On October 13, the AICPA released a new practice aid for financial statement auditors dealing with artificial intelligence.

The guidance covers AI from two directions. First, an audit client may use AI in financial reporting, internal controls, or another business process that affects the financial statements. Second, the audit firm may use AI while performing the engagement.

The practice aid is nonauthoritative. It does not create a new audit standard or prescribe a standard set of documents every firm must keep. It does, however, make one early question difficult to avoid: where is AI being used, and what evidence shows that the use is controlled?

Answering that question will require more than an AI policy.

Start with where AI touches the work

The AICPA announcement says auditors should determine how much an organization relies on AI in financial reporting. That includes direct use in accounting and reporting, but AI can also affect financial information indirectly through other business functions.

An inventory that lists “Microsoft Copilot” or “ChatGPT” is too broad to explain that reliance. The useful unit is the workflow.

A firm might record that an approved tool summarizes lease documents before someone enters terms into the accounting system. Another tool may classify expenses, identify unusual transactions, draft disclosure language, or generate a forecast used in an estimate.

For each workflow, the record should identify:

The process and financial statement area it may affect
The tool, account type, and business owner
The data sources the tool receives
Whether the output is advisory or enters a system of record
The person responsible for reviewing the result
The evidence retained after review

This builds on the tool inventory discussed in our CPA firm AI use policy guide, but ties it more closely to financial reporting and engagement work.

Data quality needs a visible owner

The practice aid calls out the quantity, quality, accuracy, completeness, relevance, and diversity of data used by an AI system. Those are not settings an IT provider can certify with one report.

The business owner has to know which data is appropriate for the task. The technology team can help show where it came from, who can change it, and whether the system is using the intended source.

Consider a tool that reviews contracts for revenue-recognition terms. Its output may be unreliable if it can see only part of the contract library, if executed amendments sit in personal email, or if an old document folder is treated as current precedent.

The evidence package might include a data-flow diagram, permissions report, source-system list, and the results of periodic access reviews. It should name the person who decides whether the data is fit for the accounting purpose.

Broad access can make the result worse. Giving an AI tool every available file increases the chance that it relies on stale, irrelevant, or restricted information.

Record how the workflow can change

Traditional software may behave predictably until someone changes the code or configuration. AI output can also vary because the model, prompt, connected data, plugin, or vendor service changed.

The AICPA identifies data risk, model risk, hallucinations, explainability, and bias among the issues auditors may need to consider. A small firm does not need to build a model-risk department to create a useful change record.

At minimum, document:

Who can approve a new AI workflow or material change
Which model, connector, or vendor service the workflow depends on
How changes are tested before production use
What output a qualified person reviews
How an incorrect result is corrected and reported
When the workflow was last reassessed

Save enough information to explain what the workflow did, who relied on it, and how someone checked the result. For a vendor product, retain the relevant contract terms, data-handling commitments, assurance reports, and notices of material changes.

Audit firms have a second set of responsibilities

The AICPA’s second section addresses AI used by auditors themselves. It discusses quality-management policies, engagement-team competence, planned use on specific engagements, approved tools, supervision, and review.

The engagement partner remains responsible for the audit and the opinion. An AI-generated analysis does not become reliable because it came from a product marketed to accountants.

That creates practical documentation questions for the audit firm:

Was the tool approved for the client data it received?
Did the engagement plan identify how the tool would be used?
Did the assigned staff understand its limitations?
Who reviewed the output and resolved exceptions?
Can the firm reproduce the source information behind a conclusion?

Those records also help with billing and client communication. As we covered in If AI Saves Your CPA Firm Time, Does the Client Have to Pay Less?, the firm should be able to explain the work performed and the professional review that remained.

Nonauthoritative guidance can still expose a weak process

The AICPA says it plans to add more material, including a deeper examination of material-misstatement risk and audit evidence when a company uses AI. More questions and answers are also expected for auditors using AI in their own work.

Firms should not present the current practice aid as a new mandatory checklist. They can still improve the record before every detail is final.

An organization that cannot identify its AI workflows today will have difficulty evaluating controls, data quality, or review later. Reconstructing that information during an engagement is harder than recording it when the workflow is approved.

Start with the workflows closest to financial reporting or audit work. Name the owner, map the data, document access, record the review step, and retain the evidence that matters.

Ask for the record behind the answer

CPA firms and audit clients can use the new guidance to test whether their AI program exists outside the policy document.

Which AI workflows can affect financial reporting? Who owns each one? What data does the tool use? Who approves changes? What does the reviewer check? Where is that review recorded? Can the firm show that only approved people and systems had access?

If the answers depend on one employee remembering how the tool was configured, the control record is not ready.

The AICPA has not prescribed one evidence package for every firm. It has made the need to understand AI use much more concrete. Leave a record that another person can follow.

If your AI policy names approved tools but does not show how those tools touch financial reporting, Artech can help inventory the workflows, map the access, and document the control record.