What the PCAOB has said about generative AI in audits

The PCAOB's main public statement on generative AI in audits is a July 2024 staff Spotlight, and its finding is narrow: the audit firms its staff spoke to appeared to use generative AI mainly for administrative and research work, and firms investing in it expected it to augment, not replace, people in auditing and financial reporting.¹ The document is staff observation from limited outreach. It is not a rule, a standard or guidance, and the PCAOB says so on its cover.¹

What the document is

The Spotlight states that it "represents the views of PCAOB staff and not necessarily those of the Board. It is not a rule, policy, or statement of the Board."¹ It reports on what staff called "limited outreach to several audit firms and companies," made to understand their views on integrating generative AI in audits and financial reporting.¹ The firms were mainly larger ones: in a footnote, staff said they consisted of the U.S. global network firms and several U.S. non-affiliated firms that audit more than 100 issuers, which together audit the majority of issuers' market capitalization.¹

Staff placed the work inside a research project on the PCAOB's standard-setting agenda, one that assesses whether there is a need for guidance, changes to PCAOB standards or other regulatory action given the increased use of technology-based tools in preparing and auditing financial statements.¹ The tracker on this site lists the Spotlight and the PCAOB's later standard-setting agenda page under the PCAOB.

What audit firms told staff

Staff reported six observations from the audit firms.¹

• Current use. Some firms said staff can use generative AI to prepare certain administrative documents or first drafts of memos and presentations related to the audit, and some had built tools to help staff research internal accounting and auditing guidance. The global network firms were generally further along than non-affiliated firms.
• Investment. Most firms said they were continuing to invest, either by building tools or by partnering with third parties. The future uses they named included summarizing accounting policy and legal documents, checking audit documentation for completeness, certain risk assessment procedures, scoping the audit, evaluating the completeness of financial statement disclosures, and comparing amounts in the statements or notes with audited amounts.
• Limits. Data privacy and security remained a focus. Some firms limited what information could be uploaded to their tools, some limited how far staff could use generative AI in an audit, and some did not allow it in audit or attest procedures at all, citing data privacy and the reliability of the output.
• Supervision and review. Firms said an engagement team member who uses a generative AI tool is still responsible for the results and documentation of the work, and that reviewers are expected to apply the same diligence as for work done without it.
• Input and output. Some firms stressed that both the source data and the generated content must be auditable, and noted that output may be false or misleading, which staff described as "so-called 'hallucinations'," or may be skewed or biased.
• Other risks. Some firms said a company's own use of generative AI could amplify existing information technology risks, such as risks related to the segregation of duties, or create new ones.

Staff also wrote that these firms indicated "that PCAOB auditing standards are not currently viewed as impediments to the development and use of GenAI in the audit."¹ That is the firms' view as staff reported it, not a finding by the Board.

What companies told staff

On the preparer side, staff said that integrating generative AI into accounting and financial reporting "appears to be secondary to integrating GenAI in operational and customer-facing areas."¹ Some preparers used it for first drafts of internal documents, such as summaries of accounting standards, and some used it for "less complex and repetitive processes, such as preparing account reconciliations or to assist with identifying reconciling items."¹

Preparers named two problems for wider use in financial reporting: the "black-box" nature of some tools and the lack of consistent output, both of which raise questions about whether the output can be audited.¹ Some said they were setting up controls over the reliability and accuracy of the data used to train models, and acknowledged that this may be hard for models developed or trained by third parties.¹ Some were testing single use cases to work out what controls would be needed before wider use.¹

What the Spotlight does not say

The Spotlight does not change any auditing standard, does not tell auditors how to test a company's AI, and does not count how many companies use generative AI in their close. It ends by asking auditors, preparers, audit committee members, investors and academics to share their experience with staff.¹ For what companies themselves tell the SEC about AI in their controls, see AI in the controls section and the controls and audit topic, where the log quotes the filings directly.