AI in auditing: what it does, what the standards require, and the tools

How AI is used in audits

Most audit AI falls into five kinds of work. The first three gather or organize evidence; the last two help the auditor think and write.

Full-population testing

Scoring each journal entry or transaction against risk criteria, such as unusual users, timing, amounts or account pairs, so the team tests the population instead of a hand-picked sample.

Evidence extraction and matching

Reading invoices, bank statements, contracts and confirmations, pulling out the figures and tying them to the ledger: vouching and tracing at volume.

Financial statements and disclosures

Tying out the statements to the trial balance, suggesting disclosure checklist answers and checking footnotes for internal consistency.

Risk assessment

Suggesting risks and affected assertions from the trial balance, prior-year files, minutes and industry information.

Research and drafting

Answering technical accounting and auditing questions with citations, summarizing client documents, and drafting memos and workpaper narratives.

How far along firms are varies. In July 2024 PCAOB staff reported that among the large firms they interviewed, generative AI in audits appeared "focused primarily on administrative and research activities," though most saw potential in planning and performing the audit (PCAOB (opens in a new tab)). Analytics on full populations, the first item above, is the use the standard setters have addressed most directly.

What PCAOB standards require: the technology-assisted analysis amendments

The PCAOB adopted amendments to AS 1105, Audit Evidence, and AS 2301, The Auditor's Responses to the Risks of Material Misstatement, on June 12, 2024. They apply to all audits under PCAOB standards for fiscal years beginning on or after December 15, 2025, so for calendar-year companies, 2026 audits are the first under them (PCAOB (opens in a new tab)). The PCAOB said they're meant to reduce the risk that an auditor using technology-assisted analysis issues an opinion without sufficient appropriate evidence, and to address some auditors' reluctance to use such analysis at all (PCAOB (opens in a new tab)).

PCAOB staff published guidance on October 1, 2025, with examples of evaluating the reliability of external information the company provides in electronic form, and the Board issued a policy statement on implementing paragraph .10A of AS 1105 (PCAOB Release No. 2025-004). Both are linked from the PCAOB's implementation page (opens in a new tab). Data and technology also remains one of the PCAOB's research projects in the agendas it updated on September 30, 2026 (PCAOB (opens in a new tab)).

AICPA audits: SAS No. 142

For private company and other non-issuer audits under AICPA standards, SAS No. 142, Audit Evidence, is effective for audits of financial statements for periods ending on or after December 15, 2022. The AICPA describes it as principles based: it sets a framework for judging evidence rather than steps to follow (AICPA & CIMA (opens in a new tab)). Three points from the AICPA's summary bear directly on AI tools:

• Auditors consider the reliability of information whatever its source. The AICPA says not to assume information from an external source is better than information from an internal one.
• Evidence is judged on attributes such as accuracy, completeness, authenticity and susceptibility to management bias, which are the same questions to ask of data a tool has extracted.
• The standard refers to automated tools and techniques, and the AICPA notes that audit data analytics can examine entire populations and can serve risk assessment and substantive objectives at the same time.

The AICPA's summary also points to critical thinking about biases, including confirmation and anchoring bias. That applies with extra force to AI output, which arrives looking finished.

Generative AI in audit work

Generative AI is the newest of these uses. In the PCAOB staff's 2024 outreach, firms reported continued investment in GenAI tools while acknowledging their limitations and "the need for strong supervision of its use to guard against risks, such as data privacy and security" (PCAOB (opens in a new tab)). In practice that means a few firm-level controls:

• Use enterprise plans with written data terms for any client information, and keep client data out of personal accounts. The provider terms for ChatGPT, Claude, Copilot and Gemini are compared in AI chatbots for accounting.
• Check each citation an assistant gives to a standard, a client document or a cell. Research tools that cite authoritative literature make this faster, not unnecessary.
• Keep the evidence, not the chat. The workpaper should show what the auditor did and concluded; an AI draft is support for the reviewer at most.
• Record which tool and version produced an analysis that was relied on, so the reviewer and inspectors can follow it.
• Cover AI in the firm's quality management and AI acceptable use policy, including who may use which tools on which engagements.

For a policy to adapt, see the AI acceptable use policy template.

AI audit tools in the directory

Audit tools in the directory, with the line from each one's documentation that describes what its AI does in an audit. Some run inside Excel, some inside an audit platform and some as separate web apps.

More detail, including filters and side-by-side comparisons, is on AI audit software.

Evaluating an AI audit tool

Will AI replace auditors?

The standards place the evidence and the opinion on the engagement team, and nothing in the recent amendments changes that. What changes is the work: less keying and sampling, more evaluating exceptions, reviewing tool output and documenting judgment. The BLS outlook for auditors, and more on what audit AI does, are in Will AI replace auditors?.