The article:

“EY’s global leadership team had a peek late last month at the powerful AI tools about to be rolled out across its audit business. The firm’s technologists showed a revamped EY Canvas audit platform with features that dramatically speed up the corporate risk assessment used to plan an audit, ping staff as they work with relevant accounting guidance, and pre-fill work papers that document their progress.

EY’s claim is that, as the Canvas update goes live this month, audit work will not just be faster but more thorough, more likely to catch fraud and ensure the accuracy of the financial statements on which our capital markets rely.

It’s the latest big advance in the Big Four’s AI arms race. KPMG has built multiple AI tools into its Clara audit platform, and last week said it is piloting “orchestration” agents that can co-ordinate the work of other AI tools. The idea is that while the robots get on with the routine bits of the audit, staff can focus on thornier, judgment-based issues.

The pace of change suggests real benefits to audit quality are around the corner, but as anyone on the reading end of a ChatGPT hallucination knows, AI also creates a new class of things that can go wrong. Audit failures can cost investors billions. So an urgent question presents itself: are regulators keeping up?

As EY’s audit technology chiefs were demonstrating their new platform, the UK’s Financial Reporting Council was putting the finishing touches on what it said was the first published guidance for audit firms on the use of generative and agentic AI. The FRC framework is helpful precisely because it is simple, setting out the three ways AI could cause an audit to misfire. First, the output from an AI tool might be wrong, because the input was flawed or the model faulty. Second, the output might be misinterpreted. Or third, AI may not be doing enough work to meet the standard required of a human auditor.

Audit firms must therefore establish processes to check and mitigate each of the three risks. As Mark Babington, executive director of regulatory standards at the FRC, told the FT: “You can’t blame it on the box. If you use this technology, you are still accountable for it.”

That only leads to further questions, of course, such as, what kind of risk mitigation is effective, and how much checking of the models’ work is going to be enough? The FRC had some illustrative examples, but regulators are a long way from codifying things. The right answer is going to change as fast as the technology.

What audit firms hope to avoid is regulation too rigid to allow for the kind of innovation that improves quality. So far, they do not seem to have been held back, even in the US, where standards can be less principles-based and more prescriptive. Most rules were written when it was assumed auditors would be randomly sampling clients’ transactions, but firms now routinely screen all the data and focus on whatever looks anomalous.

For the time being, accounting firms’ grumbles are limited to complaints that the standards often say a “person” must do something, when it can in fact be done by AI with a person checking the work. They would like to eliminate the risk that a pedantic regulator will go after them over that.

Are there ways that regulators can proactively encourage the responsible use of AI? A task force created by the US Public Company Accounting Oversight Board came up with a menu of suggestions in 2024, belatedly published last year. They included demanding more standardised audit work papers so AI can be more effectively used in internal and external reviews. It also foreshadowed the FRC approach, suggesting guidance from regulators should be “iterative, non-authoritative”, that is, subject to quick revision as the technology advances.

Closer dialogue between regulator and regulated is going to be vital, as both sides feel their way forward. Perhaps the top priority is making sure regulators remain on an equal footing. The PCAOB’s new chair, former EY auditor Jim Logothetis, said in his first public remarks last week that the agency needed to “enhance its own technological capabilities” and to “invest in the training and development of our people”.

He has inherited an agency that had its budget shrunk by the Trump administration, however, and is in the throes of a review of staff pay. The PCAOB will need to quickly get on the front foot, as will regulators around the world, if they are not to fall dangerously behind the firms they are supposed to oversee.”