Can AI do an audit? What an AI-assisted audit is, and whether your bank will accept it
By Alon Zieve FCA · Last reviewed
Can AI do an audit? Not by itself. In the UK a company's statutory auditor must be eligible under the Companies Act 2006, which in practice means an individual or firm registered with a recognised supervisory body, and where the auditor is a firm, a named person at that firm signs the report on its behalf. AI tools can do a good deal of the reading, matching and checking, under the audit team's direction. People at the audit firm obtain and evaluate the evidence and form the opinion. An audit done that way is a real audit, under the same standards, and your bank or investors receive the same auditor's report. This guide is for directors and finance teams choosing an auditor or offered an "AI-assisted" audit.
Can AI do an audit? The short answer
No. Software cannot be appointed as a UK company's auditor or sign its audit report; it can only be a tool that a registered auditor uses for parts of the work. The law decides who can audit financial statements. Section 1212 of the Companies Act 2006 says that "an individual or firm is eligible for appointment as a statutory auditor if the individual or firm (a) is a member of a recognised supervisory body, and (b) is eligible for appointment under the rules of that body". The only other route is for the four public-sector Auditors General (s1226). The four recognised supervisory bodies are ICAEW, ICAS, Chartered Accountants Ireland and ACCA. The audit regulations the first three issue jointly add that no individual or firm may accept an audit appointment unless it is registered (regulation 2.01, 1 October 2026 edition). Acting as a statutory auditor while ineligible is a criminal offence, punishable by a fine (s1213(1), (3) and (4)); it is a defence to show that the person did not know, and had no reason to believe, that they were ineligible (s1213(8)).
A person signs the report. Where the auditor is a firm, "the report must be signed by the senior statutory auditor in his own name, for and on behalf of the auditor" (s503(3)). Only a responsible individual can sign an audit report (regulation 4.04 of the same regulations), and the regulations' guidance describes responsible individuals as those "responsible for the audit work in a registered auditor".
So software cannot be your auditor. It can be a tool a registered firm uses for parts of the work, with the firm's people deciding what to rely on.
What AI can do in an audit, and what stays with people
The Financial Reporting Council (FRC), which issues the UK auditing standards, lists current and potential uses including matching supporting documents to samples, checking the arithmetic in financial statements, summarising minutes, reviewing contracts, translating documents, answering audit teams' queries, and agentic tools automating certain audit procedures (factsheet on its Generative and Agentic AI Guidance, March 2026). ISA (UK) 220, the standard on quality management for an audit, says technology "may assist the auditor in obtaining sufficient appropriate audit evidence", and warns that inappropriate use may "increase the risk of overreliance on the information produced" (para A64).
| Point in the audit | A tool may help with | What stays with people | Where it is required |
|---|---|---|---|
| Accepting the audit; independence | None in the FRC's examples | The engagement partner (the partner in charge) confirms the firm's acceptance procedures were followed and, before dating the report, that independence and the other ethical requirements are met | ISA (UK) 220 paras 21–22 |
| Assessing risks; setting materiality | Analysing ledger data, recalculating, reconciling; flagging higher-risk contracts | The auditor assesses the risks of material misstatement and sets materiality (the size of error that would matter to a reader), a judgement made "in the light of surrounding circumstances" | ISA (UK) 315 paras 13, 28, A21; ISA (UK) 320 para 10; ISA (UK) 200 para 6 |
| Designing the procedures | First drafts of working papers | The auditor designs the further procedures in response to the assessed risks | ISA (UK) 330 para 6; ISA (UK) 315 para 13(b) |
| Testing your records | Matching documents to samples; testing journals; checking arithmetic; summarising board minutes | The auditor evaluates whether the company's information is reliable enough, including its accuracy and completeness | ISA (UK) 500 para 9 |
| Evidence from beyond your records | Reaching a bank's or customer's records directly through portals or software interfaces | Where confirmations are used, the auditor controls the requests: what to confirm, whom to ask, how requests are designed and sent; and the auditor attends the stock count where stock is material, unless impracticable | ISA (UK) 505 paras 6(a), 7; ISA (UK) 330 para 19; ISA (UK) 501 para 4 |
| Evaluating what was found | Flagging unusual items, such as the riskier journals the FRC's example tool selects | The auditor applies professional scepticism, "a critical assessment of audit evidence"; the standards name overreliance on automated tools as an impediment to it | ISA (UK) 200 paras 13(l), 15; ISA (UK) 220 para A35 |
| Reviewing the work | Reviewing work to identify omissions or inconsistencies | The engagement partner directs, supervises and reviews the team's work, including the significant judgements | ISA (UK) 220 paras 29, 31 |
| Concluding | None in the FRC's examples | The engagement partner determines that sufficient appropriate evidence supports the conclusions and the report, which gives the true and fair opinion | ISA (UK) 220 para 32; CA 2006 s495(3) |
| Signing | None | The senior statutory auditor, a responsible individual, signs for the firm | CA 2006 s503(3); Audit Regulation 4.04 |
For how firms use AI at each stage, see how auditors use AI.
Is an AI-assisted audit a real audit?
Yes, when a registered firm carries it out under the International Standards on Auditing (UK), the ISAs (UK). "AI-assisted" describes how some of the work is done; it is not a separate kind of audit. The same law, the same ISAs (UK) and the same "reasonable assurance" apply: "a high, but not absolute, level of assurance" (ISA (UK) 200).
The FRC's guidance points the same way. Its first guidance on AI in audit, in June 2025, "is not prescriptive, and the requirements against which firms will be assessed remain only those in the ISQMs and ISAs (UK)". Publishing its second, in March 2026, its Executive Director of Regulatory Standards, Mark Babington, said "it is people - the firms and Responsible Individuals - who are accountable for audit quality".
Software on audits is not new: the standards already provide for "automated tools and techniques" working through "large volumes of data" (ISA (UK) 315 para A21). What is newer is generative AI, which can "generate content in response to prompts", and agentic AI, which can carry out tasks "toward a goal, with some degree of autonomy" (FRC factsheet). What makes the audit real is not the tool but who obtained and evaluated the evidence, who concluded, and whether the file lets an experienced auditor with no previous connection to the audit follow it (ISA (UK) 230 para 8).
Can AI do a financial audit on its own?
No. Whether it is a general chatbot or a product built for audit, three things stand in the way, and none is about how capable the software is: it cannot be appointed or registered, independence and scepticism are duties of the auditor, and the standards look for evidence from beyond your company's own records.
It cannot be appointed or registered
Eligibility belongs to members of a recognised supervisory body who are eligible under its rules (s1212). Registration requires, among other things, that the firm is fit and proper and has professional indemnity insurance or other appropriate arrangements (Audit Regulations 2.02(a) and (b)). So can AI audit financial statements? Only as a tool in a registered firm's hands.
Independence and scepticism are duties of the auditor
ISA (UK) 200 requires the auditor to comply with ethical requirements "including those related to independence" (para 14) and to apply professional scepticism (para 15). It uses "auditor" for "the person or persons conducting the audit, usually the engagement partner or other members of the engagement team, or, as applicable, the firm" (para 13(d)). These duties fall on the firm and its people, who must be sceptical about what their tools produce.
Some evidence comes from beyond your own records
"The reliability of audit evidence is increased when it is obtained from independent sources outside the entity" (ISA (UK) 500 para A35). The auditor must consider whether to seek confirmations from banks, customers and others (ISA (UK) 330 para 19) and, when using them, controls the requests (ISA (UK) 505 para 7); where stock is material, the auditor attends the count unless that is impracticable (ISA (UK) 501 para 4). A tool fed only your own ledger is reading your own records.
Can ChatGPT do an audit?
No. A general chatbot can help a finance team prepare, for example by drafting or summarising (see using AI in a finance department). But its output is not evidence an auditor obtained, nobody is appointed, and nobody signs. The same goes for software sold as an AI financial audit tool that a company runs over its own records. For an auditor, pasting client records into a public tool raises confidentiality, which ISA (UK) 220 names as one of the ethical requirements that inappropriate use of technology can put at risk (para A64).
Who is responsible if the AI gets it wrong?
The audit firm and the engagement partner. The FRC's factsheet says: "The firm and engagement partner retain full responsibility for audit quality, in accordance with ISQM (UK) 1 and ISA (UK) 220 respectively."
The engagement partner "shall take overall responsibility for managing and achieving quality on the audit engagement" (ISA (UK) 220 para 13) and, in the UK, bears overall responsibility for complying with the ISAs (UK) and for the report being appropriate (para 29-1). The firm's quality management standard, ISQM (UK) 1, makes it one of the firm's quality objectives that "appropriate technological resources are obtained or developed, implemented, maintained, and used" (para 32(f)). The FRC names three risks to audit quality from generative and agentic AI: deficient output, misuse of output, and a methodology that lets tools be used in ways that fail the standards. The risk of deficient output, it says, "can not be eliminated" because large language models have inherent limitations, and it lists review and oversight by people among the mitigations.
The law adds personal liability. Under section 507, where the auditor is a firm, any director, member, employee or agent of the firm who is eligible for appointment as the company's auditor commits an offence if they knowingly or recklessly cause the report to include anything "misleading, false or deceptive in a material particular". The tool's maker is not appointed and is not the company's auditor.
Your board's duties do not move either. Directors "must not approve accounts" unless satisfied they give a true and fair view (s393(1)). In an audited company's directors' report, each director states that, so far as they are aware, the auditor has all relevant audit information (s418(2)); a director who knew the statement was false, or was reckless about it, and failed to take reasonable steps to stop the report being approved, commits an offence (s418(5)).
Will your bank or investors accept an AI-assisted audit?
What matters is what your agreement asks for. If your facility or shareholders' agreement asks for audited accounts, nothing in the Companies Act or the ISAs (UK) makes an audit by a registered auditor less of an audit because the firm used AI tools. Check whether the agreement also limits which auditors are acceptable, and plan around the deadline. If the law does not require your audit and a lender asked for one, see a voluntary audit.
Your bank or investors receive what any audit produces: the auditor's report, made "to the company's members" (s495(1)); ICAEW's recommended wording says it "is made solely to the company's members, as a body". It identifies the company, the accounts and period, the reporting framework and "the auditing standards in accordance with which the audit was conducted" (s495(2)), and gives the opinion (s495(3)). Its form is set mainly by ISA (UK) 700; a revised edition issued in May 2026 applies to periods commencing on or after 15 December 2026, with early adoption permitted. Neither section 495 nor either edition of ISA (UK) 700 asks for the tools to be described, so ask the firm, not the report, which tools were used.
If your investors have asked for an audit, tell us about your company: Innate offers statutory audits signed by an ICAEW-registered partner firm, which your company appoints as its auditor, with our platform doing the legwork to save you time and money.
What to ask an auditor that uses AI
These are the AI-specific questions; for the general ones, see how to choose an auditor.
| Question | Why it matters | A good answer |
|---|---|---|
| Which tools will the firm use, and for what? | The FRC warns that a tool designed for one task may produce "a plausible-looking output for another" that is wrongly relied on | The tools, the parts of the audit each is used for, and what each is not used for |
| Who reviews what the tools produce, and how closely? | Human review is one of the FRC's four kinds of mitigation; the engagement partner is responsible for review (ISA (UK) 220 para 29) | Named roles, the level of review for each kind of output, and the partner's review of significant judgements |
| How did the firm satisfy itself the tools work for this use? | The firm's technology must be appropriate (ISQM (UK) 1 para 32(f)); certification is another of the FRC's mitigations | How each tool was approved for the use, and how its use is recorded on the file |
| Where is the company's data processed and stored, and on what terms? | ISA (UK) 220 names confidentiality as a risk of inappropriate use of technology (para A64) | The countries, the contract terms, and who else handles the data |
| Is the company's data used to train any model? | The records may include personal and commercially sensitive data | A clear yes or no, written into the engagement terms |
| Who will sign the report, and when will you meet them? | The senior statutory auditor signs and must be a responsible individual (s503(3); Audit Regulation 4.04) | A named person involved in the audit, not only at the end |
Innate, which publishes this guide, builds audit software: how the Innate platform uses AI answers the questions about the platform and the company's data. The audit questions are for the auditor: for an audit through Innate, that is the ICAEW-registered partner firm the company appoints.
What the regulator has said about AI so far
Three recent steps, all aimed at audit firms rather than the companies they audit:
- June 2025. The FRC's first guidance on AI in audit (26 June 2025): an illustrative tool for testing journals, and principles for documenting tools that use AI. It "does not introduce new regulatory requirements".
- March 2026. Guidance on generative and agentic AI (30 March 2026), mainly for the central functions at firms that develop the tools and methodologies: three risks to audit quality, four kinds of mitigation (system design and development, certification, staff education and governance, human review and oversight), and worked examples of a board-minutes summary tool and a contract review tool.
- June 2026. An Audit Tech & AI Sandbox, which opened for applications on 4 June 2026 and is open to "audit firms of all sizes across the UK market"; the FRC's role "is not to develop or endorse specific products".
Practitioners' detail is in the FRC's AI audit guidance; more guides are under AI in auditing. Under the law today, an audit is something a registered auditor carries out and, where the auditor is a firm, a responsible individual signs, with AI as one of its tools.