How to Evaluate AI-Generated Financial Information in an Audit
A client’s accounting team uses an AI-enabled system to classify transactions, summarize contracts, or draft financial statement disclosures. The output looks polished, arrives quickly, and appears accurate. But what information did the system rely on? How was the result validated? And can the auditor obtain sufficient appropriate audit evidence to support the financial statement assertions affected by that output?
As artificial intelligence becomes more embedded in accounting and financial reporting, these questions are increasingly relevant to financial statement audits. AI can improve efficiency and help organizations process large volumes of information, but it can also introduce risks that require auditors to reconsider how information is produced, controlled, and evaluated.
On October 13, 2026, the AICPA issued Artificial Intelligence (AI) Considerations for Financial Statement Auditors, a nonauthoritative practice aid addressing organizations’ use of AI in financial reporting and audit firms’ use of AI-related technological resources. The AICPA also indicated that additional guidance on assessing risks of material misstatement and evaluating audit evidence involving AI is expected. The practice aid offers a useful starting point, but auditors must continue to apply the relevant professional standards and exercise professional judgment. See the AICPA’s announcement.
Evaluating AI-generated financial information in an audit requires understanding how AI affects financial reporting, assessing the reliability of underlying data, identifying AI-specific risks, evaluating relevant controls, and obtaining sufficient appropriate audit evidence. Here are five considerations for audit teams.
1. Understand Where and How AI Affects Financial Reporting
The first step in evaluating AI-generated financial information in an audit is understanding where the organization uses AI and how that use could affect the financial statements. AI may be incorporated directly into accounting activities, such as preparing journal entries, analyzing contracts, developing estimates, or drafting disclosures. It may also operate indirectly through business processes that generate information ultimately used in financial reporting. Not every AI application presents the same risks, so auditors need to understand how each system connects to relevant accounts, disclosures, and financial statement assertions.
For example, an AI tool that summarizes internal meeting notes may have little direct effect on financial reporting, while a system that reviews customer contracts and identifies revenue recognition terms could have a much more significant impact. Auditors should understand the system’s purpose, data inputs, outputs, users, and oversight, along with how the resulting information is incorporated into accounting decisions. Unlike conventional rule-based automation, some AI systems generate probabilistic outputs, may produce different responses to similar inputs, and may not provide a transparent explanation of how a conclusion was reached.
These characteristics can introduce uncertainty into processes that auditors previously understood as predictable or consistent. The relevant question is not simply whether an organization uses AI, but whether that use changes the risks of material misstatement or the nature of the audit evidence available. Understanding where AI fits into the financial reporting process helps auditors determine whether existing risk assessments and planned audit procedures remain appropriate.
2. Evaluate the Reliability of the Underlying Data
AI-generated information is only as useful as the data and processes supporting it. Before relying on information produced by an AI system, auditors should consider whether the underlying data is accurate, complete, relevant, and appropriate for its intended purpose. This includes understanding where the data originated, how it was collected or transformed, and whether the system has access to the information necessary to produce a reliable result. Auditors should also consider whether data is missing, duplicated, outdated, inconsistently formatted, or otherwise unsuitable for the task.
Consider an AI system used to summarize customer contracts for revenue recognition purposes. If the system analyzes only the original contracts but excludes subsequent amendments, its summaries may appear accurate while omitting terms that materially affect revenue recognition. The problem may not be that the AI system incorrectly interpreted the information it received, but that the information itself was incomplete. Without understanding the source data and its limitations, an auditor could place undue reliance on an otherwise convincing output.
Under AU-C section 500, Audit Evidence, auditors are required to obtain sufficient appropriate audit evidence to support reasonable conclusions on which to base the audit opinion. The relevance and reliability of information used as audit evidence remain essential considerations, regardless of whether AI was involved in producing it. Depending on the circumstances, auditors may need to trace AI-generated outputs to underlying records, compare results with independent sources, or perform additional procedures to evaluate completeness and accuracy. A well-written AI summary is not necessarily reliable audit evidence, particularly when the information supporting it cannot be appropriately evaluated or corroborated.
3. Identify AI-Specific Risks That Could Affect Audit Evidence
AI can introduce risks that extend beyond those associated with traditional automated accounting systems. The AICPA’s practice aid identifies several considerations relevant to evaluating AI, including data risks, model risks, hallucinations, explainability, and bias. Data risks arise when an AI system relies on inaccurate, incomplete, or otherwise unsuitable information, while model risks involve limitations in how a system is designed, configured, trained, or applied to a particular task. Hallucinations occur when generative AI produces information that appears credible but is unsupported or fabricated, and limited explainability can make it difficult to understand how a system reached its conclusions. Bias may also cause a system to produce consistently skewed results because of limitations in its data, design, or operation.
Consider an AI system that reviews hundreds of customer agreements and produces a summary of contractual obligations. The system might correctly identify most payment terms but overlook an unusual modification that changes the timing of revenue recognition. Alternatively, it might generate a plausible interpretation of a contract provision that is not supported by the underlying agreement. Neither situation necessarily produces an obvious error, which is why AI-generated information can appear complete and authoritative even when significant information is missing or incorrectly interpreted.
Auditors should consider how these risks could affect relevant financial statement assertions and whether additional procedures are necessary to address them. For example, an AI system that consistently omits certain types of transactions could affect completeness, while one that incorrectly interprets contractual terms could affect accuracy, classification, or cutoff. Professional skepticism remains essential because the fact that an AI-generated conclusion appears reasonable does not establish that it is accurate, complete, or supported by sufficient appropriate audit evidence.
4. Evaluate the Controls Governing AI Use
Understanding AI-related risks is only part of the evaluation. Auditors also need to consider the controls surrounding AI systems that affect financial reporting, including access restrictions, data integrity procedures, system configuration and change management, output validation, exception monitoring, and human review. The nature and extent of the auditor’s work will depend on how the AI system affects financial reporting and the assessed risks of material misstatement. These controls should be evaluated within the organization’s broader system of internal control rather than treated as an entirely separate technology issue.
One particularly important consideration is whether human oversight is meaningful. Suppose an AI system automatically classifies thousands of transactions and a controller approves the resulting report each month. Does that approval represent a meaningful review of the classifications, or is the controller simply accepting the system’s output? An effective review control should be designed with sufficient precision to identify relevant errors or exceptions, and auditors may need to understand what the reviewer examines, what information supports the review, how exceptions are investigated, and how the review is documented.
Auditors should also consider whether changes to the AI system, its configuration, or its underlying data could affect the consistency of outputs over time. Importantly, understanding the design and implementation of relevant controls is not the same as testing their operating effectiveness. Where the audit approach includes reliance on controls, auditors must obtain appropriate evidence regarding their operating effectiveness in accordance with applicable auditing standards. Where controls are ineffective or insufficiently supported, auditors must determine an appropriate response to the assessed risks, which may include additional substantive procedures or other responses when substantive procedures alone cannot provide sufficient appropriate audit evidence.
The objective is not to create a separate audit methodology for every AI application. Rather, it is to understand how AI changes the organization’s financial reporting processes and apply the existing audit framework appropriately.
5. Maintain Auditor Responsibility and Professional Judgment
AI can assist with financial reporting and audit procedures, but it does not replace the responsibilities of management or the independent auditor. Management remains responsible for the preparation and fair presentation of the financial statements in accordance with the applicable financial reporting framework, including relevant internal control responsibilities. The auditor remains responsible for obtaining sufficient appropriate audit evidence, exercising professional skepticism, and forming the audit opinion. These responsibilities do not change simply because an AI system participates in preparing or evaluating financial information.
This distinction becomes especially important when AI is used by both the organization and the audit firm. For example, an audit team might use an approved AI-enabled tool to summarize accounting guidance, analyze financial information, or assist with audit documentation. Although these tools may improve efficiency, their outputs still require appropriate evaluation, supervision, and review. The AICPA’s October 2026 practice aid also addresses considerations for audit firms’ own use of AI-related technological resources, including quality management policies and procedures, engagement-team competence, planning, and engagement partner oversight.
Firms should understand the intended purpose and limitations of the AI tools they deploy, establish appropriate policies governing their use, and ensure engagement teams have the competence to evaluate the results. Engagement partners should understand how AI tools are being used and provide appropriate direction, supervision, and review, particularly when AI-generated information influences risk assessments, audit procedures, documentation, or conclusions. AI may change how audit work is performed, but it does not transfer accountability for the audit opinion from the auditor to the technology.
For additional perspective on the opportunities and challenges of AI adoption, explore CPAClub’s guide to smarter accounting with AI and automation tools.
What This Means for Your Next Audit
AI-generated financial information is becoming part of the environment auditors are expected to understand, but its increasing use does not necessarily require an entirely new approach to auditing. The fundamental questions remain familiar. What could go wrong? What controls address those risks? And what evidence is necessary to support the auditor’s conclusions? The difference is that AI can introduce new considerations about data quality, model behavior, transparency, consistency, and oversight.
A practical evaluation should address five areas:
- AI use: Understand where AI affects financial reporting and which financial statement assertions may be affected.
- Data reliability: Evaluate the accuracy, completeness, relevance, and reliability of the information supporting AI-generated outputs.
- AI-specific risks: Consider model limitations, hallucinations, explainability, bias, and other risks relevant to the intended use.
- Controls: Understand relevant governance, data integrity, change management, output validation, and human review controls.
- Audit responsibility: Obtain sufficient appropriate audit evidence and maintain appropriate professional judgment, supervision, and review.
AI may change how financial information is prepared, processed, and presented, but it does not change the auditor’s fundamental responsibility to obtain sufficient appropriate audit evidence. The question isn’t simply whether AI was used, but whether the information produced can be understood, evaluated, and relied upon for its intended audit purpose. As AI becomes more embedded in financial reporting, audit firms that understand these distinctions will be better positioned to evaluate risk, maintain audit quality, and adopt emerging technologies responsibly.
If your firm is evaluating AI-related audit risks or looking to strengthen its audit quality practices, connect with CPAClub to explore how we can help.
