Generative artificial intelligence (GenAI) is becoming increasingly present in professional services, including audit and assurance. GenAI refers to AI systems capable of generating new content, including text, images, audio, software code and other outputs.
The use of GenAI in audit and assurance continues to evolve, with adoption varying across firms, including small and medium-sized practices (SMPs). Applications range from general-purpose tools supporting research, documentation and communication to more advanced agentic AI systems capable of carrying out multi-step tasks.
Our paper is primarily aimed at SMPs and explores the practical opportunities, risks and considerations associated with using GenAI in audit and assurance engagements.
GenAI cannot replace professional judgement, but it can support auditors in processing and analysing large volumes of information that inform their judgements and assist them in performing audit and assurance procedures.
Across the audit lifecycle, GenAI can help auditors review and summarise documents such as contracts and board minutes, research a client’s industry, compare documents and support the preparation of working papers. It can assist with drafting and communication, including meeting notes, planning documents, internal communications and audit documentation. GenAI can also help analyse unstructured information, such as emails, contracts, reports and narrative disclosures, to identify themes, inconsistencies or areas requiring further investigation.
GenAI may also support audit quality by helping auditors process and navigate larger volumes of information and identify inconsistencies across engagement documentation. By reducing time spent on routine processing and administrative tasks, it can allow auditors to focus more attention on areas requiring professional judgement, analysis and scepticism.
Other opportunities include supporting consistency and knowledge sharing by making methodologies, guidance and previous experience easier to access.
GenAI and other digital technologies may also contribute to making the profession more attractive. By automating repetitive and administrative tasks, technology can allow auditors to focus more on analysis, professional judgement and client-facing activities. This may help create more engaging and rewarding career paths, particularly for younger professionals entering the profession.
The development of GenAI is moving beyond tools that simply respond to individual user prompts. GenAI capabilities are increasingly being combined with tools, data and workflows to create agentic AI systems capable of carrying out multi-step tasks.
These opportunities come with risks that firms need to appropriately manage.
GenAI can generate convincing but incorrect information, commonly known as hallucinations, and may produce different outputs from the same or similar inputs. Auditors therefore need to assess the relevance and reliability of information and critically review GenAI-generated outputs.
Professional scepticism and over-reliance are also important. Persuasive AI-generated outputs may encourage inappropriate reliance, while increasing automation could affect how junior auditors develop the knowledge, experience and professional judgement needed for more senior responsibilities.
GenAI can create confidentiality and data protection risks, particularly when sensitive client information is entered into publicly available tools. Firms should understand how information is stored, processed and protected and put appropriate safeguards in place.
Different levels of familiarity with GenAI may lead to inconsistent or inappropriate use. Clear policies, training, supervision and ongoing awareness are therefore important.
Using GenAI does not shift responsibility away from the auditor. Responsibility for audit evidence, conclusions and compliance with professional standards remains with the engagement team and ultimately the engagement partner.
GenAI can reflect biases in its training data, while the reasoning behind its outputs may not always be transparent. Auditors should therefore critically assess outputs and consider whether they are appropriate for the intended purpose.
The paper groups practical applications into three broad areas: knowledge management, administrative and drafting tasks, and audit procedures and information analysis. The appropriate safeguards and level of human review will depend on the nature and risk of each use case. Agentic AI can cut across all three categories but, as autonomy increases, so does the need for appropriate governance, oversight and review.
GenAI offers significant opportunities for the profession, but human oversight remains essential. Ultimately, professional judgement, accountability and responsibility for audit quality remain with the auditor.
