How AI Is Changing Auditing: What Every Auditor Should Know
AI in auditing is real, but it's smaller than the headlines suggest. Most of it today means software that reads documents and…
AI in auditing is real, but it’s smaller than the headlines suggest. Most of it today means software that reads documents and scans ledgers, while a person still signs off. The rules are moving too: PCAOB amendments on technology-assisted analysis now apply to audits of fiscal years beginning on or after December 15, 2025. This guide covers the use cases, what the PCAOB, AICPA and IAASB have said, the risks you still carry, and the skills worth building.
This article is educational. It isn’t audit or professional advice, so read the current text of any standard before you rely on it.
What AI in Auditing Actually Means
Artificial intelligence in auditing covers very different tools, and they don’t carry the same risk. A script that flags weekend postings is not a language model that summarizes a lease. Here’s one way to sort them.
| Type | What it does | Audit example |
|---|---|---|
| Rules-based analytics | Runs fixed tests across a full dataset | Flagging entries posted after close |
| Machine learning | Scores items by how unusual they look | Ranking journal entries by anomaly score |
| OCR and extraction | Pulls fields from scanned documents | Reading invoice amounts |
| Generative AI | Drafts and summarizes text | A first draft of a memo |
| Agentic AI | Chains steps under human supervision | Deloitte’s Omnia platform |
A 2025 study by Kokina and colleagues splits the field into “simple AI,” such as OCR and data extraction, and complex AI, which was still being developed at the firms they studied.
Where AI Fits in the Audit Today
The best field evidence is modest. That study interviewed 22 experienced audit professionals at large firms and found simple AI in wide use. PCAOB staff heard something similar from firms in 2024: generative AI was used mainly for administrative and research work, such as first drafts of memos.
Planning and risk assessment
Before fieldwork, automated tools can read a full ledger and show where it looks odd. The application guidance in SAS 145 lists risk assessment on large volumes of data, using automated tools and techniques, among the changes technology brings.
Say you profile revenue by day and by user. A burst of entries from one account right after close is far easier to deal with in planning than in week three of fieldwork.
Journal entry testing and full-population analytics
Here the tool tests every entry instead of a sample. The standard cares about what you do next. Under the amended AS 2301, investigating items a tool flags includes “determining whether the identified items individually or in the aggregate indicate misstatements or control deficiencies,” per the PCAOB release.
An illustration, with made-up numbers. A tool scores 40,000 entries and flags 60. The team groups the 60 by reason, such as round amounts or late postings. For each group they pull support, ask the preparer, and write down what they found. The flag is a lead; the follow-up is the evidence.
Document review and evidence extraction
OCR speeds up vouching, but the data still has to be trustworthy. Under the amended AS 1105, testing controls over a company’s electronic information covers, where applicable, IT general controls and related automated application controls.
Picture matching invoices to the sales ledger. If a scan quietly drops a digit from an invoice number, a wrong match can look clean.
Drafting, research and summarization
Generative AI in audit work is mostly about words: first drafts, summaries, research. Firms said in that outreach that “an engagement team member who uses a GenAI-enabled tool is still responsible for the results and documentation of the work,” according to the PCAOB spotlight.
Some firms are also building platforms with agentic features. Deloitte’s Omnia is one, and Deloitte lists “full human-in-the-loop” monitoring as a core feature. We make no claims about how well these tools perform.
What the Standards Say About AI in Auditing
No regulator has issued an “AI auditing standard,” and none has banned the tools. What exists is amendments, quality control rules and proposals. The short version:
| Body | Standard | Status | What it means for AI use |
|---|---|---|---|
| PCAOB | AS 1105 and AS 2301 amendments | Fiscal years beginning on or after Dec 15, 2025 | Reliable electronic data; investigate flagged items |
| PCAOB | QC 1000 | Effective Dec 15, 2026 | Firm technology must be reliable and secure |
| AICPA | SAS 145 (AU-C 315) | Periods ending on or after Dec 15, 2023 | Automated tools in risk assessment |
| IAASB | ISA 500 (Revised), exposure draft | Proposal; comments due Dec 15, 2026 | Guidance on tools; flags automation bias |
PCAOB: AS 1105 and AS 2301 (technology-assisted analysis)
The PCAOB adopted the amendments on June 12, 2024, and the SEC approved them on August 20, 2024. They apply to audits of fiscal years beginning on or after December 15, 2025. Three points matter if you use analytics or AI. Control testing over electronic information covers IT general controls where applicable. A procedure with more than one purpose must achieve “each objective of the procedure.” And flagged items get investigated.
PCAOB: QC 1000 and technological resources
QC 1000, A Firm’s System of Quality Control, takes effect December 15, 2026, according to the PCAOB’s QC 1000 Q&As. Paragraph .51 says technological resources need “capacity, integrity, resiliency, availability, reliability, and security.”
PCAOB staff view on generative AI
The July 2024 spotlight records what firms told PCAOB staff, and it says it is “not a rule, policy, or statement of the Board.” Firms reported that PCAOB standards are “not currently viewed as impediments” to generative AI, and that “human involvement remains essential” to review the output. Read it as a snapshot of firm views, not an approval.
AICPA: SAS 145 (AU-C 315) for private company audits
SAS 145, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, covers risk assessment on US audits of non-issuers, mostly private companies. It applies to periods ending on or after December 15, 2023. The full text sits on the AICPA’s SAS 145 page.
IAASB: proposed ISA 500 (Revised), Audit Evidence
The IAASB released its exposure draft on August 5, 2026, with comments due December 15, 2026. It sits in a package with ED-330 and ED-520. This is a proposal, not a final standard, and it can still change.
On technology, the board chose guidance over new requirements, including an appendix on technological tools. The draft’s explanatory memorandum says generative AI tools “challenge elements of the ‘input-output model,'” and the application material names “placing undue weight or reliance on output from automated systems” as automation bias.
The Risks Auditors Still Own
Kokina and colleagues sort the challenges into six groups. Run any new tool past this list.
Overreliance is the one the IAASB draft names outright. A hypothetical case: an AI summary of a lease leaves out a renewal clause. It reads smoothly, so nobody questions it until a reviewer with the contract open spots the gap.
Will AI Replace Auditors?
Nothing in the evidence here supports a prediction of mass job loss, so we will not make one. Deloitte says its agents let experienced auditors “focus more on complex and judgment-oriented procedures.” That is a firm describing its own product, so weigh it that way.
Picture a staff auditor’s week: less time keying invoice data, more time chasing down why entries were posted at midnight.
Skills Every Auditor Needs for AI-Enabled Audits
None of this calls for a computer science degree. A few habits go a long way.
- Know where the data came from. If you cannot say how it was produced, you cannot call it reliable.
- Treat output as a lead. Test it before you lean on it.
- Write down what the tool did. Record its logic and how you followed up each flag.
- Learn your firm’s rules on client data. Check which AI tools are approved before you paste anything in.
- Pick up basic analytics. SQL, Python or IDEA-type tools are optional but useful.
How to Start Using AI in Your Audit Work Responsibly
Start small and build review in from day one. Journal entry analytics is a good first run because the follow-up is clear.
- Use firm-approved tools only. This fits the QC 1000 focus on technology.
- Pick one procedure.
- Confirm the source data is reliable.
- Decide how flagged items will be investigated and documented. AS 2301 expects it.
- Have a person review every generative AI output.
If agents are on your radar, our explainer on what an AI agent is gives the background.
FAQ
How is AI used in auditing today?
Mostly for extraction and analytics. A 2025 field study found OCR and data extraction in wide use at large firms, with complex AI still in development. PCAOB staff heard that generative AI centered on administrative and research work. A person reviews and owns the result.
Do PCAOB standards allow auditors to use AI?
No PCAOB standard bans it. In 2024, firms said the standards aren’t currently seen as impediments to generative AI. The duties stay the same: reliable data, investigated items, documented work, and human review.
What changed in AS 1105 and AS 2301 for technology-assisted analysis?
They cover controls over electronic information, procedures that serve several purposes, and investigating items a tool flags. The PCAOB adopted them June 12, 2024, and the SEC approved them August 20, 2024. They take effect for fiscal years starting on or after December 15, 2025.
Can generative AI tools like ChatGPT be used on audit engagements?
Nothing in the sources we reviewed prohibits it outright. The practical limit is your firm’s policy on approved tools and client data, and whoever uses the tool remains responsible for the results.
Will AI replace auditors?
The evidence points to a change in the work, not an end to it. Firms in the PCAOB outreach expect generative AI to augment people, not replace them. Expect more investigation and supervision, and less manual keying.
Bottom Line
AI changes how audit evidence is gathered. It doesn’t change who answers for it. The standards already give you a workable frame: check the data, investigate what the tool flags, document it, and keep a person on the review. This week, pick one procedure and run it through the five steps above.
Related Reading
- AI Automation for Business: The Complete 2026 Guide: how automation works across a business.
- AI Tax Software: Can It Really Do Your Taxes? (2026): another place professional judgment still matters.
- Can AI Manage Your Money? What It Can and Can’t Do: the same limits apply to personal finance.
Was this article useful?
Thanks, that helps us decide what to write next.
Spotted a mistake? Report an error and we will fix it, with a dated correction note.
Disclaimer. This article is general information, not financial, tax, or investment advice. Figures describe specific cases at specific dates. Talk to a licensed professional before acting on anything here. Full disclaimer.
