Audit Independence, Evidence and AI
Audit raises distinct questions about AI. A tool that both prepares and tests the same figure may create a self-review threat. When AI contributes to a conclusion, the file must show how its output was checked. The auditor retains professional scepticism, judgement and responsibility throughout.
An audit opinion is relied upon beyond the client that commissioned it. Its value depends on the auditor's independence and on sufficient, documented evidence. AI can assist an audit team with reading, extraction and analysis. Because it may affect both independence and the evidence chain, its use must be designed, reviewed and recorded with care.
1Why audit is the sharpest case
Confidentiality matters across an accounting firm. Audit adds further questions about independence, evidence and the basis for the opinion.
The auditor must be independent. The file must also demonstrate the basis for each significant conclusion. These are core professional requirements.
AI use that weakens either requirement creates more than a technology risk. It may undermine the audit itself.
The firm should therefore decide where AI may be used, what evidence must be retained and who reviews its output before the engagement begins.
2The self-review threat, made concrete
Independence frameworks address self-review: the risk that a firm audits its own work and cannot be sufficiently objective about it. AI can create a new route to that familiar threat.
Consider a tool that generates adjustments, a reconciliation or a draft disclosure, then tests the same output. The same instrument has helped prepare the answer and assess it.
The firm must assess whether that use creates an unacceptable self-review threat under the applicable ethics code. AI need not be excluded from every preparation or testing task. The boundary must be deliberate, visible in the engagement design and open to review.
3Evidence has to survive being looked at
An audit file should allow the work and significant conclusions to be understood after the engagement. Each conclusion must trace back to evidence that a reviewer or regulator can inspect.
AI can produce a plausible answer without exposing a reliable reasoning path. If that answer feeds a conclusion without verification, the evidence chain contains a gap. A note that the tool suggested an answer and staff accepted it is not enough.
Where AI is used, the file should record its purpose, the information it worked with and how a person checked the output against source. The auditor designs the test, applies professional scepticism and reaches the conclusion. The role of AI is documented, not hidden.
Anything AI contributed to a conclusion should remain inspectable after the work is complete. If a reviewer cannot follow the source, the check and the human conclusion, the output is not ready for the evidence chain.
4The judgement cannot be delegated
Professional scepticism underpins both independence and evidence. The auditor must question contradictory information, investigate unusual results and notice what may be missing. A model cannot take on that duty.
Generative AI can produce confident, fluent and inaccurate answers. Its apparent certainty must not replace the auditor's own challenge and verification.
AI is decision-support, not the decision-maker.
The tool can assist with reading, extraction and pattern surfacing. It cannot be sceptical on the auditor's behalf or carry the responsibility attached to the signature.
Judgement and accountability stay with the auditor. Every AI-assisted result remains subject to human review.
5Where the data has to live for any of this to hold
The firm must also control where confidential audit work is processed and how the record of AI use is retained.
Many firms already store files in well-run cloud systems. Storage is not the same as sending confidential audit evidence to a public or third-party AI model for processing. The latter introduces another provider, another set of terms and another point the firm must account for.
Secure Accounting runs on premises and works with authorised firm knowledge and client files. It supports cited answers that accountants can check. The firm still needs policies for documentation, access, retention and review, but confidential AI processing remains under the firm's control.
The limits of this paper
This paper is not a substitute for the applicable ethics code, auditing standards or regulator guidance. These requirements continue to develop. Each firm should set its independence policy and confirm current requirements. AI use in audit should be governed at engagement level, with the auditor retaining judgement and accountability.
6What a governed audit team actually does
In practice, the discipline is clear.
Decide, at engagement level, where AI may and may not be used, and keep the preparation side and the assurance side from collapsing into the same tool used the same way.
Record where AI was used, over what, and how its output was checked against source, so the file stays inspectable.
Keep the design of tests, the scepticism and the conclusion in human hands, and treat every AI output as a draft to be verified rather than a result to be trusted.
Keep confidential AI processing on premises and under the firm's control. Apply the firm's evidence, retention and confidentiality policies to the AI-assisted work. The audit must remain defensible because the team can show what the tool did, how its output was checked and who reached the conclusion.
See it against your own audit workflow
See how Secure Accounting can support research, document review and drafting while confidential client work stays on premises. A discovery conversation can examine where AI may fit within your audit workflow and governance requirements.
Book a discovery conversation →Notes & further reading
- Independence and self-review: the international ethics code for professional accountants (adopted via the MIA By-Laws) and its independence provisions for assurance engagements; the self-review threat as applied to tools that both prepare and test. Confirm the current code and any AI-specific guidance.
- Audit evidence and documentation: the auditing standards' requirements for sufficient appropriate evidence and for a file that supports the opinion; professional scepticism as a standing requirement. Any AI use must remain inspectable within that framework.
- Regulator direction: audit oversight bodies in this region and internationally (for example Malaysia's Audit Oversight Board, and counterparts such as the PCAOB and FRC) are actively developing expectations on AI use in the audit. Reconfirm current positions before circulation, as this area is moving quickly.
- Retention and confidentiality: statutory and professional working-paper retention duties, and the confidentiality obligations that an on-premises Secure Accounting deployment can help a firm address. See companion paper C11, AI & Professional Obligations.
- Companion pieces: The Assistant You Already Trust and The Layer Above the Ledger; and, within Series C, C7 AI Over Structured Financial Data.
This paper is a perspective for audit leadership and is not professional, legal or regulatory advice. Ethics codes, auditing standards and oversight expectations on AI differ by jurisdiction and are developing; confirm the current position with your standards and regulator before relying on it.