AICPA’s New AI Audit Guidance: Two Risks Auditors Cannot Treat the Same Way

AI Has Entered Both Sides of the Audit

Auditing AI-assisted financial reporting is not the same as auditing with AI assistance. Each situation creates different questions about risk, controls, evidence and oversight.

The resource is intended to help auditors assess AI-related risks, understand their implications for internal controls and determine appropriate audit responses. The AICPA also emphasises the competence of audit teams and the responsibilities of firms using AI tools.

One qualification is important: this is nonauthoritative guidance. It does not, by itself, introduce a new mandatory auditing standard. Its relevance to Pakistani CA students and practitioners lies in the audit principles and professional questions it raises, not in any assumption that US guidance automatically governs Pakistani engagements.

One AI System. Two Very Different Audit Risks.

The first question is simple: Whose process is using AI?

When the client uses AI

An organisation may use AI to process information, support accounting decisions or contribute to financial reporting. Auditors need to understand how that use affects the reporting process, relevant controls and the risks that could lead to a material misstatement.

The AICPA identifies concerns including the quality and accuracy of data, model risks, bias, hallucinations and limited explainability. These issues can affect how much confidence an auditor places in a process and what further work may be needed.

Consider this hypothetical example: A company uses an AI system to classify expenses. The system consistently places certain repair costs in the wrong account. If those classifications affect reported balances, the auditor needs to understand the source of the error, its potential financial statement impact and the controls designed to detect it.

The issue is not simply whether the AI system works quickly. It is whether its use introduces a risk that the financial statements could be materially wrong.

When the audit firm uses AI

The questions change when an audit team uses AI to assist with its own work.

The firm must consider its policies, the suitability of the tool, staff competence, engagement planning, supervision and review. Partners need to understand the tools being used, ensure they are approved by the firm and assess whether staff are using them appropriately.

Consider another hypothetical example: A trainee uses an AI tool to summarise a large set of documents for an audit workpaper. The summary omits a qualification that changes the meaning of the underlying evidence. The trainee cannot treat the summary as sufficient merely because it appears coherent. The relevant information still needs to be assessed, and the work must meet the engagement's review requirements.

These examples illustrate the distinction; they are not cases reported by the AICPA.

Bad Data Can Put Financial Statements at Risk

An AI system can process large quantities of information without making that information reliable.

The AICPA specifically highlights data quantity, quality, accuracy, completeness, relevance and diversity. These factors matter because an AI system's output depends partly on the information it receives and how its model processes that information.

For auditors, the practical task is to understand where information originates, how it is processed, what controls operate around the process and whether the resulting information can be relied upon for the purpose at hand.

This connects directly to established audit thinking. A system's output is not automatically sufficient audit evidence, and the use of AI does not remove the need to assess the reliability of information.

For CA students, this is the useful connection: technology changes the process, but the auditor still has to evaluate the risk and the evidence.

Firm Approval Does Not Guarantee Proper AI Use

An approved tool is not a substitute for a competent audit team.

The AICPA's practice aid addresses firm-level policies, engagement-team capabilities, planning and the responsibilities of partners for appropriate use, supervision and review.

A tool may be approved for use, but that does not mean every application is suitable for every engagement. Staff must understand the task they are performing, the limitations relevant to that task and how the resulting work will be evaluated.

For trainees, this translates into three practical questions:

• Is the tool approved for the intended use under the firm's policies?
• Do I understand what it produced and what limitations could affect the result?
• Can the work be reviewed and supported using appropriate underlying information?

These are not new universal audit requirements created by this announcement. They are practical questions arising from the responsible use of AI within an audit engagement.

The Auditor Still Owns the Opinion

AI may assist with analysis, but it does not take over professional responsibility.

The AICPA stresses that auditors remain responsible for appropriate supervision, review, audit conclusions and the audit opinion. This reinforces an established principle rather than replacing it with a new one.

The distinction is particularly important when AI-generated outputs appear polished or convincing. Presentation quality does not establish accuracy, and a plausible answer does not prove that the underlying information supports the conclusion.

For professionals, the challenge is to understand where AI affects the engagement and whether the resulting work is appropriate. For students and trainees, the lesson is to understand the reasoning behind an audit conclusion rather than treating a tool's output as the conclusion itself.

What Comes Next? The Evidence Question Remains Central

The AICPA says further material is planned on assessing the risk of material misstatement and evaluating audit evidence when an organisation uses AI. Additional question-and-answer material is also expected on the use of AI in the audit process.

That matters because identifying an AI-related risk is only part of the task. Auditors also need to determine how the risk affects their assessment, what evidence is appropriate and what response is necessary.

The new practice aid begins addressing these challenges, but the AICPA's announcement makes clear that further material is still expected. Readers should not interpret the announcement as a complete resolution of every AI-related audit question.

What Pakistani CA Students, Trainees and Professionals Should Take Away

The announcement is US-focused, and its publication does not automatically change ICAP requirements or the standards applicable to Pakistani engagements. Nevertheless, the issues it raises are relevant to understanding how AI can affect financial reporting and audit work.

CA students: Connect AI-related risks to familiar audit concepts, including internal controls, risk assessment, evidence and professional scepticism.

Articleship trainees: When AI contributes to a process or workpaper, understand its role, the information behind its output and the applicable firm policies and review expectations.

Audit professionals: Consider how AI affects the entity's reporting process, the engagement team's work and the evidence supporting conclusions. Check the professional requirements applicable to the engagement rather than assuming that a US practice aid applies locally.