Despite challenges and concerns related to AI adoption and use, organizations are rapidly experimenting with and, in some cases, adopting this technology. Some question whether AI is another technology with false promises and misleading expectations. They assume they can continue their current practices, as they have with previous technologies. Others point to stock market valuations to support the idea that this time, the new technology is different. They also identify heightened client pressures for professionals to become more adept in using and managing AI with the hope of delivering better professional services at a lower cost.
CPAs face challenges from evolving technologies and must gain the necessary education and expertise before they can deliver value to clients. This includes maintaining current competency skills, acquiring and mastering new knowledge, and gaining practical experience. The CPA Journal article “Strategies for CPAs to Become Artificial Intelligence (AI) Savvy” provides a sampling of educational opportunities to begin one’s AI journey (https://tinyurl.com/3w4z8tpa).
Prioritizing what to learn and how much, especially in auditing, can be overwhelming. The level of knowledge required to audit, manage, oversee, or maintain a business conversation regarding the area under audit has been debated. The profession continues to define evolving audit considerations for the implementation and use of AI. Many CPAs are concerned with whether the use of AI involves nontraditional financial considerations that can materially impact actual financial reporting information.
Adding to the confusion is the overwhelming guidance available, ranging from the simple to the highly technical. Vendors and others in the sales cycle may produce biased perspectives that encourage the use of their products or services, making it challenging to rely on such materials. Fortunately, many practitioners have access to various tools and guidance published by accounting-related professional organizations that can help address these challenges.
Understanding the Auditor’s Role
Given the amount of knowledge needed to master AI, individuals should define their goals. For some, developing knowledge to perform simple queries may suffice. Others require subject matter expertise that may go beyond what professional accounting societies typically provide. Regardless, the latter’s tools can be used to jump-start efforts and identify areas needing further attention.
Delivering growth and reliable information to their members and the general public is among the benefits provided by professional associations. In many cases, whitepapers, guidance papers, and continuing professional education can provide quality information that allows practitioners, whether in public or private, to better focus on what they need to know. Additionally, professional associations enable practitioners to benchmark what their peers or competitors are learning about AI and its applications, and how they are putting this information into practice. Some associations provide learning frameworks that facilitate an individual’s ability to design a learning plan targeted to their needs, while leveraging peer advice for developing skills.
Similar to the auditing tasks they execute with traditional information systems, CPAs can perform comparable roles related to AI environments. From a core audit perspective, each auditor is a user of technology. Those performing auditing services, whether external or internal, will need to consider evolving controls to manage applicable risks. Sometimes, especially in assurance-related services, CPAs may be asked for advice on best practices and changing controls for new AI environments and their supporting technologies.
One way to better understand how AI is impacting audit and assurance services is to see how competitors and larger firms are addressing the issue. This understanding should encompass not only implications for individuals, but also industry practices. CPA.com, a subsidiary of the AICPA, provides significant resources that can help CPAs gain a deeper understanding of how the profession intends to utilize AI and one’s potential role within it.
Reading industry-impacting reports such as “CPA.com 2025 AI in Accounting Report” can provide a good introduction to current and planned firm AI strategies, enabling an auditor to jumpstart their efforts (https://tinyurl.com/bdh22et7). Sections address key current topics, trends to watch, where quick shifts are happening, strategic implications for the profession, a roadmap for firms, and a section on reflective exercises to evaluate opportunities. The latter two are especially helpful as they provide the opportunity to understand how firms and corporate environments are planning to use and implement AI. CPAs can gain insight into not only competitors’ activities, but also into AI business trends and tools used by clients.
AI-Focused Guidance for Audit and Assurance
AI can be used in a more traditional role that involves auditing and assessing the reliability of information. These include, but are not limited to, producing information used in financial statement reporting, data queries, and applying various forms of analytics–from past to future. It can also be used to assist in testing for regularity and other contractual compliance responsibilities. The following is a sampling of frameworks, guidance, and whitepapers published by accounting-related organizations.
The Center for Audit Quality provides guidance to help auditors and audit committees (https://tinyurl.com/2s3zssyc). Representative publications include “Audit Committee Oversight in the Age of Generative AI” and “Auditors and AI in the New Era of Audit.” A two-part webinar, “Artificial Intelligence 101 for Audit Committees,” discusses how AI is used in financial reporting from a committee member’s perspective.
The Information Systems Audit and Control Association (ISACA), through its Certified Information System Auditor (CISA) certification and Control Objectives for Information and Related Technology (CoBIT) framework, has played a prominent role in advising the profession about technology-related risks and audit challenges, and AI is no exception. ISACA’s AI resources page provides resources to learn AI and audit processes (https://tinyurl.com/rxbnyhzw). Although some resources may be available behind a paid firewall, others are available for free. Their Artificial Intelligence Audit Toolkit remains the most well-known resource of its kind. Another development is the Advanced in AI Audit (AAIA) credential. Per the candidate guide, this exam is “designed for IT Audit professionals with a CISA, CIA (IIA) or CPA (AICPA) certification looking to gain recognition for their expertise, assuring AI-driven processes comply to the highest industry standards” (https://tinyurl.com/38zar6jk).
Another helpful reference for auditors is CPA.com‘s “Security and Risk Considerations: Safeguarding Validity, Privacy and Transparency” (https://tinyurl.com/4vb8mbuw). This publication is an excellent summary to facilitate a practitioner’s introduction to managing AI-related risks. Although it has a generative AI focus, its principles can easily be leveraged to consider many of the AI-related business risks. The infrastructure vulnerability section and the five key risks sections are invaluable to those new to assessing controls in this area.
The Institute of Internal Auditors (IIA) has created an Artificial Intelligence Knowledge Center (https://tinyurl.com/ytb5wyr6) whose purpose is to provide internal audit professionals with topical guidance. Of special interest, IIA’s four-part “Artificial Intelligence Auditing Framework” provides an internal auditor’s and risk management perspective in AI. From an audit governance perspective, users will appreciate models that describe the roles of each of the “three lines of defense.” Auditors will understand the practitioner’s guide that provides a checklist that can be used as an audit program.
“Closing the AI Trust Gap: The Role of the CPA in AI Assurance” is a paper published jointly by the AICPA and CPA Canada. Emphasizing governance and risk management, it provides CPAs with a fundamental baseline of practices that many companies should be following (https://tinyurl.com/mrxk755c). Readers will also find a helpful chart, initially prepared by Boston Consulting Group and updated by EY, which identifies AI corporate governance practices, voluntary guidelines and standards, and laws and regulations.
The Association of Chartered Certified Accountants and EY published “AI Assessments: Enhancing Confidence in the Use of AI” (https://tinyurl.com/427fh9fn). Although not necessarily geared to financial statement audits, it provides a summary of international standards and guidelines, typically non-accounting related and focused on AI.
Advice is Available
Despite the technical complexities and challenges in applying classical audit procedures, ample advice is available. AI presents a new challenge for auditors, as the source of data may not be traditional data stores. No matter the technology, it is an auditor’s responsibility to figure out the most efficient and effective method to perform the procedures in accordance with professional standards and within acceptable risk tolerances. By understanding what other professionals are doing, CPAs can leverage the experience of competitors, along with a review of procedures provided by professional associations. Like anything, developing new techniques requires discipline, a commitment to training, and, in some cases, experimentation. More importantly, to remain competitive, auditors may soon find that they must adapt new techniques and leverage the technology for its benefits. Hopefully, most CPAs will adjust and be able to not only continue but also expand the value-added service they provide to clients.
