AI in auditing: what the PCAOB has said, which standards already apply, and what audit firms report

AI in auditing means two different things in the PCAOB’s documents: audit firms using AI tools in their own work, mostly for administrative and research tasks according to a July 2024 staff Spotlight, and auditors meeting AI inside the companies they audit.¹ The PCAOB has issued no standard on either; its one technology amendment, Release No. 2024-007 of 2024-06-12, covers technology-assisted analysis and says it does not address “specific matters relating to other technology applications used in audits (e.g., blockchain or artificial intelligence).”²

The PCAOB’s agenda page, as read on 2026-11-02, names AI only inside a research project and a planned piece of staff guidance.³ What follows sets each PCAOB document beside the standards it names, then counts the other side: how many 10-Ks name artificial intelligence, and how often the auditor’s report bound into those 10-Ks does.

Two questions: auditors using AI, and audited companies using AI

The Spotlight splits its observations the same way, one section on generative AI in audits and one on generative AI in financial reporting.¹ On the first, staff wrote that use by the firms they spoke to “appears to be focused primarily on administrative and research activities.”¹ On the second, companies said that bringing generative AI into accounting and financial reporting “appears to be secondary to integrating GenAI in operational and customer-facing areas.”¹

The two questions land on different standards. An auditor’s own use of a tool goes to audit evidence and to supervision of the engagement team. A company’s use goes to the auditor’s risk assessment and, in an integrated audit, to the testing of internal control over financial reporting under AS 2201, the standard that began as Auditing Standard No. 5.²⁵ The SEC’s 2007 order approving that standard says it “requires the auditor to evaluate and test both the design and the operating effectiveness of internal control.”⁵ A control that runs on a model is still a control the auditor must test.

What the PCAOB has published, in date order

The record is short. Three of the eight dates are about technology-assisted analysis, the PCAOB’s term for what practice calls data analytics.² Release No. 2024-007 says some auditors use it “to examine the correlation between different types of transactions, compare company information to auditor-developed expectations or third-party information, or recalculate company information.”²

Of the documents on the timeline, the Spotlight is the only one about generative AI, and it is explicit about its weight: it “represents the views of PCAOB staff and not necessarily those of the Board. It is not a rule, policy, or statement of the Board.”¹ It came out of “limited outreach to several audit firms and companies.”¹ This site’s explainer on the Spotlight walks through its observations one by one; here the interest is in which standards each document touches.

Which existing standards each statement touches

Release No. 2024-007 amends AS 1105, Audit Evidence, and AS 2301, The Auditor’s Responses to the Risks of Material Misstatement, and conforms AS 2501 on accounting estimates.² Among the changes it lists are two that bear on any tool: “Specify considerations for the auditor’s investigation of items identified when performing tests of details” and “Emphasize the importance of controls over information technology.”² It points auditors to AS 2601 for a company’s use of a service organization and to AS 2201 for integrated audits.² Its effective date is for audits of financial statements for fiscal years beginning on or after December 15, 2025, subject to SEC approval as the release states it.²

The release also carries the only count of AI tools the PCAOB has published in these documents. Its economic analysis reports that in the 2023 inspection year the six U.S. global network firms said 90% of their tools were used for data visualization, summarization, tabulation or modeling, and that “Less than 7% of the U.S. GNFs’ tools used blockchain technology, artificial intelligence, or robotic process automation.”² The six firms are named in the release’s footnote: BDO USA, Deloitte & Touche, Ernst & Young, Grant Thornton, KPMG and PricewaterhouseCoopers.² All six reported using tools to identify and select journal entries and to select samples for testing.²

Commenters on the 2023 proposal had asked for more. The release records that some said the Board “should continue to research and evaluate the need for standard setting related to other types of technology used in the audit, such as artificial intelligence.”² The Board answered that the amendments address “only one area of auditors’ use of technology” and that other areas “continue to be analyzed as part of our ongoing research activities.”²

What the Spotlight says firms use generative AI for

Staff reported that some firms let staff use generative AI for “certain administrative documents or initial drafts of memos and presentations related to the audit,” and that some had built tools “to assist staff in researching internal accounting and auditing guidance.”¹ The global network firms were further along than the non-affiliated firms.¹

The uses firms expected next are closer to audit evidence: summarizing accounting policy and legal documents, checking the completeness of audit documentation, certain risk assessment procedures, scoping, evaluating the completeness of disclosures, and comparing amounts in the statements or notes with audited amounts.¹ Those are the procedures AS 1105 governs, which is why the release’s carve-out of artificial intelligence matters.

Some firms did not allow generative AI in audit or attest procedures at all, citing data privacy and the reliability of output.¹ Firms that did said an engagement team member who uses such a tool “is still responsible for the results and documentation of the work,” and that reviewers apply “the same level of diligence as when reviewing work where GenAI was not involved.”¹

What the standard-setting agenda says is under consideration

The agenda page, as read on 2026-11-02, lists a Data and Technology research project to study “how auditors and companies are using new technologies and how those technologies may affect audit quality.”³ It says auditors, public companies and broker-dealers “increasingly use data analytics, automation, super intelligence, and other technologies,” and that “the staff plans to develop guidance on considerations relating to the use of super intelligence by companies and auditors.”³ “Super intelligence” is the page’s own term; it does not define it.

Two standard-setting projects name technology. The Fraud project would amend AS 2401, “including addressing matters that may arise from developments in the use of technology,” and the page says the Fraud and Going Concern projects “may examine how technology affects auditor identification of misstatements.”³ Neither project has a proposal date on the page; for both, staff “is evaluating feedback” and developing a project plan.³

The agenda is the product of two public requests for comment in 2026. Release No. 2026-001 on strategic priorities was issued on March 31, 2026, and its comments informed the focus areas in Release No. 2026-005 on standard setting, issued on June 23, 2026.³ The page says the agendas “are dynamic and may evolve” and that the Office of the Chief Auditor will update it “at least quarterly.”³ The one project in its “Recently Completed” table is not about technology: amendments to QC 1000 on quality control, adopted on September 9, 2026, effective on December 15, 2026, with SEC approval pending as the page was read.³

Counts: AI in the firms’ tools and in the companies they audit

The audited side is easier to count. EDGAR full-text search, run quarter by quarter and reduced to distinct filings, finds the phrase “artificial intelligence” in 836 10-Ks filed in 2021, 1,139 in 2022, 1,283 in 2023, 2,412 in 2024 and 3,271 in 2025.⁴ The full method and the share of all 10-Ks are in the AI disclosure count.

The firms’ side has one published count, the one in Release No. 2024-007. The release reports that the average number of tools used by engagement teams at the six U.S. global network firms rose from approximately 13 to approximately 18 per firm between 2018 and 2023, about 38%.² It says firms “generally do not require the use of such tools on audit engagements.”²

The chart reads as a census of ordinary software. Nine in ten of the tools did data visualization, summarization, tabulation or modeling; about three in four were built in-house; about one in five also used third-party data; fewer than one in fourteen used artificial intelligence, blockchain or robotic process automation, and the release does not split that last group.² Every tool used company data.² Those are 2023 figures, and none of the other PCAOB documents read for this article gives a later count.

The firms in the count are the ones that audit most of the market. The Spotlight’s footnote describes its own outreach sample the same way: the U.S. global network firms and several non-affiliated firms that audit more than 100 issuers, which, the footnote says, “audit the majority of the market capitalization for issuers.”¹

On the companies’ side the numbers are larger and moving faster. Of the 6,431 10-Ks filed in 2025, 3,271 named artificial intelligence, against 836 of 6,933 in 2021.⁴ More than half of the 10-Ks filed that year used the phrase. The count does not say where: a risk factor, the business description or the controls section. The AI disclosure count splits it by year, form and industry.

No document read for this article counts auditor’s reports that mention AI, and the PCAOB’s agenda page lists no project on critical audit matters about AI; it says only that staff plans “a further post-implementation review of CAMs” before deciding on further research, standard setting or guidance.³

What an audit committee can ask, from the documents

The documents suggest questions without prescribing them. Each of these traces to a sentence above.

• Which audit procedures on this engagement used a firm tool built on AI, and does the firm’s policy allow it for audit or attest procedures? The Spotlight records firms that did not.¹
• Where the audit used technology-assisted analysis, how were items the tool flagged investigated, as the amended AS 1105 and AS 2301 now specify?²
• Which of the company’s controls over financial reporting depend on a model, and how were they tested in the integrated audit under AS 2201?²⁵
• Has the auditor’s fraud risk assessment considered AI-enabled schemes, the matter the PCAOB’s Fraud project names as technology?³

The PCAOB’s own entries are in the regulation tracker, and the controls side of what companies file is in AI and internal control over financial reporting.