Leveraging Artificial Intelligence in Audit Planning

A Framework for Integrating AI into Audit Risk Assessment

Audit risk assessment is a vital phase of the audit process, as it guides auditors in identifying areas of potential misstatement and in determining the nature, timing, and extent of appropriate audit procedures. With the growing complexity of business environments and their massive volumes of structured and unstructured data, AI represents a potential tool to enhance the accuracy, efficiency, and depth of audit risk assessment.

The following framework integrates all kinds of AI [ML, natural language processing (NLP), GenAI, LLM, and Data Analytics] to create a comprehensive approach to audit planning. While the article focuses on risk assessment—per the AICPA’s AU-C 315, as amended by SAS 145, PCAOB’s AS 2110, and IAASB’s ISA 315 (Revised 2019) standards—audit planning involves more than just risk assessment. Professional standards outline specific steps that auditors must follow, including understanding the entity, identifying areas of risk, designing audit procedures, evaluating internal controls, and documenting the audit plan. Under the PCAOB’s standards, in an integrated audit, the auditor’s risk assessment procedures should apply to both the audit of internal controls over financial reporting and the financial statement audit.

AS 2101, Audit Planning, states that an auditor should develop and document an audit plan that includes a description of: 1) the planned nature, timing, and extent of the risk assessment procedures; 2) the planned nature, timing, and extent of tests of controls and substantive procedures; and 3) other planned audit procedures required to comply with PCAOB standards. This framework should reflect these steps, and one must be careful not to simplify it as merely an application of AI in the risk assessment process.

Exhibit 1 illustrates a framework for integrating AI into audit risk assessment. It highlights four interrelated stages: data acquisition, risk identification, analytical modeling, and auditor judgment integration.

The first stage, data acquisition, emphasizes the use of AI-enabled tools to collect and organize both structured data (such as financial transactions, ledgers, and regulatory filings) as well as unstructured data (such as emails, contracts, and industry news). NLP and ML algorithms allow auditors to process these diverse sources at scale, uncovering early signals of risk that might not be made evident through the application of traditional sampling techniques.

The second stage, risk identification, involves applying AI to detect anomalies, patterns, and red flags when identifying relevant assertions about a class of transactions, account balance, or disclosure. ML models can highlight unusual fluctuations in revenue recognition, sudden changes in expense patterns, or inconsistencies in related-party transactions. In industries with complex operational and financial structures, AI can provide predictive indicators of error or even fraud by comparing current data with historical data or industry benchmarks.

The third stage, analytical modeling, integrates advanced algorithms into risk scoring spectrums. Generative AI and predictive analytics can simulate scenarios to assist an auditor in assessing the likelihood and magnitude of risks of material misstatement under different conditions. This stage supports auditors in quantifying significant risk exposures; prioritizing high-risk transactions, accounts, and related disclosures; and efficiently allocating audit resources. Importantly, AI tools are able to improve throughout the engagement as new audit evidence is gathered, creating a dynamic, adaptive risk assessment process.

The final stage, auditor judgment integration, ensures that AI functions as an aid rather than a replacement for professional skepticism. Human auditors must interpret AI outputs and validate them against professional standards, as well as apply contextual knowledge of the client and industry. This stage preserves accountability and ethical responsibility, while enabling auditors to focus on higher-order analysis and decision-making.

An auditor’s assessment of the risks of material misstatement, including fraud risks, should continue throughout the audit. When auditors obtain evidence during the audit that contradicts the initial expectations of risk, they should revise the risk assessment and modify planned procedures or perform additional procedures. AI offers several advantages over traditional risk assessment methods. AI algorithms can “learn” from new data, allowing auditors to adapt to changing risk environments and identify emerging risks in real-time (Onwubuariri et al. 2024).

To ensure this framework is accessible, the technical AI terminology used in this article can be interpreted in practical audit terms. In essence, the AI tools automate tasks that auditors traditionally perform manually—such as reviewing contracts, comparing transactions to historical patterns, identifying unusual journal entries, and detecting abnormal revenue recorded near period end. By translating the analytics into familiar audit indicators, the framework helps auditors focus their professional skepticism on areas most likely to contain material misstatements. The Sidebar includes definitions for the AI terms used in this article.

Data Sources and Tools in AI Applications

An AI-powered audit risk assessment workflow begins with the integration of multiple structured and unstructured data sources. Structured data includes general ledger accounts activity, trial balances, revenue and expense schedules, and accounts receivable and accounts payable subsidiary ledgers. Unstructured data includes contracts, internal control policies, audit committee reports, board meeting minutes, management’s public pronouncements, and regulatory filings. All incoming data is preprocessed in order to cleanse, normalize, and format them for model consumption. Exhibit 2 presents data sources and tools in AI applications.

Natural language processing uses pretrained models such as BERT, BART, and GPT, fine-tuned on audit-specific data from SEC filings, PCAOB findings, financial disclosures, internal audit records, and forensic accounting cases. BERT supports clause-level contract classification and red-flag detection, while BART summarizes lengthy audit reports and identifies judgmental areas in disclosures. GPT models assist with audit planning, anomaly explanation, and plain-language interpretation of AI outputs. Classification models must meet minimum accuracy thresholds and be validated through human review before they are used.

Numerical analysis relies on Pandas, NumPy, and SciPy to calculate transaction patterns, ratio changes, and peer deviations. Machine learning models hosted in TensorFlow, PyCaret, and AWS SageMaker classify inherent and control risks, while GenAI converts results into documentation-ready audit language. Additional tools can detect control failures, segregation of duties issues, and weak control mappings. Dashboards in Tableau and Power BI display risk across assertions and accounts, while explainability tools such as SHAP and LIME help auditors understand and justify findings that are derived from AI.

Risk Identification

Risk identification and assessment procedures are designed to obtain an understanding of the client and its environment, including its internal controls, to assess the RMM. All AI-generated insights are compiled into a risk assessment dashboard, where inherent risk (IR), control risk (CR), and the resulting RMM are visualized across different areas. Audit action plans are then recommended, aligned with risk levels—low RMM areas may rely on automated controls, while high RMM areas may require detailed substantive testing. This workflow facilitates not only audit compliance but also enhanced precision, consistency, and efficiency.

The spectrum of inherent risk refers to the range of possible levels of inherent risk for a given assertion, account balance, class of transactions, or disclosure—depending upon both the likelihood as well as the magnitude of potential misstatement. The spectrum of inherent risk is a concept introduced in AU-C section 315, as amended by SAS 145, to help auditors understand that inherent risk is not limited to high, moderate, or low assessments, but rather exists on a continuous scale. Risks with both high likelihood and high magnitude fall toward the upper end of the spectrum.

Auditors use professional judgment to determine where on this spectrum an inherent risk falls, which, in turn, affects the nature, timing, and extent of planned audit procedures. The spectrum of inherent risk depicts how risks move along a continuum from low to high depending upon the assessed likelihood and magnitude of potential misstatement. For example, in estimating warranty obligations, if the likelihood of misstatement is moderate (being dependent upon management’s estimation process), and magnitude is high (large dollar amount), this risk may fall toward the higher end of the spectrum.

Inherent risk assessment. Inherent risk (IR) refers to the susceptibility of an assertion to a misstatement, assuming there are no related internal controls. The model assesses various IR factors as well as the spectrum of risk associated with operations. Such factors may be quantitative or qualitative and include complexity, subjectivity, change, uncertainty, and susceptibility to misstatements due to management bias or other fraud risk factors (see SAS 145, AS 2110, ISA 315). The following are examples of IR factors:

• Complex transactions: When a company engages in complex transactions such as mergers, acquisitions, or the use of intricate financial instruments or bundled contracts, LLMs and AI tools analyze legal contracts and financial filings to identify these transactions. Anomaly detection models help identify atypical transactions, with the risk level set to high if the complexity increases the chances of misstatements due to transaction intricacies.
• Revenue fluctuations: The GenAI tool analyzes historical revenue data and identifies fluctuations or dependencies. ML models forecast future revenue trends and associated risks, while GenAI reviews earnings calls and reports to identify volatility concerns. The analysis provides insights into whether the fluctuations signal a high risk of misstatements in the financials. For example, if a company’s revenue is tied to a few high-value contracts with recent declines in key revenue streams, the inherent risk level would be moderate or high.
• Inventory valuation: AI tools and data analytics enhance an auditor’s ability to identify patterns of overvaluation [cost vs. net realizable value (NRV)], management bias (i.e., expected sales being overstated), and inventory anomalies that could materially misstate financial statements. For example, for a fashion retailer, inventory represents a high percentage of total assets but quickly becomes obsolete and/or discounted; AI might identify that product prices dropped 20% after year-end, increasing the risk that closing inventory is valued above NRV.
• Impairment testing: In this judgment-heavy area, AI can detect overly optimistic projections of future cash flows, incorrect cost of capital assumptions, misallocation of assets to avoid recognizing impairment, or the disregard of triggering events. For example, an auditor using ML might find that management applied a 10% discount rate while industry peers use 14-16%. AI flags this as an anomaly, thus identifying a higher risk.
• Fraud detection: AI can detect potential fraud in manually inserted journal entries generated by personnel working at corporate headquarters (top level adjustments), especially those that are recorded near period-end, which is often when management override of controls occurs. The AI tool can also scan legal databases and news articles to identify historical fraud cases, which are linked to the likelihood of material misstatements. The risk level is often assessed as high when a company faces ongoing litigation or regulatory fraud investigations.
• Industry and regulatory risks: Industry reports and regulatory filings can be scanned to understand the company’s operating environment and regulatory pressures. ML risk-scoring models assign scores based on current trends in the regulatory landscape. For example, in the fintech sector, where new privacy laws are being introduced, the risk of noncompliance increases, leading to a high inherent risk assessment.
• Management and employee turnover: Significant management turnover, especially in key financial roles, can signal an increased risk of reporting errors and potentially fraud. Analysis is performed on public data such as LinkedIn and news articles, using NLP tools to track turnover patterns. A moderate inherent risk assessment is associated with turnover in financial management roles, as it can lead to inconsistencies in financial reporting and internal control lapses.
• Market risks: Sentiment analysis and predictive models assess external market risks. GenAI reviews market reports and news to gauge external market factors like supply chain disruptions or economic pressures, raising the risk level if these factors significantly impact the business’s financial health, often resulting in assessment of high inherent risk.
• Related party transactions: AI models can review public filings to detect related party transactions, including those not disclosed by management, to assess their transparency and management’s forthrightness. While these transactions are typically disclosed, complex or poorly documented transactions raise high inherent risk due to potential undisclosed conflicts of interest and other related misstatements in financial reporting.
• Warranty obligation estimates: AI, including ML, NLP, and predictive analytics, can help auditors evaluate the reasonableness of warranty obligation estimates by combining historical data, predictive analytics, text analysis, and benchmarking. Use of these tools does not replace the exercise of sound professional judgment, but they potentially provide stronger risk indicators and help auditors focus their procedures where misstatements are more likely to occur.

Control risk assessment. Control risk (CR) is the risk that a material misstatement will not be prevented, detected, or corrected on a timely basis by the effective operation of an entity’s internal controls. It arises when an entity’s internal controls are ineffective, bypassed, or overridden—allowing material misstatements to occur and go undetected. Traditionally, auditors obtain an understanding of internal control and assess control risk through the performance of walkthroughs, sampling, and other modes of testing. With AI, this process can become more data-driven, allowing auditors to identify weaknesses early and to focus testing on high-risk areas. The following are examples of AI-assisted control risk assessment:

• Internal control policies: LLMs can be used to analyze internal control documentation and check for alignment with best practices. If a company has comprehensive and well-documented control policies and the auditor performs sufficient tests of operating effectiveness, control risk can be assessed as low. Weak, missing, or outdated policies increase the risk of misstatement.
• Frequency of control evaluations: For companies with an internal audit function, AI can process internal audit records to assess the frequency and thoroughness of management’s internal control evaluations. If there are infrequent updates or reviews of controls, the control risk level can be assessed as high.
• Segregation of duties: An auditor can use graph-based ML models to analyze the organizational chart and detect potential violations, such as when personnel both authorize payments and perform reconciliations. Poor segregation of duties increases the risk of fraud and errors, leading to high control risk assessments.
• Control breakdown history: Historical data, including past incidents of fraud or control failures, can be analyzed using AI tools. Patterns of recurrent control breakdowns, especially in high-risk areas such as inventory valuation, imply the assessment of control risk should be high.
• Internal audit function effectiveness: AI reviews internal audit reports, identifying deficiencies in the control framework. If the internal audit function is ineffective, especially in critical areas, the risk can be assessed as moderate.
• Control design and operating deficiencies: AI tools can be used to review the design of internal controls and monitor their operating effectiveness. If controls are outdated or are frequently bypassed, such as in reconciliation processes, the control risk can be assessed as high.
• Fraudulent manual overrides: AI can help detect manual overrides in financial statements, such as changes to system-generated invoices or adjustments to revenue recognition modules. Management overrides are a key control risk area under AU-C 315, AS 2110, and ISA 315.
• Oversight by management and audit committee: GenAI can analyze meeting minutes and internal reports to evaluate the level of oversight provided by management or the audit committee. If oversight is limited or inconsistent, the control risk should be assessed as high.

Assessing RMM

Assessing where on the spectrum of inherent risk a particular risk falls is one of the most judgment-heavy aspects of auditing. Auditors must weigh both likelihood and magnitude of potential misstatements, often with incomplete or uncertain information. The risk assessment process helps auditors identify and evaluate the RMM at both: 1) the overall financial statement level, and 2) the relevant assertion level (for significant classes of transactions, account balances, and disclosures). Identified RMM at the overall financial statement level may also affect the auditor’s assessment of significant risks at the relevant assertion level.

The model assists in identifying relevant assertions, which are those audit assertions that have one or more RMMs associated with them, based on an analysis of the likelihood and magnitude of a potential misstatement (assertion-level risk mapping). Significant classes of transactions, account balances, and disclosures are those that have one or more relevant assertions associated with them.

An RMM exists when: 1) there is a reasonable possibility or an actual probability of a misstatement occurring (usually evidenced by a 10–100% estimated likelihood of occurrence), and 2) if it were to occur, there is a reasonable possibility of the misstatement being material to the financial statements. RMM is calculated by combining the results of both the inherent and control risks. Under AU-C 240 (SAS 145), AS 2110, and ISA 240, fraud risks are always assessed as significant risks. Furthermore, when control risk is assessed as high, RMM is always assessed at the same level as inherent risk.

Exhibit 3 sets forth examples of professional judgment in assessing RMM for selected assertions and areas. Consistent with AU-C 315, the AI agent supports the auditor’s responsibility to identify and assess RMM by integrating inherent risk factors, control considerations, and observed data anomalies into a structured RMM rating at the assertion level. In line with AU-C 240, the model also highlights fraud-sensitive areas—such as complex revenue arrangements or indicators of management bias—so that auditors can designate significant risks, exercise heightened professional skepticism, and design targeted procedures while retaining ultimate responsibility for the audit judgment.

Thus, Exhibit 3 summarizes selected assertions or audit areas, the inherent risk drivers involved, the resulting RMM category based on the thresholds above, and descriptions of what the AI identified. Auditors must interpret these results within the context of the audit and modify procedures accordingly. These examples are illustrative. AI tools should be calibrated to the specific audit environment, and auditors must update risk assessments when new information becomes available.

Many audit methodologies employ a risk rating matrix with five categories for both likelihood and impact. Each category is assigned a numeric value from 1 (rare or insignificant) to 5 (almost certain or severe). Combining these scores produces a risk rating between 1 and 25. For example, widely used risk management guidance classifies scores of 1-4 as low risk, 5-9 as moderate, 10-16 as high, 17-20 as very high and 21-25 as extreme. In practice, organizations adapt these ranges to fit their needs.

In the examples in Exhibit 3, which illustrates how AI-derived indicators are mapped to likelihood and magnitude, the combined risk scores are scaled to a 0-1 range by dividing them by 25 (since 25 is the maximum possible score). Accordingly, risks with scores up to approximately 0.30 (equivalent to scores up to 7 or 8 out of 25) are considered low; scores between 0.31 and 0.60 (moderate); scores from 0.61 to 0.80 (high); and scores above 0.80 (very high). These thresholds align with the categories described above and provide a quantitative basis for classifying risks. By referencing established risk management guidance, the thresholds gain credibility and consistency.

Once the AI tool is used to identify and assess the risks, auditors can design and tailor audit procedures to respond appropriately—focusing on gathering higher-quality evidence and performing more extensive testing on high-risk areas. High RMM areas demand extensive substantive testing, while lower RMM areas may be tested less extensively using substantive analytical procedures. In accordance with the key principles in AU-C 315, AS 2301, and ISA 330, the higher the assessed risk of material misstatement, the more persuasive and extensive the audit evidence must be; the lower the assessed risk of material misstatement, the more limited or analytical the auditor’s procedures can be. Thus, risk assessment guides the determination of appropriate audit procedures (the nature, timing, and extent of “further audit procedures”) that best address each risk.

By leveraging AI, the audit process becomes more data-driven and customized, improving the efficiency and effectiveness of risk assessment, fraud detection, and overall audit strategy.

Getting Started with AI

Readiness assessment. First, an audit firm should evaluate its data availability, IT infrastructure, staff competencies, governance policies, and ethical safeguards related to data privacy and algorithm transparency. This assessment helps determine whether existing processes and controls can support the responsible use of AI tools.

Pilot engagements. Next, a firm should determine where AI can deliver clear value with manageable risk—such as large-volume transaction testing, journal entry analysis, or anomaly detection in revenue or expense accounts. Selecting engagements with well-structured data and experienced engagement teams increases the likelihood of successful implementation.

Success metrics. Finally, the firms should evaluate the pilot program, including improvements in audit efficiency, enhanced risk identification, audit evidence quality, and compliance with professional standards. Establishing these metrics allows firms to assess whether AI tools meaningfully support auditor judgment and whether broader deployment is justified, while maintaining appropriate oversight and professional skepticism.

Ethical and Professional Considerations

According to a KPMG survey (“AI in Financial Reporting and Audit: Navigating the New Era,” 2024, https://kpmg.com/xx/en/our-insights/ai-and-technology/ai-in-financial-reporting-and-audit.html), although GenAI is a relative newcomer, companies are hurrying to implement it in their financial reporting processes. The survey reveals that nearly 72% of companies surveyed are piloting or using AI in financial reporting and this number may increase. In addition, 64% of companies surveyed expect auditors to have a role in evaluating their use of AI in financial reporting, providing assurance and attestation over their AI controls.

AI holds significant potential to improve the efficiency and accuracy of financial statement audits, especially in the audit planning stage. To implement AI responsibly, however, auditors must understand AI’s limitations and focus on complementing, not replacing, auditors’ expertise (J. Lanz, “Artificial Intelligence: Evolving Risk Guidance and Considerations,” The CPA Journal, September/October 2023; J. Mökander, J. Schuett, H. R. Kirk, and L. Floridi, “Auditing Large Language Models: A Three-Layered Approach,” Feb. 16, 2023, https://ssrn.com/abstract=4361607; CAQ 2024; K. Kasztelnik, and E. Jermakowicz, “Financial Statement Fraud Detection in the Digital Age,” The CPA Journal, vol. 94, no. 3/4, 2025, pp.32–39). Thus, an AI-enabled audit introduces several important ethical considerations that auditors must actively manage, including:

• Client consent is critical: Auditors should clearly communicate how AI tools will be used, what data will be analyzed, and obtain informed consent—especially when tools rely on sensitive or nontraditional data sources.
• Data privacy and confidentiality remain paramount: Auditors must ensure compliance with professional standards and regulations when handling client data, including secure storage, restricted access, and safeguards against unauthorized use or breaches.
• Explainability and transparency of AI outputs pose a challenge: Many AI models operate as “black boxes,” yet auditing standards require auditors to understand and justify their risk assessments. Auditors must therefore ensure that AI-generated insights can be reasonably interpreted, validated, and documented, avoiding overreliance on opaque outputs.
• Model bias: AI models rely heavily on the quality of the training data. If the data is biased, out of date, or otherwise incomplete, the AI’s analysis may be flawed, leading to inaccurate conclusions. Failure to comprehend and control the models used would constitute an unacceptable deficiency in the audit process.
• Governance: AI solutions may not be identified and managed appropriately and consistently across the company. Adopting a catalog-and-score approach—like Deloitte’s 60+ model review—however, clarifies ownership, risks, and controls for every AI component used in audit planning (Deloitte 2025).
• The use of AI in audits is still evolving: Regulatory standards might not fully address the implications of AI-driven audits. Noncompliance with evolving regulations or improper use of AI tools can lead to legal and financial penalties.
• Continuing education is essential: Certain knowledge and skills are required to develop, deploy, and monitor AI technologies, as well as adequate employee training on how to use AI-enabled tools effectively.
• An excessive dependence on AI tools could lead auditors to overlook critical issues: AI can’t replace human judgment and professional skepticism. AI may struggle with nuanced scenarios that require contextual understanding or ethical considerations.
• Auditors retain full professional responsibility for their judgments, even when using AI: If AI tools fail, produce biased results, or generate misleading conclusions, auditors are ethically and professionally obligated to exercise skepticism, perform additional procedures, and not defer judgment to technology. In essence, AI should augment—not replace—auditor judgment, with accountability remaining firmly with the auditor.

The integration of AI into audit risk assessment requires a systematic framework that balances technology with human expertise. By leveraging AI in data acquisition, risk identification, analytical modeling, and auditor judgment, auditors can enhance the reliability and timeliness of risk assessment and collect sufficient appropriate evidence supporting auditors’ professional skepticism throughout the audit.

Moreover, by continuously flagging outliers and correlations that might not be immediately apparent to humans, AI can reinforce professional skepticism, encouraging auditors to critically evaluate audit evidence rather than inappropriately relying too heavily on management representations. Auditors must still exercise judgment to interpret AI-generated insights, however, and ensure conclusions are grounded in professional expertise and proper application of relevant auditing standards.

Future Directions for AI-Enabled Auditing

AI in auditing is expected to evolve from primarily decision support tools toward increasingly autonomous agents capable of executing defined audit tasks with minimal human intervention. While current AI applications largely assist auditors by identifying anomalies, prioritizing risks, or analyzing large datasets, future systems may independently perform continuous risk assessments, initiate audit procedures, and adapt testing strategies in real time. This evolution raises important questions regarding governance, accountability, and the auditor’s obligation to maintain professional judgment, as autonomy increases without eliminating the need for human oversight.

The growing sophistication of AI also enables the broader adoption of continuous auditing, shifting assurance from periodic, retrospective evaluations to near real-time monitoring of transactions and controls. AI-driven continuous auditing systems can ingest high-volume data streams, flag exceptions as they occur, and dynamically update risk assessments throughout the audit period. This model enhances the timeliness and relevance of audit assurance, but it requires robust data integrity, well-designed exception thresholds, and clear protocols for auditor intervention when anomalies are detected.

Emerging technologies such as blockchain may heighten the impact of AI on audit practice. Blockchain’s promise of immutable transaction records can serve as a reliable data foundation for AI analytics, reducing data reliability concerns and enabling automated verification of transaction completeness and occurrence. When combined, blockchain and AI have the potential to reshape audits from sample-based testing toward population-level assurance, while redefining audit evidence, control evaluation, and the auditor’s role in system design and oversight. Ultimately, the future of auditing will not be defined by artificial intelligence replacing auditors, but by auditors who effectively integrate AI with professional skepticism, ethical judgment, and deep knowledge of auditing standards.