AI in auditing: balancing efficiency gains and responsibility

AI becomes part of everyday audit practice

Artificial intelligence is no longer a topic for the future. Whether through automated data analytics, intelligent document review or generative AI applications, the technology is increasingly becoming part of business processes and is also transforming the work of auditors.

At the same time, new questions are emerging. Which tasks can be supported by AI? Where does the auditor’s responsibility remain unchanged? And what impact does the use of AI have on governance, internal controls and the statutory audit?

With IDW PS 861, the Institute of Public Auditors in Germany (IDW) has established a standard that enables the assurance of AI systems and provides guidance for both businesses and auditors in dealing with AI. But what does this mean in practice?

AI as an audit tool: where it already adds value today

Auditing has always involved the analysis of large volumes of data. As a result, the potential for artificial intelligence is considerable. Today, 78% of German audit firms have established dedicated AI competence centres.

The reasons are clear. When reviewing supporting documents, analysing large volumes of accounting data or identifying anomalies within account structures, AI can support audit teams and uncover patterns that may easily be overlooked in a purely manual sample-based review. This allows processes to be accelerated while enabling auditors to focus their attention on higher-risk areas.

For clients, this does not necessarily mean a different audit – but often a more targeted one that focuses on genuine areas of risk.

IDW PS 861: the first standard for the assurance of AI systems

With IDW Assurance Standard 861, the IDW introduced a framework in 2023 that allows AI systems themselves to become the subject of an assurance engagement. The standard is based on the international assurance standard ISAE 3000 for assurance engagements other than audits or reviews of historical financial information.

In simple terms, an engagement can assess whether an AI system has been appropriately designed and whether the controls defined for that system operate effectively in practice. For businesses that rely on AI systems in key operational processes, this creates an opportunity to obtain independent assurance regarding the reliability of those systems.

Responsibility remains with the auditor

No matter how powerful modern AI systems become, professional responsibility cannot be delegated.

Auditors must continue to assess independently whether audit procedures have been performed appropriately and whether the evidence obtained is sufficiently reliable. The output of an AI application must never be accepted without critical review.

This is particularly true for generative AI systems. While these tools can produce convincing content and present complex relationships in an understandable manner, there remains a risk of inaccurate or incomplete outputs. Professional judgement, critical evaluation and plausibility assessments therefore remain essential.

AI is not replacing people. Rather, it is changing the nature of audit work. The focus is shifting away from purely reviewing data towards interpreting results, challenging assumptions and exercising professional judgement.

New challenges for governance and internal controls

As AI adoption increases, so do the requirements placed on internal control systems.

Businesses need to be able to demonstrate:

• which AI applications are being used,
• which data these applications rely on,
• who is responsible for their outputs,
• which risks are associated with their use, and
• how results are monitored and controlled.

Particular attention should be paid to data quality, data protection, information security and potential bias within the underlying models.

From a management perspective, it is becoming increasingly important to establish clear responsibilities and policies governing the use of AI. The responsible deployment of AI is rapidly evolving into a key governance issue.

New audit considerations when clients use AI themselves

The more extensively businesses use AI within their operations, the more relevant the topic becomes within the context of the statutory audit.

Auditors must understand how AI systems are embedded within business processes and what implications this may have for the internal control environment. This goes beyond technical considerations and extends to the reliability of information and the transparency of decision-making processes.

Businesses should therefore document at an early stage:

• which systems are being used,
• which processes are affected,
• how risks are monitored, and
• which controls have been implemented.

In this context, IDW PS 861 may become increasingly relevant as an additional voluntary assurance engagement, independent of the statutory audit itself.

The KHS perspective

Artificial intelligence offers significant opportunities for businesses and auditors alike. Processes can become more efficient, analyses more comprehensive and risks easier to identify at an early stage.

At the same time, the importance of governance, control and accountability continues to grow. The more deeply AI becomes embedded within business processes, the more important clear rules, transparent decision-making and effective control mechanisms become.

The key takeaway is therefore simple: AI can support, accelerate and enhance processes, but responsibility for decisions remains with people.

AI in auditing is no longer an abstract future concept. At KHS, it is already becoming part of everyday audit practice – both as a tool used by our teams and as a potential subject of assurance engagements. At the same time, we increasingly see businesses facing questions around how AI applications should be documented, controlled and integrated into existing governance and compliance frameworks. We support organisations in understanding the relevant regulatory requirements and preparing for potential assurance engagements.

Would you like to understand how the use of AI may affect your internal control system, compliance framework or statutory audit?