AI for Audit and Assurance at CPA Firms

Audit is the most regulated thing a CPA firm does, and the standards that govern AI in it already exist. No SAS is titled after artificial intelligence, which gets read as a gap. It is not one. Four standards cover it between them, and naming which clause bites is the difference between a defensible file and an argument with a peer reviewer.

The four that govern

SAS No. 142, Audit Evidence. Issued July 2020, effective for periods ending on or after 15 December 2022. It expressly recognizes automated tools and techniques as a means of obtaining evidence, and it gives the attributes to weigh before relying on information: accuracy, completeness, authenticity, and susceptibility to bias. Those four are the evaluation criteria for any AI output used as evidence.

SAS No. 145. Effective for periods ending on or after 15 December 2023. It enhanced the definitions of general IT controls and of risks arising from the use of IT, and it requires identifying the IT applications exposed to those risks and the controls that address them. A tool the audit team relies on sits in the audit's IT environment. A tool the client used to produce the records sits in theirs, and it is a risk to be identified rather than assumed away.

AU-C 230, Audit Documentation. The test is unchanged and it is the one that decides the workpaper question: documentation sufficient for an experienced auditor with no previous connection to the engagement to understand the nature, timing and extent of what was done, the results and evidence, and the significant judgments. A tool in the middle of a procedure does not soften it.

SQMS No. 1. Effective 15 December 2025, replacing SQCS No. 8. Quality management became risk-based: quality objectives, the risks against them, designed responses, then monitoring and remediation. Each firm identifies its own quality risks, and AI use on engagements is hard to leave off the list. The first evaluation of the system is due by 15 December 2026, which makes this the one standard of the four with a deadline still ahead of it.

What AI handles in audit

• Initial document review and categorization
• Transaction sampling
• Anomaly detection
• Risk assessment input
• Workpaper drafting
• Comparative analytics

What auditors handle

• Risk assessment decisions
• Audit strategy
• Substantive testing decisions
• Audit opinion and report
• Quality control review
• Final responsibility for engagement

The audit professional standards (SSARS, GAAS, SQMS) remain the framework. AI accelerates work within the standards.

Compliance considerations

Applicable standards:

• SAS 142, whether the output is usable as audit evidence
• SAS 145, the tool as part of the IT environment on both sides
• AU-C 230, what the workpaper has to let a reviewer reconstruct
• SQMS No. 1, AI use among the firm's quality risks, first evaluation due 15 December 2026
• SSARS for review and compilation, the AICPA Code throughout
• PCAOB standards additionally for issuers

The documentation requirement is the one to get right first, because it is the one a peer reviewer can test from the file alone. What goes in: the tool and version, what it was given, what it returned, what the auditor did to evaluate that output, and who reached the conclusion. The evaluation step is the one most often missing, and a workpaper recording a tool and its output without it has documented an input rather than a procedure.

The workflow

Planning:

• AI assists in risk assessment data analysis
• Auditor judgment determines audit strategy
• Documentation captures AI use

Fieldwork:

• AI accelerates document review
• AI flags anomalies for auditor attention
• Auditor makes substantive testing decisions
• AI assists workpaper drafting

Review and opinion:

• Auditor reviews all AI-assisted work
• Quality management reviews completeness
• Audit partner signs report

Tools

Specialized audit AI:

• MindBridge Ai Auditor
• DataSnipper
• Caseware with AI features
• Built-in AI in major audit platforms

Time savings

• Planning: modest, because the work is judgment about scope and risk
• Fieldwork: the largest gain, and it varies with how document-heavy the engagement is
• Reporting: modest, because drafting is the small part and review is the large one

The compression lands in fieldwork. Planning and reporting are judgment-bound and stay roughly where they are.

What can go wrong

Pattern 1: Inadequate auditor review. Accepting AI output without substantive testing decisions.

Pattern 2: Documentation gaps. AI use not properly documented under SQMS.

Pattern 3: Confidentiality breach. Audit data sent to inappropriate AI tools.

Pattern 4: Quality management deficiencies. Peer review or PCAOB inspection finds issues.

Bottom line

Audit AI in 2026 is established but requires careful deployment under professional standards. The compression is real but the documentation and supervisory discipline are non-negotiable.

For audit-active CPA firms, AI is increasingly competitive necessity. For firms not yet deploying, structured implementation with proper compliance is essential.