Loading...
KPMG Clara runs analytics across 100% of your journal entries. EY Astra drafts audit memo language from flagged conditions. Deloitte Omnia surfaces anomalies before the engagement team reviews them. Your audit committee approved an engagement letter that may not describe any of this — and the PCAOB has signaled that AI-assisted audit procedures carry the same documentation requirements as human-performed ones.
How AI became standard practice inside every Big Four audit — and what the governance architecture looks like from the client side.
Your Big Four engagement team is using AI tools for journal entry analysis, document extraction, and risk assessment synthesis. This is standard practice — but the engagement letter your audit committee approved may predate these tools or describe them in general language that does not reflect current operational scope or data access.
The PCAOB has established that AI-assisted audit procedures carry the same documentation requirements as human-performed procedures. Your audit committee's oversight responsibility includes understanding how AI is used in your audit, what data flows to auditor infrastructure, and whether the documentation standard the PCAOB expects is being met.
This is not a question about whether your auditor is competent or trustworthy. It is a question about whether the governance framework your audit committee operates under was designed for the audit your organization is actually receiving — or for the audit that existed before AI became standard practice.
Defensible if your engagement letter explicitly addresses AI tool usage, data handling, and PCAOB documentation standards. Not defensible if AI scope has expanded beyond what the current letter describes — and for most pre-2023 engagement letters, it has.
Require the engagement team to identify AI platforms in use, procedures they support, data categories processed, and data retention and deletion terms. Does not limit auditor flexibility. Creates the audit committee visibility the oversight function requires.
Request that AI-assisted procedures be documented with the same specificity as human-performed procedures — tool, parameters, output, professional judgment applied. Appropriate for PCAOB-regulated issuers, companies with prior PCAOB findings, and any issuer where inspection risk is elevated.
Have internal audit or an independent third party assess whether the Big Four AI tools in use meet PCAOB documentation standards. Highest governance posture. Right for issuers with significant deficiency history or where the audit committee cannot independently evaluate AI disclosure from the engagement team.
The PCAOB has signaled that AI-assisted audit procedures require documentation to the same standard as human-performed procedures. An audit where AI tools made consequential scope decisions — what anomalies to flag, which flags to dismiss — without documented professional judgment rationale creates inspection exposure that did not exist in purely human-performed audits. The documentation obligation does not diminish because the procedure was faster.
AI audit platforms have progressively expanded the categories of client data they access: structured financial data (established), contract and agreement terms (2022–2023), unstructured communications and board minutes (2024–2025). Engagement letters drafted before each expansion may not accurately describe current practice. The data your auditor's AI platform processes today may exceed what your audit committee approved.
AI journal entry platforms generate flags at a volume that engagement teams triage rather than fully investigate at equal depth. The professional judgment decision about which flags to pursue and which to dismiss must be documented with a professional rationale. A workpaper that records AI flag volume but not the dismissal rationale for each dismissed flag is not compliant with the PCAOB's documentation standard for AI-assisted procedures.
KPMG, EY, Deloitte, and PwC have all announced Microsoft Azure partnerships for their AI audit platforms. If all four run on Azure OpenAI infrastructure, a correlated failure — platform outage, regulatory restriction on AI in audit, model update that changes anomaly detection behavior — affects all four audit firms simultaneously. Enterprise issuers whose previous and current auditors both rely on the same infrastructure have not assessed this concentration risk.
AI audit tools are deployed firmwide, but engagement team capability to evaluate, challenge, and override AI output varies materially. A senior partner who understands Clara's anomaly detection scope applies different professional judgment to AI flags than a manager who treats the flag list as a checklist. Audit quality variance attributable to differential AI fluency within engagement teams is not yet reflected in published PCAOB inspection findings — but the risk is structural.
AI Insight Lab publishes The Deployment Memo for enterprise executives who have to decide, not just read. One deployment dissected every Tuesday.