AI in Auditing: How Technology Is Changing the Financial Statement Audit

AI in auditing is transforming what a financial statement audit looks and feels like from both sides of the engagement. Auditors can now analyze entire populations of transactions instead of relying solely on samples, flag anomalies that would be invisible to manual review, and build source-linked workpapers that trace every finding back to the underlying data. For finance leaders, that means a more rigorous opinion, shorter timelines, and less back-and-forth during fieldwork.

What Has Changed and What Has Not

The core objective of an audit has not moved: the auditor must obtain sufficient appropriate evidence to support an opinion on whether financial statements are materially misstated. What AI changes is how efficiently and thoroughly that evidence can be gathered.

Until recently, auditors tested representative samples of transactions because testing a full year of journal entries by hand was impractical. An AI-assisted audit can ingest a complete trial balance export or a full year of journal entries and scan every record against a programmed set of risk criteria in minutes. Low-frequency anomalies, entries that appear only once or twice in a large population, are often the transactions most worth examining, and they are precisely what a well-designed sample might miss.

The difference matters at scale. A mid-market company processing hundreds of thousands of transactions per year now gets an audit that looks at 100% of its data, not a 5% slice.

Risk Assessment Gets Sharper

Traditional risk assessment relied heavily on auditor judgment informed by inquiries, prior-year knowledge, and analytical procedures run on summary-level data. AI tools can now surface anomalies in disaggregated data far earlier in the engagement, sometimes before the audit even starts.

Machine-learning models trained on journal-entry characteristics can flag entries posted outside normal business hours, reversals that offset each other within a short window, and unusual account combinations, all in a pre-fieldwork screening pass. The result is a risk assessment grounded in the actual population of transactions rather than in discussions alone.

Workpaper Documentation Becomes More Traceable

One of the quiet friction points in any audit is connecting the tested item in the workpaper to the source record in the client’s system. When that connection is made manually, it is time-consuming to build and tedious to review. Source-linked workpapers automate that chain: the auditor’s procedure, the evidence it relied on, and the underlying client file are tied together in the documentation from the start.

That linkage matters at review, at quality inspection, and when a regulator asks follow-up questions. It also reduces the “information requests” that cause delay on the client side because the auditor can access data already ingested rather than going back to ask for a new export.

The Regulatory Framework Around AI in Auditing

Regulators have moved deliberately to keep standards current with practice. The PCAOB updated AS 1105, Audit Evidence, and AS 2301 through amendments that address technology-assisted analysis directly. Those amendments, approved by the SEC in August 2024, are effective for audits of fiscal years beginning on or after December 15, 2025, meaning they apply fully to calendar-year 2026 audits.

The amendments clarify that auditors who use technology-based tools to analyze electronic information must still evaluate the relevance and reliability of what those tools produce. Efficiency from automation does not reduce the obligation to obtain sufficient appropriate evidence. It changes how that evidence is gathered, not the standard it must meet.

In February 2026, COSO released “Achieving Effective Internal Control Over Generative AI,” which applies the Internal Control-Integrated Framework to AI systems at the company level. The publication maps AI use cases to the ICIF’s five components and gives audit committees a practical structure for assessing how their finance teams govern AI-assisted processes. For auditors, the guidance informs what questions to ask about a client’s control environment when AI is embedded in financial reporting workflows.

The AICPA has also published resources through its AI resource center addressing how AU-C Section 500 (Audit Evidence) applies when information is obtained or processed by AI tools, reinforcing that professional skepticism and evidence sufficiency requirements carry forward regardless of the technology used.

What Auditors Must Still Do

Automation narrows the scope of manual work but does not eliminate professional judgment. The PCAOB has been explicit on this point: principles-based standards scale to new tools rather than prescribe specific technologies. Several areas remain fundamentally judgment-dependent:

• Evaluating the design and operating effectiveness of internal controls
• Assessing the reasonableness of significant accounting estimates
• Concluding on going concern indicators
• Applying professional skepticism when management’s representations conflict with other evidence

AI tools accelerate the evidence-gathering phase. The auditor’s judgment about what that evidence means is still the foundation of the opinion.

How AI Changes the Client Experience

For CFOs and controllers, the most visible effect of AI in auditing is a shorter and less disruptive fieldwork process. When an auditor can ingest structured data directly from the client’s accounting system and run automated procedures over it, the request list for one-off exports and manual confirmations gets smaller.

Faster audit turnaround is a downstream benefit of that efficiency. Engagements that historically stretched across several months of back-and-forth can compress when the heavy data-analysis work happens in near-parallel with the initial planning phase rather than sequentially after it.

There are also quality benefits that are less visible but meaningful to finance teams. When workpapers are source-linked and the evidence chain is automated, the risk that a finding rests on a miskeyed number or a misidentified document drops significantly. That is the kind of audit quality improvement that reduces restatement risk, not just audit hours.

A firm built around AI-native audit workflows, like the audit and assurance practice at Modus, structures engagements so that source-linked documentation and full-population data analysis are built into the process rather than added on top of a traditional approach.

Where AI Introduces New Risks

An honest discussion of AI in auditing includes its failure modes. Three are worth flagging for any finance leader evaluating their audit firm’s technology use.

Model and data risk. An AI system is only as reliable as the data it ingests and the rules it applies. Errors in training data, algorithmic bias, or incomplete coverage of unusual transaction types can produce results that appear rigorous but miss the most important items. Auditors using AI tools must understand the methodology well enough to evaluate its outputs critically.

Over-reliance on automated results. Consistent, data-driven outputs can create a false sense of precision. An anomaly score of 0.02 on a journal entry does not mean the entry is correct; it means it does not match a pattern the model was trained on. Professional skepticism requires the auditor to interpret that score, not accept it.

Data security and confidentiality. Ingesting a client’s full transaction population into an external system raises confidentiality questions. Finance leaders should confirm how their audit firm stores, processes, and ultimately disposes of client data, and whether that handling meets the firm’s contractual and regulatory obligations.

These risks are manageable with the right controls and training, but they are real. The auditing firms doing this well are the ones that treat AI as a tool that requires governance, not a system that operates on autopilot.

What to Ask Your Audit Firm

If you are evaluating an audit firm’s technology capabilities or benchmarking your current firm, these questions surface the most useful information:

• Do you test full populations of journal entries, or samples?
• Are workpapers source-linked to the underlying client data?
• What tools do you use for anomaly detection, and do you validate their outputs?
• How do you handle client data security when ingesting transaction files?
• Does your use of AI-assisted tools comply with the PCAOB AS 1105 amendments effective for fiscal years beginning on or after December 15, 2025?

The answers will tell you quickly whether the firm’s AI use is integrated into its methodology or window dressing.

PE deal teams and finance leaders preparing for a first-time audit or an audit transition may also find it worth understanding how AI-native methodology affects diligence timelines. Faster turnaround and traceable documentation reduce friction in accelerated deal processes. The transaction advisory and audit capabilities at Modus are designed with those timelines in mind.

The Direction of Travel

The trajectory is clear. PCAOB standards now explicitly address technology-assisted analysis. COSO has mapped internal controls for AI at the entity level. The profession’s credentialing bodies are developing AI-specific competency frameworks. Firms that built AI into their audit methodology early are working through second- and third-generation refinements, while firms still piloting the technology are only beginning the learning curve.

For finance leaders, the practical question is not whether AI will be part of your next audit, but whether the firm doing your audit has integrated it thoughtfully. The standards require evidence quality. The methodology determines whether technology helps achieve that quality faster and more reliably or introduces new blind spots.

Related reading: Switching Auditors: When and How to Change Audit Firms

Frequently Asked Questions

How is AI changing the audit process?

AI in auditing primarily changes how evidence is gathered. Instead of testing a sample of transactions, AI-assisted auditors can analyze full populations of journal entries and flag anomalies for investigation. Risk assessment happens earlier, documentation is more traceable through source-linked workpapers, and fieldwork timelines compress because data analysis runs faster. Professional judgment on what the evidence means remains the auditor’s responsibility.

Does AI replace auditors?

No. AI tools automate data-intensive tasks like transaction analysis, anomaly detection, and documentation linkage. They do not replace the auditor’s judgment on internal control effectiveness, significant accounting estimates, or professional skepticism. Regulatory standards, including the PCAOB’s updated AS 1105, require auditors to evaluate the reliability and relevance of AI-generated outputs, not simply accept them.

What PCAOB standards govern AI in auditing?

The PCAOB updated AS 1105 (Audit Evidence) and AS 2301 through amendments addressing technology-assisted analysis, effective for fiscal years beginning on or after December 15, 2025. These amendments clarify that auditors using technology-based tools must still meet the sufficiency and appropriateness requirements for audit evidence. The PCAOB also issued a policy statement in September 2025 on evaluating the reliability of electronic information, and COSO released internal-control guidance for generative AI in February 2026.

What is a source-linked workpaper?

A source-linked workpaper ties the auditor’s documented procedure directly to the underlying evidence, such as the specific transaction record, confirmation, or data file the procedure relied on. Source linking creates a traceable chain from the audit opinion back through each finding to the raw data, which supports review, quality inspection, and regulatory examination. It also reduces client information requests because the evidence is captured during ingestion rather than reconstructed later.

Does AI in auditing make the audit faster?

Yes, in most cases. Full-population data analysis, automated anomaly flagging, and source-linked documentation all reduce the back-and-forth between auditor and client that extends traditional engagements. Faster audit turnaround is a common result, particularly for companies with high transaction volumes. The caveat is that the efficiency gain depends on how well the firm’s methodology is designed: poorly integrated AI tools can add verification steps rather than remove them.

Should a CFO be concerned about data security when their auditor uses AI tools?

Yes, this is a reasonable area of due diligence. Ingesting a full year of transaction data into an AI system raises questions about where data is stored, how it is secured, and how it is disposed of after the engagement. CFOs should ask their audit firm specifically how client data is handled when using AI-assisted procedures and confirm that the firm’s practices align with applicable confidentiality obligations under professional standards and any relevant contractual data-handling requirements.