Auditors can rely on AI for preparation, not for conclusions. It can read, sort, compare and draft: matching invoices to ledgers, summarising contracts, writing a first memo. Deciding whether evidence is sufficient, assessing risk and forming the opinion stay with a named auditor who reviews the output, checks it against the source and signs the work.
#Key takeaways
- Firms surveyed by PCAOB staff were using generative AI mainly for administrative and research work, not for audit conclusions.
- A useful rule: AI prepares, a person concludes, and the file shows which was which.
- Every figure an AI produces must trace back to a source document or a system extract.
- Client data only goes into tools the firm has approved for it.
- The review step is part of the design, not a manual check bolted on later.
#What are audit firms actually using AI for?
PCAOB staff spoke to the large U.S. Network firms and several others in 2024. They reported that generative AI use was focused mainly on administrative and research activities, such as first drafts of memos and tools for searching internal guidance, and that firms expected it to augment, not replace, auditors. Some firms were keeping it out of audit procedures for now over privacy and reliability concerns (PCAOB staff, july 2024).
That matches what audit managers describe: the time goes into reading, matching and writing up, and that is where AI helps first. The standards conversation is still moving. The IAASB's audit evidence project aims to modernise ISA 500 for the use of technology, including automated tools and techniques (IAASB audit evidence project, checked november 2026).
#Which tasks can AI prepare, and which stay with the auditor?
- Prepare: read and extract fields from invoices, bank statements and contracts, in Arabic and English.
- Prepare: match a sample of transactions to support and list the exceptions.
- Prepare: draft walkthrough notes, memos and management letter points from the team's own findings.
- Prepare: search firm methodology and past files for the relevant guidance.
- Auditor: decide the sample, the materiality and the response to assessed risks.
- Auditor: judge whether evidence is sufficient and appropriate, and whether an exception is a misstatement.
- Auditor: anything that goes into the opinion, the report or communication with those charged with governance.
This list is a working rule, not a reading of any standard. Your firm's methodology and your regulator decide what is acceptable; check with your quality function before you change a procedure.
#How do you make AI output reviewable?
A reviewer must be able to see what the AI looked at, what it produced and what the person changed. That means the source document is linked next to every extracted field, exceptions are listed rather than summarised away, and the approval is recorded with a name. The NIST AI risk management framework, january 2023 treats this kind of accountability and human oversight as part of managing AI risk.
The second test is reliability on your own data. Run the tool on a closed engagement where you already know the answers and count the misses before anyone uses it on a live file.
#When is a general chat assistant enough?
For research questions, drafting an email or reworking a memo the auditor has already written, an approved enterprise assistant such as Copilot or ChatGPT Enterprise is often enough, with a short firm policy on what can go in. A built workflow is worth it when the same preparation runs across many engagements and the review trail has to sit on the audit file.
#Where does Stennir fit?
Stennir's AI consulting engagement includes the governance part: which tasks AI may prepare, who approves the output, how it is logged and where client data is processed. The AI Opportunity Audit ranks the workflows worth building, each with a payback case, and the report is yours whether or not you build with Stennir.
If you go ahead, AI implementation builds one workflow with a named reviewer approving every output, and AI training teaches the team where the line between preparing and concluding sits on their own files.
We are
Stennir designs AI workflows where the AI prepares and a named auditor reviews, approves and concludes, with every step logged.
We aren't
Stennir does not give opinions on auditing standards or sell a tool that forms audit conclusions.
#What should an audit quality lead do next?
Write down the three preparation tasks that take your seniors the most time and mark who concludes on each. Compare notes with how finance teams use AI and compliance teams, then take the free readiness assessment or book a 30-minute call.
#Common questions
Does using AI change who is responsible for the audit?
No. The engagement partner and the team stay responsible for the work and the opinion, whatever tool prepared a schedule. That is why the design matters: AI output is marked as prepared by a tool, a named person reviews it, and the file shows the source behind every figure. Check specifics with your methodology team.
Can the AI select our samples?
It can run a selection method your team has chosen and document it, and it can highlight unusual items for the team to consider. Choosing the method, the size and the response to what the sample shows stays with the auditor. Stennir builds the first part and leaves the judgement where it belongs.
What could go wrong?
The usual failures are a misread figure accepted without checking, an exception summarised away, and client data pasted into an unapproved tool. The controls are source links on every field, listed exceptions, a named approver and a firm policy on tools. Test on a closed engagement before using it live.
Does it work on Arabic documents?
Yes. Arabic and English are supported for reading and drafting. Reviewers see the original next to any extraction or translation, so they can check the figure against the source rather than trust a summary. Accuracy is measured on your own document types before the workflow is used on a live engagement.
