Linkedin
Facebook
Email
more
Audit & Assurance · Technology & Governance
Is AI Already in Your Audit ? the Standards Are Still Catching Up
Audit firms are already using AI to test entire populations of transactions instead of samples, draft disclosure narratives, and flag anomalies no human reviewer would catch. Regulators are still working out how to govern any of it. Here's what's actually settled, what isn't, and what audit committees and finance teams should be doing while the rulebook is still being written.
Key update
In December 2025 the International Auditing and Assurance Standards Board (IAASB) approved work on non‑authoritative guidance for AI in audit and assurance, following global roundtables that drew more than 240 stakeholders across six continents. A proposed action plan, scope, themes, and coordination with ethics standards bodies, was due in March 2026. Until then, firms and audit committees are operating on internal judgment rather than a settled rulebook.
Key takeaways
- There is no binding standard yet, but there is already regulatory attention. Neither the IAASB nor the US PCAOB has issued enforceable rules on AI use in audits, but the PCAOB's Technology Innovation Alliance has floated a documentation framework, and the SEC is already asking registrants about AI governance through comment letters, usually a precursor to formal rulemaking.
- The risk isn't hypothetical, it shows up in five specific places. Full‑population testing with unclear methodology standards, generative‑AI drafting errors in disclosures, unapproved "shadow AI" tools in the financial close, thin documentation of how AI tools were validated, and a basic information gap between what preparers' AI does and what auditors' AI checks.
- Governance built now outlasts governance retrofitted later. Businesses that inventory their AI tools, document validation and human review, and update audit committee charters today will be markedly better positioned than those waiting for a final standard to tell them what to build.
Where the standards actually stand today
The direction of travel is clear even though the destination isn't finalised. The IAASB's global roundtable programme has already surfaced the central tension: firms want to deploy AI to improve audit quality, but quality management frameworks for AI‑enabled tools are still being built rather than settled. In the US, the PCAOB has acknowledged the ambiguity directly, a board member has noted that inspectors could just as easily reward a firm for deploying AI‑driven full‑population testing as penalise it for using an undefined methodology, because no standard yet says which.
| Body | Status | What's next |
|---|---|---|
| IAASB | Global roundtables completed (240+ stakeholders, six continents); non‑authoritative guidance approved for development | Action plan due March 2026 |
| PCAOB (US) | No binding AI‑specific standard; Technology Innovation Alliance has floated a documentation framework | Firms proceed on internal assumptions, not safe harbours |
| SEC (US) | Issuing comment letters asking registrants about AI governance and disclosure practices | Typically a precursor to formal rulemaking |
For UAE entities, this matters even without a local AI‑in‑audit rule on the books: UAE audits are performed against International Standards on Auditing issued by the same IAASB running this process, so whatever guidance eventually lands will shape audit practice here as directly as anywhere else.
Five places AI is quietly creating audit risk right now
- The 100%‑testing ambiguity. AI lets auditors test entire populations instead of statistical samples, which sounds like an unambiguous improvement, but no standard yet defines the methodology bar for doing it, leaving firms and inspectors both guessing at what "sufficient" looks like.
- Generative‑AI hallucination in disclosures. AI‑drafted MD&A commentary, footnotes, and earnings narrative can read as fluent and plausible while containing factual errors, precisely the kind of text a rushed reviewer is likely to under‑scrutinise.
- "Shadow AI" in the financial close. Staff quietly using consumer tools, a general‑purpose chatbot, a personal AI assistant to help close the books creates outputs with no validation trail, which is exactly what existing audit‑evidence standards require and shadow tools don't provide.
- Thin documentation standards. Current audit standards require procedures to be documented, but don't yet specify whether that must include the AI tool's training data, validation methodology, or known failure modes, so documentation quality varies wildly between engagements.
- Preparer‑auditor information asymmetry. Finance teams often don't know what their auditor's AI flagged; auditors often don't know which management outputs were AI‑generated or how they were validated. Both sides are reviewing each other's work half‑blind.
Agentic AI raises the stakes further
The PCAOB has already referenced autonomous "agentic" AI systems capable of conducting audit procedures independently, not just assisting a human reviewer, but performing steps end‑to‑end. Professional skepticism is a foundational requirement of every audit standard in use today, and how it applies when the party executing a procedure isn't a person is genuinely unresolved. Deloitte has called agentic AI the single biggest internal‑audit theme of 2026 for exactly this reason.
What audit committees and finance teams should actually do
- Inventory every AI tool in use across finance and the close process, including informal staff usage of consumer tools, not just sanctioned platforms.
- Document inputs, outputs, and the human review step for every AI‑assisted process, so a validation trail exists whether or not a formal standard demands one yet.
- Ask your auditor directly which AI tools they deploy on your engagement and how they document AI‑assisted procedures, this is a fair, increasingly standard question for an audit committee to put in writing.
- Update the audit committee charter to explicitly cover AI oversight on both sides, management's use of AI in reporting, and the auditor's use of AI in testing it.
- Confirm contractual rights to your AI vendors' model versions and training documentation for the length of your audit retention period, before signing — not after a regulator asks for it.
Frequently asked questions
Is there currently a binding standard on AI use in audits?
No. As of mid‑2026, neither the IAASB nor the PCAOB has issued a binding, AI‑specific auditing standard. The IAASB is developing non‑authoritative guidance following its 2025 global roundtables, with an action plan due March 2026; the PCAOB's Technology Innovation Alliance has floated ideas, none of which are yet enacted as rules.
Does this affect audits performed in the UAE?
Yes, indirectly but meaningfully. UAE audits follow International Standards on Auditing issued by the IAASB, so guidance that body eventually finalises on AI will shape how audits are performed here, even without a separate UAE‑specific AI‑audit rule.
What is "shadow AI" and why does it matter to an audit?
Shadow AI refers to staff using unapproved, consumer‑grade AI tools (general chatbots, personal assistants) for work tasks like closing the books. Because these tools sit outside sanctioned systems, their outputs typically lack the validation documentation and audit trail that existing evidence standards require.
Should we wait for final standards before building AI governance?
No. Regulatory guidance will arrive eventually, but businesses and audit committees that build documented AI governance now, tool inventories, validation records, updated charters, will be in a materially stronger position than those retrofitting controls after formal standards land and inspectors start asking questions.
How RSM UAE can help
RSM UAE helps audit committees and finance teams build practical AI governance ahead of formal standards, from tool inventories and validation frameworks to updated audit committee charters and engagement‑level discussions with your auditor about how AI is used on both sides of the relationship.
Primary sources: IAASB roundtable publications and Technology/Quality Management focus area updates (2025–2026); PCAOB Technology Innovation Alliance commentary; SEC registrant comment‑letter practice; Deloitte 2026 Internal Audit Hot Topics.
Auditing standards and regulatory guidance on AI use are evolving rapidly and may change materially after publication. This article is for general informational purposes only and does not constitute audit, assurance, or legal advice. Businesses should confirm their specific position with RSM UAE or the relevant standard‑setting body before acting.
