The audit firm’s AI governance playbook

For many industries, AI adoption is accelerating faster than governance can keep pace, and the audit profession is no exception. While many firms are eager to use AI across the audit lifecycle, most do not yet have the policies, approvals, or checkpoints to use it safely thus leading to increased risk.

According to the 2026 State of Tax Professionals Report from the Thomson Reuters Institute, AI is now the number one technology investment priority for 57% of tax, audit, and accounting firms — up from 47% in 2025 and 35% in 2024. However, only 47% of firms describe their processes as “standardized,” and 36% are still “reactive”, with limited documentation and heavy reliance on individual expertise.

To build a governance structure that keeps pace with AI adoption, today’s audit firms must provide clear answers for staff on a range of practical questions:

• Which AI tools can I use?
• What information can I put into them?
• When do I need approval?
• What level of review is needed on the outputs?
• What do I need to document?

A practical playbook for building AI governance answers these questions with specific policies, use cases, and guardrails for each stage of the audit lifecycle, from pre-engagement and planning to fieldwork and reporting. Because when AI governance is designed correctly, it can become an accelerator for growth rather than an obstacle that increases risk.

Why postponing AI governance is a risky strategy

Today’s audit firms have good reasons to move quickly on AI-powered technology. It can support data extraction and processing, analyze entire populations, identify anomalies, assist with risk assessment, review documents, and help auditors create more coherent summaries and reports. However, the more deeply AI becomes embedded in an engagement, the greater the consequences of unclear governance.

Consider a staff auditor who uses a publicly available AI application to summarize a client document. Was uploading that document permitted? What happens to the information once it enters the system? Can the resulting summary become audit evidence? Does someone need to verify it against the original document?

Or, consider an engagement team using AI to identify unusual transactions. Who determines whether the system is appropriate for that purpose? How are flagged transactions evaluated? What happens if the AI fails to identify something important? Without established policies, individual staff members are forced to answer those questions themselves.

Unfortunately, that is already happening across the professional services industry. According to the 2026 Future of Professionals Report from the Thomson Reuters Institute, 34% of professionals acknowledge using AI tools their organizations have not sanctioned.

The lesson for audit firms is that prohibiting AI without providing practical alternatives is not necessarily governance. Neither is allowing AI experimentation without boundaries. Good governance creates a controlled path for using AI.

AI governance playbook for audit professionals

Pillar 1: Start with a right-sized AI use policy

The foundation for your audit firm’s AI governance strategy should be a written acceptable use policy. The objective is not to anticipate every future AI application — technology will evolve too quickly for that. Instead, the policy should establish principles your staff members can apply as use cases change.

At minimum, your firm should address these four areas:

1. Acceptable use. Define which AI applications are approved and what employees can use them to accomplish. For example, your firm might permit an approved tool for summarizing internal information or drafting correspondence while requiring additional approval before it is used in audit procedures.
2. Data and confidentiality. Specify what information can be entered into each type of system. Client confidential information, personally identifiable information, financial records, and audit evidence may require substantially different protections than publicly available information.
3. Client transparency. Determine when the firm should disclose its use of AI and whether engagement letters, privacy notices, or other client communications need to address AI-assisted processes.
4. Prohibited uses. Establish clear boundaries. Certain tools or activities may be unacceptable regardless of efficiency benefits, particularly where confidentiality, independence, professional standards, or audit quality could be compromised.

The AI tool itself also matters. Professionals surveyed for the 2026 Future of Professionals Report overwhelmingly said that AI used for professional work should safeguard confidential data (96%), ground outputs in authoritative content (94%), and produce reasoning that can be explained and defended (90%).

Those expectations should inform the AI-powered audit solution your firm selects. General-purpose AI may be appropriate for some low-risk tasks, while work involving authoritative guidance, confidential data, or professional conclusions may require professional-grade AI designed for an audit firm environment.

Pillar 2: Build a tiered approval process that does not become a bottleneck

AI governance can fail in two directions. Too little oversight exposes your firm to unnecessary risk. Too much oversight can make legitimate AI use so difficult that your staff either stop using it or work around the rules.

A better approach is tiered approval based on risk. A good rule of thumb is to classify AI use cases into three broad categories:

1. Lower risk. Administrative or productivity activities with little or no connection to audit evidence or professional conclusions. Examples might include brainstorming, meeting summaries using non-confidential information, or initial drafts of routine communications.
2. Moderate risk. Activities involving client information or contributing to audit procedures but not independently determining significant professional conclusions. Examples could include document summarization, data extraction, preliminary research, or assistance preparing workpapers.
3. Higher risk. Applications influencing risk assessment, fraud considerations, audit evidence, accounting conclusions, financial statement disclosures, or ultimately the audit opinion.

Lower risk use cases may simply require the use of approved tools and standard procedures. Moderate-risk applications may require manager review or additional validation. Higher-risk use cases should undergo more formal evaluation involving audit quality, risk, technology, information security, and other appropriate firm leadership. A tiered approach is what makes AI governance scalable.

The same logic can apply when approving new tools. Rather than sending every AI request through one centralized committee, firms can establish predefined criteria that allow routine use cases to move quickly while escalating the applications that could materially affect audit quality.

Pillar 3: Put human review where it matters most

AI may change how audit work is performed, but it does not change who is accountable for the result. The 2026 Future of Professionals Report found that 47% of professionals say final responsibility for errors in AI-assisted work rests with the individual professional. That makes human oversight a critical part of AI governance, although not every AI-assisted task requires the same level of review.

For example, with lower-risk applications, such as drafting routine client correspondence, organizing information, or creating an initial summary, using lighter-touch guardrails may be appropriate. Firms can rely on approved tools, confidentiality requirements, and a basic accuracy check before the work is used or shared.

Human review and sign-off become non-negotiable, however, when AI contributes to work involving professional judgment or audit evidence that could ultimately affect the audit opinion or conclusion. Examples of AI uses include AI-assisted risk assessment, fraud detection, anomaly identification, transaction testing, evaluation of audit evidence, and significant accounting or disclosure conclusions. In these situations, an auditor should independently evaluate the output and not treat AI results as inherently reliable.

The level of human review should increase as AI moves closer to professional judgment or the audit opinion.

• During pre-engagement. AI can help organize information, streamline client communications, or support data collection. Appropriate controls focus primarily on confidentiality, accuracy, and authorized tools.
• During planning. The stakes rise. AI may help identify patterns, anomalies, or areas of heightened risk. But because risk assessment influences the nature, timing, and extent of audit procedures — professionals need to understand, challenge, and validate AI-assisted conclusions rather than simply accept them.
• During fieldwork. AI can process large data sets, select items for testing, analyze transactions, or review documents. Here, reviewers should understand what the AI analyzed, what assumptions or criteria were applied, what exceptions were generated, and how those results were incorporated into audit procedures.
• During reporting. AI can help summarize findings, review drafts for consistency, and assist with financial statement or disclosure preparation. However, conclusions that contribute to an audit opinion require professional evaluation and sign-off.