How PCAOB External Auditors Should Be Using Artificial Intelligence: From Risk Assessment to Audit Evidence and Fraud Detection
Practical AI Applications for CPA Firms, Engagement Partners, Audit Managers, and Audit Staff
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | PCAOB Auditing Standards, Artificial Intelligence, Audit Quality, and External Audit Tradecraft
Artificial intelligence is changing how external auditors plan engagements, evaluate risks, examine financial information, test internal controls, and document audit evidence.
For CPA firms performing audits under Public Company Accounting Oversight Board (PCAOB) standards, AI presents an important opportunity to improve audit efficiency, expand analytical capabilities, and strengthen audit quality.
External auditors can use tools such as ChatGPT, Claude, and approved AI-enabled audit applications to research accounting issues, develop preliminary audit procedures, analyze large transaction populations, evaluate contracts, identify unusual transactions, and improve audit documentation.
However, using AI in a PCAOB audit is fundamentally different from using AI for general business research.
External auditors must demonstrate that AI-assisted procedures comply with applicable PCAOB auditing standards and produce sufficient appropriate audit evidence to support their conclusions.
An AI-generated answer is not automatically reliable audit evidence. An automated analysis is not necessarily an adequate audit procedure. And an AI-generated workpaper does not demonstrate that the auditor actually performed the documented work.
The challenge for external auditors is learning how to combine AI capabilities with professional skepticism, sound audit methodology, appropriate supervision, and effective documentation.
Corporate Compliance Seminars offers a practical, two-day AI Boot Camp for Auditors & Finance Professionals designed to help professionals develop these skills.
The program offers 16 CPE credits, with upcoming in-person sessions in San Antonio, Tucson, Denver, and Scottsdale.
1. AI Should Become Part of the External Auditor's Professional Toolkit
External auditors are required to understand their clients' businesses, identify and assess risks of material misstatement, evaluate internal controls, obtain sufficient appropriate evidence, and form an opinion on the financial statements.
These responsibilities involve significant research, analysis, documentation, and professional judgment.
AI can assist throughout the audit process.
For example, an external auditor can use an approved AI tool to develop preliminary industry risk profiles, analyze revenue transactions, compare contract provisions, identify unusual journal entries, or review draft audit documentation for missing elements.
AI may also help auditors understand complex accounting transactions and prepare more focused questions for management.
The objective is not to automate professional judgment.
It is to improve the auditor's ability to identify risks, analyze information, and obtain persuasive audit evidence.
AI should make the auditor more effective—not less skeptical.
2. Using AI During Audit Planning — PCAOB AS 2101
PCAOB AS 2101, Audit Planning, establishes requirements for planning an audit engagement.
Effective planning requires auditors to consider the company's business, reporting environment, significant accounts, relevant risks, and available audit resources.
AI can help engagement teams organize preliminary information and identify areas requiring additional attention.
For example, an auditor could ask:
Develop a preliminary audit planning risk profile for a publicly traded manufacturing company experiencing declining gross margins, increasing inventory balances, and pressure to meet earnings forecasts. Identify potential financial statement risks, relevant assertions, and questions the audit team should investigate.
AI may suggest risks involving inventory valuation, revenue recognition, management estimates, or potential management bias.
The engagement team must evaluate those suggestions against actual company information.
AI-generated planning analyses should not replace required audit planning procedures.
They can, however, help auditors develop a more comprehensive understanding of potential engagement risks.
3. Using AI to Identify Risks of Material Misstatement — PCAOB AS 2110
PCAOB AS 2110, Identifying and Assessing Risks of Material Misstatement, requires auditors to perform risk assessment procedures and evaluate the risks affecting financial statement assertions.
AI can help auditors examine financial trends, identify unusual relationships, and develop hypotheses about possible misstatements.
Consider a company reporting:
Revenue growth of 18%.
Accounts receivable growth of 42%.
Declining operating cash flow.
Increasing sales near the end of the reporting period.
AI-assisted analysis might identify potential concerns involving revenue recognition, collectability, or cutoff.
The auditor could then design procedures to investigate the relationships.
For example:
Analyze these financial statement trends and identify possible risks of material misstatement. Distinguish analytical observations from conclusions that require additional audit evidence. Identify relevant financial statement assertions.
The AI output provides a starting point.
The auditor remains responsible for evaluating the risks and determining the appropriate audit response.
4. Using AI to Develop Audit Responses — PCAOB AS 2301
PCAOB AS 2301, The Auditor's Responses to the Risks of Material Misstatement, requires auditors to design and implement responses to assessed risks.
AI can help develop preliminary audit procedures aligned with particular risks and assertions.
For example, an auditor examining inventory valuation could ask:
Develop proposed substantive audit procedures addressing inventory valuation risks for a manufacturer with slow-moving inventory, declining sales, and significant inventory obsolescence estimates. Identify the evidence needed and explain how each procedure responds to the valuation assertion.
The output might suggest examining subsequent sales, testing inventory aging, evaluating historical write-offs, and challenging management's assumptions.
The engagement team must determine whether the proposed procedures are appropriate and sufficient.
AI can help design an audit response, but it cannot determine whether the audit evidence ultimately obtained is sufficient.
5. Using AI to Analyze Revenue Recognition Under ASC 606
Revenue recognition is frequently a significant area of audit attention.
Complex contracts, multiple performance obligations, variable consideration, and cutoff issues can create risks of material misstatement.
AI can assist auditors in analyzing contract language and identifying provisions relevant to ASC 606.
For example:
Review this customer contract and identify provisions potentially affecting revenue recognition under ASC 606, including performance obligations, variable consideration, acceptance clauses, payment terms, and contract modifications. Cite the relevant contract sections and identify questions requiring further audit investigation.
The auditor must verify the analysis against the contract and authoritative accounting guidance.
AI should not be relied upon to make the final accounting determination without appropriate professional evaluation.
Practical application
An engagement team could use an approved AI tool to help screen a large population of customer contracts for unusual provisions.
Contracts containing acceptance conditions, rights of return, or nonstandard payment terms could be identified for further examination.
This approach may improve the auditor's ability to identify contracts requiring additional attention.
However, the team must evaluate the completeness and accuracy of the contract population and validate the AI classification results.
6. Using AI to Evaluate Audit Evidence — PCAOB AS 1105
PCAOB AS 1105, Audit Evidence, is central to the responsible use of AI in external auditing.
Auditors must obtain sufficient appropriate audit evidence.
Appropriateness includes the relevance and reliability of the evidence.
AI can assist in organizing and analyzing information, but the reliability of the underlying information and the procedures used to process it remain critical.
Consider an AI-assisted analysis of accounts receivable.
The auditor uploads a company-generated aging report into an approved analytical environment and asks the system to identify overdue balances and unusual customer trends.
Before relying on the results, the auditor must consider whether the aging report is accurate and complete.
The auditor must also evaluate whether the analytical procedures were performed correctly.
An attractive AI-generated dashboard does not establish that the underlying information is reliable.
Four questions every auditor should ask
Is the underlying information complete and accurate?
Is the AI-assisted analytical method appropriate for the audit objective?
Have the outputs been validated?
Do the results provide relevant and reliable evidence for the assertion being tested?
These questions should become routine whenever AI is used to assist audit procedures.
7. Using AI for Journal Entry Testing and Fraud Risk — PCAOB AS 2401
PCAOB AS 2401, Consideration of Fraud in a Financial Statement Audit, requires auditors to consider fraud risks, including the risk of management override of controls.
AI-assisted data analytics can help auditors examine large populations of journal entries and identify unusual transactions.
Potential indicators include entries posted late at night or on weekends, entries recorded near period-end, unusual account combinations, round-dollar adjustments, manual entries to revenue accounts, and transactions involving rarely used accounts.
For example:
Analyze this journal entry population for unusual posting patterns, including period-end entries, manual adjustments, uncommon account combinations, and entries recorded by users with elevated privileges. Identify the selection criteria and provide a reproducible exception report.
The resulting analysis may help auditors identify journal entries requiring further examination.
However, auditors must determine whether the procedures meet the requirements of AS 2401.
The auditor must also evaluate the completeness of the journal entry population and the appropriateness of the selection criteria.
An unusual journal entry is not proof of fraud. It is a transaction that may require additional audit investigation.
8. Using AI to Test Internal Controls — PCAOB AS 2201
PCAOB AS 2201 addresses audits of internal control over financial reporting that are integrated with audits of financial statements.
AI can help auditors understand control objectives, analyze process descriptions, and identify potential design weaknesses.
For example, an auditor could ask:
Evaluate the design of a revenue recognition control in which the controller reviews a monthly revenue reconciliation. Identify questions needed to determine the precision of the review, the information used, the evidence of review, and whether the control could detect a material misstatement.
This type of analysis can help the auditor prepare for walkthroughs and control testing.
AI may also assist with organizing evidence from multiple control executions.
However, AI-generated summaries cannot substitute for evidence that the control operated effectively.
The auditor must evaluate whether the control was performed, whether the individual performing it had appropriate authority and competence, and whether the control operated at the necessary level of precision.
A management signoff does not automatically establish effective control operation.
9. Using AI to Evaluate Accounting Estimates — PCAOB AS 2501
PCAOB AS 2501, Auditing Accounting Estimates, Including Fair Value Measurements, addresses one of the most judgment-intensive areas of external auditing.
Accounting estimates may involve uncertain future events, complex valuation models, subjective assumptions, and management judgment.
Examples include goodwill impairment, expected credit losses, inventory reserves, fair value measurements, and contingent liabilities.
AI can help auditors identify relevant assumptions, compare management's methodology with accounting requirements, and organize potential contradictory information.
For example:
Review this management valuation memorandum. Identify significant assumptions, potential sources of estimation uncertainty, indicators of management bias, and additional evidence the auditor should consider under PCAOB AS 2501.
The auditor must independently evaluate the assumptions and evidence.
AI cannot replace required testing of management's process, development of an independent expectation when appropriate, or evaluation of subsequent events and other relevant evidence.
For complex estimates, the engagement team may need specialists with appropriate expertise.
10. Using AI to Strengthen Professional Skepticism — PCAOB AS 1015
PCAOB AS 1015, Due Professional Care in the Performance of Work, addresses professional skepticism.
External auditors must maintain a questioning mind and critically assess audit evidence.
AI can support skepticism by helping auditors identify alternative explanations and potential contradictions.
For example:
Management attributes a 25% increase in revenue to stronger customer demand. Identify alternative explanations, potential financial reporting risks, and evidence the auditor should obtain to evaluate management's explanation.
AI may suggest evaluating customer concentration, pricing changes, returns, channel stuffing indicators, or changes in credit terms.
These suggestions can improve the auditor's questioning.
However, AI itself may produce inaccurate or overly confident responses.
Auditors must apply professional skepticism to AI-generated information as well as to management representations.
11. Using AI to Improve Audit Documentation — PCAOB AS 1215
PCAOB AS 1215, Audit Documentation, requires workpapers to contain sufficient information for an experienced auditor with no previous connection to the engagement to understand the procedures performed, evidence obtained, results, and conclusions.
AI can help auditors prepare clearer workpaper narratives and identify missing documentation elements.
For example:
Review this draft audit workpaper. Identify whether it adequately describes the audit objective, risk addressed, nature, timing and extent of procedures, evidence obtained, exceptions, and conclusion. Do not invent procedures or evidence.
The auditor can use the response to improve documentation.
However, AI should never be used to fabricate work performed or create unsupported conclusions.
The engagement team must retain sufficient documentation of actual procedures and evidence.
When AI-assisted analysis materially supports an audit conclusion, the documentation should explain the procedures performed, information used, validation performed, and conclusions reached.
The firm's documentation and retention policies should address AI-generated outputs and related supporting records.
12. Using AI to Support Audit Supervision — PCAOB AS 1201
PCAOB AS 1201, Supervision of the Audit Engagement, establishes responsibilities for supervising engagement team members.
AI can assist supervisors by identifying inconsistencies in workpaper narratives, missing references, or incomplete descriptions of procedures.
For example, a manager might use an approved tool to compare an audit program with the associated workpaper documentation.
The tool could flag procedures lacking documented conclusions or workpapers that do not address the stated audit objective.
This may improve review efficiency.
However, the engagement partner and other responsible reviewers must still perform the supervision and review required by applicable PCAOB standards.
AI-assisted quality checks are not a substitute for professional review.
13. Using AI to Evaluate the Results of the Audit — PCAOB AS 2810
PCAOB AS 2810, Evaluating Audit Results, requires auditors to evaluate the results of audit procedures and the implications of identified misstatements and other findings.
AI can help engagement teams organize audit differences, identify recurring themes, and prepare preliminary summaries.
For example:
Organize these identified audit differences by financial statement account, assertion, and potential root cause. Highlight matters that may require further evaluation and identify missing information. Do not determine materiality or conclude that the differences are acceptable.
The output can support engagement team discussions.
The auditor remains responsible for evaluating misstatements, considering qualitative factors, assessing the sufficiency of audit evidence, and determining whether additional procedures are necessary.
14. Using AI to Improve Audit Committee Communications — PCAOB AS 1301
PCAOB AS 1301, Communications with Audit Committees, establishes requirements for communicating specified matters to the Audit Committee.
AI can assist auditors in organizing information for required communications.
For example, the engagement team might use AI to help prepare a preliminary summary of significant accounting policies, critical accounting estimates, significant unusual transactions, and difficult or contentious matters arising during the audit.
The tool may help improve clarity and organization.
However, the auditor must determine which matters require communication, verify the accuracy of the information, and ensure that communications comply with applicable PCAOB requirements.
AI should support effective communication, not replace direct professional engagement with the Audit Committee.
15. Using AI for Audit Research and Technical Accounting Questions
External auditors regularly encounter unfamiliar transactions and complex accounting requirements.
AI can accelerate preliminary research.
For example:
Explain the accounting considerations for a business combination involving contingent consideration under U.S. GAAP. Identify relevant ASC topics, areas requiring professional judgment, and questions the engagement team should investigate.
This may help the auditor identify relevant technical issues.
However, AI-generated citations and interpretations must be verified against authoritative accounting literature.
A chatbot's response should not be treated as authoritative guidance.
Audit teams should use approved research platforms and established technical consultation procedures.
16. A Practical AI Workflow for PCAOB Auditors: Ask, Get, Perform, Verify, and Document
External auditors should adopt a disciplined methodology for using AI.
Ask
Define the audit objective, relevant financial statement assertion, applicable standard, available information, and expected output.
Get
Obtain an AI-generated analysis, preliminary procedure, exception report, or research summary.
Perform
Conduct the actual audit procedures using appropriate evidence and approved tools.
Verify
Validate the source information, analytical methodology, AI output, and conclusions.
Document
Prepare workpapers explaining what was performed, what evidence was obtained, how the
AI-assisted results were evaluated, and what conclusions were reached.
For example, an auditor could use this process to identify unusual revenue transactions.
The auditor defines the objective and requests an analytical approach.
AI assists in developing the exception criteria.
The auditor applies those criteria to a validated transaction population.
The engagement team examines selected exceptions and verifies the supporting evidence.
Finally, the procedures, results, and conclusions are documented in accordance with PCAOB requirements.
This approach treats AI as an audit tool operating within a controlled audit methodology—not as an independent source of audit assurance.
17. Risks CPA Firms Must Address Before Using AI
CPA firms should establish appropriate safeguards for AI use.
Client confidentiality
Auditors must protect confidential client information and use only approved applications consistent with professional obligations and firm policies.
Data security
Firms should understand how AI providers process, retain, and protect uploaded information.
Accuracy and hallucinations
AI-generated responses may contain incorrect calculations, fabricated references, or unsupported conclusions.
Completeness of information
AI analysis may be unreliable when the underlying data population is incomplete or inaccurate.
Reproducibility
Audit teams should be able to explain and, where necessary, reproduce the analytical procedures supporting their conclusions.
Supervision and review
AI-assisted work must remain subject to appropriate engagement supervision and review.
Independence
Firms must consider applicable auditor independence requirements when deploying AI tools, particularly when providing technology-related services to audit clients.
Documentation
AI-assisted procedures should be documented sufficiently to support the audit conclusions and applicable quality requirements.
These safeguards are essential to maintaining audit quality.
18. What Should CPA Firms Be Doing Now?
CPA firms should begin incorporating AI into their audit methodologies in a controlled and systematic manner.
A practical starting point is to identify audit activities where AI can improve efficiency without compromising evidence quality.
Examples include preliminary risk research, audit planning, contract review, journal entry analysis, workpaper quality checks, and audit report preparation.
Firms should establish approved tools, data protection requirements, validation procedures, and documentation expectations.
Engagement teams should receive practical training and understand when specialist involvement or technical consultation is necessary.
Firms should also evaluate how AI use affects their systems of quality control, including the requirements of PCAOB QC 1000 where applicable.
The objective should be to improve audit quality and consistency while preserving professional skepticism, independence, and accountability.
Earn 16 CPE Credits: AI Boot Camp for Auditors & Finance Professionals
Corporate Compliance Seminars is offering a two-day, hands-on AI Boot Camp for Auditors & Finance Professionals designed to help audit professionals develop practical AI capabilities.
The training is particularly relevant to CPA firm personnel performing financial statement audits, integrated audits, and other assurance engagements.
Participants will explore how AI can assist with audit planning, risk assessment, financial data analysis, fraud detection, control evaluation, document review, and audit reporting.
Upcoming in-person events
City | Dates | CPE credits |
San Antonio, Texas | November 5–6, 2026 | 16 |
Tucson, Arizona | November 19–20, 2026 | 16 |
Denver, Colorado | December 3–4, 2026 | 16 |
Scottsdale, Arizona | December 17–18, 2026 | 16 |
Event details
Program: AI Boot Camp for Auditors & Finance Professionals
CPE credits: 16
Delivery format: In-person, Group-Live
Program level: Basic to Advanced
Prerequisites: None
Thursday: 9:00 a.m.–5:00 p.m.
Friday: 9:00 a.m.–4:00 p.m.
Who should attend?
CPA firm associates and senior auditors.
External audit managers and engagement partners.
Professionals performing PCAOB financial statement audits.
Auditors involved in integrated audits of internal control over financial reporting.
Audit quality and methodology professionals.
Financial reporting and assurance professionals.
Auditors interested in applying AI to fraud risk assessment and audit analytics.
Practical skills participants can develop
Participants will learn how to use AI to research complex audit topics, develop more effective prompts, analyze financial information, identify potential fraud indicators, organize
audit evidence, and improve audit documentation.
The training emphasizes practical applications, appropriate verification, and responsible use of AI.
No programming experience is required.
Register for the City That Works Best for You
Select from San Antonio, Tucson, Denver, or Scottsdale.
Conclusion: AI Competence Is Becoming an Essential External Audit Skill
AI offers CPA firms an opportunity to improve the efficiency and effectiveness of external audit engagements.
It can help auditors identify risks, analyze large transaction populations, examine contracts, evaluate accounting estimates, develop audit procedures, and improve workpaper documentation.
However, AI does not eliminate the requirements of PCAOB auditing standards.
Auditors must continue to exercise professional skepticism, obtain sufficient appropriate
audit evidence, evaluate contradictory information, document their procedures, and support their conclusions.
The most effective external auditors will be those who combine strong knowledge of PCAOB standards with practical AI skills.
AI should strengthen the audit process, improve the quality of audit evidence, and allow auditors to devote more attention to the matters requiring professional judgment.
Corporate Compliance Seminars provides hands-on training to help audit professionals develop these capabilities.
Earn 16 CPE credits and learn how to apply AI to external auditing.
Corporate Compliance Seminars — Professional CPE Training in PCAOB Auditing Standards, Artificial Intelligence, Audit Evidence, Internal Controls, Fraud Risk, and External Audit Tradecraft.
Comments