients expect.”
High AI use without a governance framework creates risk. Thomson Reuters research shows professionals agree on minimum standards: tools must safeguard confidential data (96%), ground outputs in authoritative content (94%), and produce explainable, defensible reasoning (90%).
AuditWatch training solutions
AuditWatch AI courses cover prompting, ethics, and how to document AI use in workpapers.
Learn more ↗What should you document when AI is used on an audit?
Think of AI documentation as an extension of existing audit documentation. The firm must still show what was done, what was evaluated, what evidence supported the conclusion, and how the auditor exercised professional judgment. The documentation should reflect how AI was used.
“Can a reviewer — and that’s whether it’s me reviewing or peer reviewers or inspections — can they determine what was done, and if they performed those procedures, would they reach the same conclusion? Also, is the work re-performable?” Lanke said.
For AI-assisted work, that means documenting the following:
- What tool was used and why. Identify the AI application and document why its use was appropriate for the procedure.
- What version was used. Different versions of an AI tool can produce different results from the same prompt, making version information relevant to re-performability.
- What information went into the tool. Document the inputs and whether the underlying data was valid, accurate, and complete.
- What came out. Capture the relevant AI output and how it contributed to the audit procedure.
- What the auditor did with the output. Document the human evaluation, corroboration, and professional judgment applied to the result.
- What limitations were identified. If the tool or its output had limitations, document how the audit team addressed them.
- What evidence supported the conclusion. AI output should not stand alone where corroborating audit evidence is required.
- How the work tied to the audit risk. The AI-assisted procedure should remain connected to the relevant risk and the audit response.
Technology can help create that record. For example, CoCounsel Audit & Accounting grounds its responses in FASB, GASB, AICPA, IFRS, and Checkpoint content. It provides citations that show the source of the information, allowing the auditor to verify the underlying material rather than relying solely on the generated response.
“Every answer includes citations, so auditors can see exactly where the information comes from and verify it for themselves,” said Carroll. “That traceability is essential because auditors need to stand behind their conclusions. They can follow every recommendation back to its source and understand how it was reached.”
Added Carroll, “CoCounsel helps automate and document the work, but the professional judgment remains with the auditor.”
How audit firm owners can set the ground rules about AI
Firms don’t need to prohibit AI to manage the risk of AI in audit. They need to establish clear ground rules for its use. That starts with an approved list of AI tools, an AI usage policy, appropriate training, and clear accountability for reviewing AI-assisted work.
Then, use a tool like CoCounsel Audit & Accounting that ties outputs to authoritative content. This creates a more transparent record of AI-assisted work while keeping professional judgment where it belongs: with the auditor.
To learn more about how AI is transforming audit and to get a roadmap for integrating autonomous AI workflows into your firm’s audit processes, check out our white paper From vision to implementation: How to craft your audit firm’s AI strategy.
