AICPA AI Audit Guidance: What Auditors Will Ask Clients

The American Institute of CPAs issued a 51-page practice aid on October 13, 2026 telling auditors how to assess a client’s use of artificial intelligence and how to use AI tools in their own work. The AICPA AI audit guidance is nonauthoritative.

The document is titled Artificial Intelligence (AI) Considerations for Financial Statement Auditors. The AICPA announced it as a framework covering two areas: how an organisation’s AI use in financial reporting and controls affects the audit, and how audit firms use AI tools to perform it.

For finance teams, the first area matters most. If a company uses AI to draft journal entries, classify transactions, estimate reserves or reconcile accounts, its auditor now has a published structure for asking how that tool works, what data feeds it and who checks its output.

What the AICPA AI audit guidance covers

The practice aid has two sections. Section one deals with an entity’s use of AI. It explains how AI differs from ordinary automation and covers data quality, the capabilities the audit team needs, whether AI affects financial reporting, new risks and controls over AI.

Section two deals with the audit firm’s own use of AI tools. It covers quality management policies, team competence, firm planning for intended AI use and partner responsibilities for approving and supervising tools.

The AICPA said more material will follow. Section one will gain guidance on assessing the risk of material misstatement and on evaluating audit evidence when a client uses AI, and section two will gain further questions and answers.

Jennifer Burns, the AICPA’s chief auditor, set out the central principle.

“Ultimately, the auditor remains responsible for the audit and the audit opinion.” Jennifer Burns, Chief Auditor, AICPA

The aid applies that principle to supervision, review and audit conclusions. Engagement partners must understand the AI tools their teams use, confirm the firm has approved them and check that staff use them correctly.

Status: practice aid, not an AU-C standard

The AICPA describes the document as nonauthoritative guidance on considering AI in a financial statement audit. It does not amend the AICPA’s AU-C standards and does not create new requirements.

The AICPA is a professional body. It cannot sanction auditors through a practice aid, and the document carries none of the force of a standard.

The AU-C sections remain the rules for audits of private companies in the United States. Risk assessment sits under AU-C 315, audit evidence under AU-C 500 and audit documentation under AU-C 230. The practice aid shows how an auditor might apply those requirements when AI is involved.

Audits of US public companies fall under the Public Company Accounting Oversight Board, which sets its own standards. A practice aid from the AICPA does not bind those engagements. Firms that work under both regimes will still need to map any AI procedures to the standard that applies to each audit.

That split affects how much weight a CFO should give the document. It is guidance that firms will use to shape their questions, not a rule that a client can cite or be penalised under.

Hallucinations, scepticism and unreliable AI output

Section one lists the new risks that AI can introduce: data risk, model risk, hallucinations, explainability and bias. Hallucinations, where a model produces plausible but false output, sit alongside the older concern that a model trained on poor data produces poor results.

The aid says the quantity, quality, accuracy, completeness, relevancy and diversity of data can each affect whether an AI system is reliable. An auditor testing a client’s AI-generated estimate would therefore look first at what went into the model.

Amy Pawlicki, the AICPA’s vice president of assurance and advisory innovation, said that AI tools are already benefiting the efficiency and effectiveness of both financial statement preparation and the audit, but that “these tools can introduce new risks that auditors must be cognizant of.”

Professional scepticism appears in both sections. Section one says an audit team may need a blend of auditing expertise, AI knowledge, data skills, professional scepticism and specialist support. Section two calls for continued attention to professional judgement and professional scepticism when the firm itself relies on AI.

The practical point is that an AI output is not audit evidence because a tool produced it. An auditor who uses AI to summarise a contract or flag anomalies must still decide whether the output can be relied on, and must be able to show how.

On documentation, the practice aid sits beside AU-C 230 rather than replacing it. Firms should expect to record which tool was used, what it was asked to do and how its output was checked. That is an inference from the existing standard, not a new requirement in the aid.

What finance teams should expect their auditors to ask

The aid states that a client’s use of AI does not change management’s responsibility for the financial statements. Management owns the numbers whether a person or a model produced them.

It also ties a client’s AI use to acceptance and continuance decisions, so a firm may weigh that use before taking on or keeping an engagement. Finance teams should expect these questions in the planning stage:

Where AI is used in preparing the financial statements or in controls over them.
What data trains or feeds each tool, and how its completeness and accuracy are checked.
Who reviews AI output before it reaches the ledger, and how that review is evidenced.
What happens when a tool returns an error or an unexplained result.
Which third parties supply the models.

Burns told reporters the way an entity responds when data goes wrong would feed into the auditor’s assessment of its AI controls. A company with no written policy for AI use will find that harder to answer than one that has already set one. Our guide to AI agent governance for finance teams covers where to start, and the AI literacy and AI use pack gives teams a template for a use policy.

The aid includes a question on whether an engagement letter must disclose the auditor’s use of AI. Auditing standards do not require it, but laws, contracts or firm policies may. Some US states require licensed professionals to disclose certain AI uses in advance, and that disclosure can appear in the engagement letter.

What changes in practice for audit teams

Audit leaders will have to decide how far to build AI literacy into teams. The aid’s emphasis on mixed skills puts pressure on firms to add data specialists, and our piece on the digital audit leader describes how heads of audit are already approaching that.

The quality management section matters for smaller practices. A firm that adopts a tool without an approval process, defined uses and partner oversight will find the aid describes what a reviewer would look for.

Pawlicki said the document is meant to help auditors understand how AI affects the work. The AICPA has not named a date for the additional guidance on risk assessment and audit evidence, which is the part most likely to change fieldwork. The full document is available through the AICPA’s resource page.