AI Audit Software Guide: Full-Population Testing to Risk Assessment

Deloitte, EY and KPMG have put AI agents into their global audit platforms, while the IAASB’s proposed rules on how auditors use technology stay open for comment until December 15, 2026. AI audit regulation now trails the tools it covers.

For audit partners and finance leaders, the practical question is which tools do which job, and what evidence a regulator will expect a firm to keep about them. The answer differs between the Big Four’s in-house platforms and the products sold to mid-tier and smaller practices.

The UK’s Financial Reporting Council published its first AI guidance for auditors on June 26, 2025. The US Public Company Accounting Oversight Board is still researching the subject. Neither has set an AI-specific rule, so AI audit regulation today means guidance and proposals rather than requirements.

What AI audit software does

AI audit software falls into four working categories. Most products cover more than one, and the labels overlap in vendor marketing.

Full-population testing analyses every transaction in a ledger instead of a sample. MindBridge, which sells to CPA firms and corporate finance teams, says its platform analyses 100% of financial transactions.

Anomaly detection ranks unusual items for follow-up. MindBridge combines statistical models, business rules and unsupervised machine learning, and ranks the highest-risk items with explainable AI. The FRC’s guidance uses a similar case: a tool that flags journal entries that look unusual against the wider population.

Document review extracts data from contracts, minutes and statements, and checks disclosures. KPMG’s Financial Report Analyzer helps auditors complete disclosure checklists. PwC’s Evidence Match module extracts evidence and validates it against documents.

Risk assessment is the newest category. Tools read the financial statements, prior-year files and board minutes, then draft the risks an engagement team should consider before fieldwork starts.

AI audit software at the Big Four

The largest firms build their own platforms and sell them to no one. All four now present AI agents as part of the core audit workflow.

Deloitte announced a unified agentic intelligence network inside Deloitte Omnia on June 24, 2026, in New York. The company said the network supports nearly 85,000 audit and assurance practitioners. Its agents carry out preliminary procedures such as data extraction, evidence analysis and drafting documentation, with preliminary conclusions left for professionals to review.

EY announced in April 2026 a global rollout of agentic AI in EY Canvas, built on Microsoft Foundry, Fabric and Azure. Canvas processes more than 1.4 trillion lines of journal entry data a year and supports 130,000 assurance professionals across 160,000 audit engagements. EY expects agents to support all end-to-end audit activities by 2028.

KPMG added AI agents to Clara in April 2025 for substantive procedures including expense vouching and the search for unrecorded liabilities. More than 95,000 auditors use the platform. Scott Flynn, global head of audit at KPMG International, said the firm was “continuing to build out our AI capabilities with increasingly sophisticated agents in KPMG Clara”.

PwC runs Aura on every audit it performs worldwide. Its Australian firm introduced an AI-native audit platform built with Microsoft in 2025, in which agents assess risk, design the audit plan and test balances, with auditors kept in the loop.

Firms outside the network have no access to any of this. They buy from vendors.

AI audit software for mid-tier and smaller firms

Three vendors dominate the conversation in this segment. ICAEW noted in 2023 that Inflo, MindBridge and Caseware are used quite widely among mid-tier firms.

MindBridge is the full-population specialist. It integrates with Fieldguide, Xero and Databricks, and lists BDO UK as a partner for data-driven audit.

Caseware launched its Verity-powered Risk Suggestion Agent worldwide on October 6, 2026, at CwX London. It is the clearest example of the risk assessment category in a product a smaller firm can buy. Existing Verity licence holders get it at no extra cost.

The agent drafts engagement-specific risks from current and prior-year financial information, existing risks, controls and documents such as board minutes. Auditors can select up to five prior years, which helps separate recurring risks from new ones. Each suggestion stays pending until the practitioner accepts, edits or rejects it.

In a May preview, the agent flagged five risks from a trial balance, board minutes and a prior-year file. One was a $118,000 gap between the trial balance and the net profit in the minutes.

The agent sits in the Plan suite of Verity, which Caseware introduced on May 20, 2026. Caseware chief executive David Marquis said the agent “sits inside the workflow our customers already trust”. The company said engagement data is never used to train AI models.

Inflo, the London-based digital audit platform founded in 2016, covers the audit lifecycle from planning through risk assessment to conclusion, including group audits. Firms comparing these and other products can start with Accountio’s list of the best audit software.

AI audit regulation: FRC, PCAOB and IAASB

The FRC guidance is the closest thing to AI audit regulation from a major audit regulator. It has two parts: a worked example of an AI tool used in fraud identification, and principles for proportionate documentation of AI tools. The scope covers traditional machine learning, deep learning and generative AI.

The regulator published it with a thematic review of how the six largest firms certify automated tools and techniques. It also sets out how its expectations apply when a firm buys a tool from a third party.

“AI tools are now moving beyond experimentation to becoming a reality in certain audit scenarios.”

Mark Babington, Executive Director of Regulatory Standards, Financial Reporting Council

The FRC guidance is not prescriptive and creates no new requirements. A firm that adopts a tool still has to document it, and the guidance says how much explainability is needed depends on how the tool is used.

In the US, AI audit regulation has not reached the proposal stage: the PCAOB has not proposed an AI standard. Its staff reported in a July 2024 spotlight that firms used generative AI mainly for administrative and research tasks, and that auditing standards were not seen as a barrier. The Board’s amendments on technology-assisted analysis apply to audits of fiscal years beginning on or after December 15, 2025.

The PCAOB updated its agenda on May 5, 2026, and issued a request for public comment on June 23, 2026. The request names data and technology, including AI, as a critical emerging issue. The Board plans to consider AI within its existing data and technology research project. The comment period has closed, and commenters did not agree whether AI should be handled through staff guidance or standard setting.

The IAASB is further along on the international standards. In June 2026 it approved exposure drafts of ISA 330 (Revised), ISA 500 (Revised) on audit evidence, and ISA 520 (Revised), with conforming amendments. It published them in early August 2026.

The board chose not to write technology-specific requirements. Instead the drafts clarify how the existing principles-based requirements apply when auditors use technology to obtain and evaluate audit evidence. The draft ISA 500 also carries technology-related amendments to ISQM 1 and ISA 220 (Revised). Details are on the IAASB projects page.

AI audit regulation vs auditing AI systems

The phrase “AI audit” has a second meaning. It also describes independent assurance over a company’s own AI systems, covering bias, controls and governance. That work is a service line for audit firms, not a category of software.

This guide covers the first meaning only: the tools auditors use on financial statements. The distinction matters in procurement, because an AI assurance engagement and an AI audit platform are bought, scoped and regulated separately.

The next step in AI audit regulation comes on December 15, 2026, when comments on the IAASB’s audit evidence proposals close. The PCAOB has said it will continue its research on AI, and has not set a date for any proposal.