Sufficient and Appropriate: artificial intelligence, audit evidence and professional scepticism

Artificial intelligence in audit now has its first regulator guidance, and the practical problem has moved from permission to proof.

Nothing in this article constitutes legal, audit or regulatory advice. It is offered to support discussion and further review with qualified advisers.

What does artificial intelligence change about audit evidence?

Artificial intelligence in audit changes what a team can examine. The test of sufficient appropriate audit evidence stays where it was, because a generated output remains information until a procedure is applied to it. The Financial Reporting Council states that the human auditor is always accountable, so the file must show the basis for reliance.

• The Financial Reporting Council published guidance on artificial intelligence in audit on 30 March 2026, describing it as the first issued by a global audit regulator.
• A thematic review of the six largest UK audit firms, published in June 2025, found that no firm monitored what a tool did to audit quality after deployment.
• American amendments on technology-assisted analysis took effect for fiscal years beginning on or after 15 December 2025, so firms with US-registered clients are already inside it.
• Five of the six ways these tools fail in an audit leave a file that still looks complete, so the controls have to sit in the design.

Auditing has spent a century refining what counts as sufficient appropriate audit evidence. Artificial intelligence in audit arrived with a great deal to say about how work gets produced and almost nothing to say about that older question.

The question in front of a firm has moved from what might be required to what has been said. What remains is the work of showing that a given tool, used for a given purpose, produced something the firm was entitled to rely on. That work is documentary.

When does information become sufficient appropriate audit evidence?

An auditor gathers information, performs procedures on it, and what survives the procedure supports an assertion. Nothing in that sequence changes because the information arrived through a model. What changes is the volume, the apparent authority of the presentation, and the ease with which the procedure can be skipped without anybody noticing.

The International Auditing and Assurance Standards Board has put that distinction at the centre of its drafting. Exposure drafts released in August 2026, open for comment until 15 December 2026, propose an input and output model under which information becomes audit evidence once procedures have been applied to it. They also strengthen the evaluation of authenticity and add requirements on professional scepticism aimed at confirmation bias. None of it is final, and all of it indicates direction.

Read against practice, that framing names the failure precisely. A generated summary filed on its own is information dressed as evidence, while the same summary filed alongside the minutes it cites, with significant matters agreed back to source, carries a procedure behind it.

What does the FRC guidance on AI actually require?

The guidance identifies three categories of risk, which are the misuse or misinterpretation of outputs, deficient output arising from flawed system design, and a methodology that fails to comply with auditing standards. Only the second is a technology problem. The first concerns training and supervision and the third concerns methodology, which places two thirds of the regulator’s concern inside functions a firm already runs. It declines to prescribe a uniform validation protocol, leaving the extent of mitigation to professional judgement.

Elsewhere the position is firmer. Amendments adopted by the American oversight board took effect for fiscal years beginning on or after 15 December 2025, so a UK firm auditing an entity registered there is inside a requirement now. Where a company supplies information in electronic form, the auditor establishes its source, tests either the information or the relevant controls, and investigates the items an analysis flags. On my reading the third obligation will be missed most often, because a tool that flags 4,000 items creates an obligation to investigate 4,000 items.

Which layer of accounting firm AI governance do inspections find missing?

The Council had examined certification nine months earlier. Its thematic review, published in June 2025 and covering the six largest UK audit firms, found that certification maturity varied and some firms lacked documented policies. No firm performed formal monitoring to quantify what a tool did to audit quality after deployment. Data-validation requirements were inconsistent, and some templates omitted any check of input data for completeness and accuracy. Recertification triggers were informal, relying on a tool owner to raise the need.

Closing that gap takes a few indicators reported on a regular cycle. A firm can count the teams using a tool for its certified purpose, the rate at which reviewers correct or reject its output, and the results of a standing regression set rerun after each supplier update. The most informative signal is the number of engagements where a tool was abandoned mid-audit. An inventory underpins all of it, reaching tools embedded in software the firm already licences and the unsanctioned use that a 2026 survey of 1,816 professionals put at around a third.

Five of the six ways this fails leave a file that looks complete

The risks the regulator published are organised around the tool. Organising them around the file serves a firm better, because the file is what an inspector reads. I propose the grouping below.

• Evidence substitution puts a generated output on the file with nothing to show what procedure was applied to it.
• Completeness illusion arises where the tool reports accurately on the material supplied and the population itself goes untested.
• Scepticism decay sets in where the team tests the tool’s explanation without forming an independent expectation.
• Documentation without basis leaves working papers carrying conclusions in language that reaches beyond the underlying evidence.
• Silent tool change occurs where a supplier update alters behaviour mid-engagement and earlier results are still treated as comparable.
• Synthetic evidence enters the chain from outside the firm, in fabricated invoices or confirmations.

Only the last is caught by review, and then only where authenticity has been tested. A tool asked to extract audit-relevant matters from 18 months of board minutes can report faultlessly on every meeting whose pack it received, while a further meeting, filed under another naming convention, never reaches it. Requiring every extraction tool to report its denominator converts an unsafe negative into a testable one. A tool that surfaces contradictory evidence alongside corroborative evidence removes another failure mode cheaply.

Why does generation get cheaper while the work gets more expensive?

A business case that counts hours saved in production has priced generation alone. Generation becomes nearly free, and the binding constraint moves to verification, which in an audit practice falls to managers, directors and partners. Those are the people a firm can least afford to occupy.

The test takes a minute. Set the cost of producing the work by hand against the cost of generating it and then checking it to the standard the work requires. Verification cost is a design property. Extraction with pointers to source is cheap to check, because a reviewer agrees a sample back and tests the rest. A generated conclusion resists checking altogether, since the conclusion is the output and nothing exists to agree it back to.

Evidence on whether this improves audit quality is thin in a specific way. A study of 36 large audit firms, using more than 310,000 curricula vitae, reported that a one standard deviation increase in recent artificial intelligence investment was associated with a 5.0 per cent reduction in restatements. That association covers a period preceding generative tools, so it indicates direction, and the merits of any current product remain an open question.

My own expectation is that the inspection cycle will supply the first real evidence on artificial intelligence in audit, and that the first finding will concern audit documentation. A wrong answer will come later. Automation raises the volume of work a file must account for, but leaves the standard of that account where it was, so accounting firm AI governance succeeds or fails on one discipline. An audit file should show what a generated output was checked against and by whom, because that is what an inspector can test and what separates reliance from assumption.

Frequently asked questions

Does the FRC guidance on AI allow auditors to rely on generative tools?

The guidance leaves reliance to professional judgement. It states that the human auditor is always accountable and describes confidence as built through system design, certification, staff education and governance, and human oversight. A firm still shows why a tool suited its use.

When does a generated output count as sufficient appropriate audit evidence?

It counts once an audit procedure has been applied to it and the file records that procedure. A summary filed on its own is information. The same summary, filed alongside the source it cites with significant matters agreed back, is something an experienced auditor could follow.

How does artificial intelligence affect professional scepticism?

Experimental work published in 2022 found that auditors proposed smaller adjustments to management’s estimates when contradictory evidence came from an artificial intelligence system than when the same evidence came from a human specialist, which the authors concluded could impair audit quality. Whether generative systems behave the same way remains open. International drafting now adds requirements aimed at confirmation bias.

What should audit documentation record when a tool has been used?

A working paper should name the tool and version, the purpose it served, what the output was checked against, how much was checked, and who performed the check. Automation increases the volume of work, yet the record is held to the same standard. An inspector still asks whether an experienced auditor could follow it.

Where should accounting firm AI governance start?

Start by separating tools that support work from tools that contribute to a conclusion, since the assurance burden differs by an order of magnitude. Build the certification record next, covering intended use, testing, approval, review date and the events that trigger recertification. Monitoring after deployment comes third. Inspection work found that step the hardest to demonstrate.