How do auditors use AI? Each stage of a UK audit, and what stays with people

How do auditors use AI? Mostly to read, sort, match and flag. Audit firms use, or are developing, AI tools to summarise board minutes, classify contracts, match supporting documents to the items they are testing, score every journal in the ledger for how unusual it looks, and check that the accounts add up. The people on the engagement team use those tools within rules their firm sets, check the results, obtain some evidence directly, and make the judgements the standards require, including the opinion. This guide, for directors and finance teams of UK companies, goes through each stage of a statutory audit.

How do auditors use AI? The short answer

The Financial Reporting Council (FRC), which issues the UK auditing standards, lists the current and potential uses of generative and agentic AI in audit firms as including:

• tools automatically matching supporting documents to samples;
• automated checks of the mathematical accuracy of the financial statements;
• summarising meeting minutes;
• chatbots assisting audit teams with queries;
• translating documents to or from local languages;
• contract review tools that classify or stratify contracts;
• agentic tools automating certain audit procedures.

That list comes from the FRC's Generative and Agentic AI Guidance factsheet of March 2026. The FRC's June 2025 guidance adds a worked example of machine learning that looks for unusual journals, and names drafting tools that produce first versions of working papers (the documents that record the audit work) for a person to review.

None of this changes who the auditor is. A company's statutory auditor must be a firm or individual that is a member of a recognised supervisory body, such as ICAEW, and eligible under its rules (Companies Act 2006 s1212), and where the auditor is a firm, a named person at that firm signs the report (s503(3)). For whether an AI-assisted audit is a real audit, and who signs it, see the companion guide.

Is AI used in auditing in the UK yet?

Yes, but unevenly. In June 2025 the FRC wrote that "we have begun to see tools that use AI being deployed on live engagements, and many more such tools are in development". By March 2026 it described firms as "at varying stages of adopting" generative and agentic AI: some build their own tools, others buy third-party software.

The FRC's thematic review of June 2025 looked at how the six largest audit firms approve automated tools before audit teams may use them. It noted that outside the largest firms, tools are more likely to come from third-party vendors. The FRC's SME Audit Market Study (March 2026) found that smaller audit firms "may lack resources and technical knowledge to implement and customise technology", and that those that do invest rely heavily on off-the-shelf software. We found no primary UK source that gives a percentage of audits that use AI.

Software on audits is not new, and the FRC's 2025 guidance counts traditional machine learning as AI. What is new is generative AI, built on large language models, which can read documents and draft text.

The FRC's guidance is written for audit firms, and mostly for their central technical teams. The 2025 guidance says it "is not prescriptive", and that firms are assessed only against the quality management standards and the ISAs (UK), the International Standards on Auditing as adopted in the UK. Practitioners will find the detail in documenting AI tools under the FRC's guidance.

How AI is used at each stage of a statutory audit

How AI is used in auditing depends on the stage of the audit. The table maps the FRC's examples onto the audit process.

Accepting the engagement and planning

This is the stage with the least AI in it. The engagement partner makes sure the firm's acceptance procedures were followed and, before the report is dated, that the ethical requirements, including independence, have been met (ISA (UK) 220 paras 21–22). The auditor then determines materiality, the size of error that would matter to a reader of the accounts (ISA (UK) 320 para 10). A drafting tool may produce a first version of the plan, but it is a draft for someone on the team to review and change. None of the FRC's examples has a tool accepting an engagement or setting materiality.

Understanding your business and assessing risk

Auditors read the board minutes to understand the business and spot risks. The FRC's March 2026 guidance takes this as its first worked example: a tool that summarises the minutes and points to the areas of most potential relevance, citing the passage each point comes from. In the FRC's words, this "does not replace the auditor's risk assessment", but lets the auditor "focus their time on the most relevant areas". In the example, the firm's method still requires the auditor to read the minutes themselves and check that the summary is complete and accurate. On the file, the auditor records that the tool was used and how its output shaped the further work.

Risk assessment also includes analytical procedures (ISA (UK) 315 para 14(b)): comparing this year's figures with last year's and with expectations, so that the team can ask about movements it did not expect. A tool may also help research the company's environment; if its outputs are all checked back to the sources it cites, the FRC says less may need documenting.

Testing journals for fraud risk

Every audit tests journal entries, because management can override controls by posting entries that should not be there (ISA (UK) 240 para 33(a)). The traditional method filters the ledger by rules, for example journals posted at certain times or with certain values. The FRC's June 2025 worked example adds a model that looks at every journal and scores how unusual each one is compared with the rest, along a spectrum rather than pass or fail. In the example the firm runs the two together, because the AI model alone might miss entries that are consistently posted to an unusual account, and the firm's people set the threshold above which an entry counts as high risk.

The tool flags; it does not decide what a flag means. The team follows up the entries selected, considers why each was flagged, and evaluates the evidence and explanations. In the FRC's example, the values of some entries the tool flagged turned out to be correct, and following them up led the team to look at others and find that their descriptions had been recorded wrongly.

The revised standard, ISA (UK) 240 (Revised), adds an explicit requirement to obtain evidence that the population of journals is complete (para 49(b)), for periods beginning on or after 15 December 2026. Whichever edition applies to your year, a scoring tool needs the whole journal file to work on, so that is what the auditor asks for.

Testing balances and transactions

Here the FRC's second worked example applies: a contract review tool used in auditing revenue. The company's contracts are uploaded, and the tool reads each one for risk indicators. Some are plain, such as terms on bonuses, contingent payments or refunds, or a contract longer than a set limit. Others need evaluation, such as whether control transfers over time, which the tool does under prompts the firm has written and tested. The tool then scores each contract, and the contracts above a threshold the firm has set become the sample the auditor tests. The FRC notes that the tool's agency "is bounded within an entirely human-designed workflow", and the auditor records which contracts were selected, why, and the testing done.

Matching tools work the other way round: the sample is already chosen, and the tool matches the supporting documents, such as invoices, to each item. Either way, a person tests the items and evaluates the evidence. Where the evidence is the company's own data, the auditor must also evaluate whether it is reliable, including whether it is accurate and complete (ISA (UK) 500 para 9).

The team still obtains some evidence directly, and AI does not change that. When the auditor asks a bank or a customer to confirm a balance, the auditor keeps control of the request: what is asked, whom, and how the reply comes back (ISA (UK) 505 para 7). Where stock is material, the auditor attends the count unless that is impracticable (ISA (UK) 501 para 4).

Completion and the auditor's report

At the end, tools may check the arithmetic of the accounts, review the work for omissions or inconsistencies, and produce first drafts of working papers. The judgements are people's: whether the uncorrected misstatements are material (ISA (UK) 450 para 11), whether management's use of the going concern basis is appropriate (ISA (UK) 570), which written representations to request from management (ISA (UK) 580), and the opinion itself. Where the auditor is a firm, the report is signed by the senior statutory auditor "in his own name, for and on behalf of the auditor" (Companies Act 2006 s503(3)).

What the engagement team still decides

Across the stages, these stay with the engagement team:

• Accepting the audit and planning it, including materiality and the assessment of risk.
• Applying the firm's criteria for each tool, such as whether the data is good enough, and reviewing its output as closely as the firm's method requires. The firm chooses and approves the tools. In the FRC's contract example, by default no one reviews the output contract by contract: the team checks it against its understanding of the company and stays alert for signs the tool is wrong.
• Professional scepticism, which ISA (UK) 200 requires throughout the audit. The FRC's minutes example warns staff about automation bias and "the tendency of the tool to sound fluent and confident even when it is wrong".
• Evaluating the evidence and concluding. The FRC warns that an auditor may not understand that a tool's output "was intended to inform their judgement rather than being itself a conclusion".
• The opinion and the signature.

Responsibility does not move to the software. The FRC's factsheet says the firm and the engagement partner "retain full responsibility for audit quality", under ISQM (UK) 1 and ISA (UK) 220. When it published the guidance, the FRC added that "the human auditor is always accountable". The firm also has to make sure the technology it uses is appropriate (ISQM (UK) 1 para 32(f)), and the FRC's 2025 guidance sets out principles for documenting the tools that use AI. For who is responsible if a tool gets something wrong, see can AI do an audit. As for whether AI will replace auditors: the law as it stands requires a registered auditor and, where that is a firm, a named signatory.

Innate, which publishes this guide, builds audit software; how the Innate platform uses AI sets out what its tools do and do not do.

What it means for your finance team

If your auditor uses AI, you may be asked for complete data sets rather than extracts, and for documents in bulk rather than one at a time.

Whole ledgers and journal files, not extracts. A tool that scores every journal needs every journal. In the FRC's example, the team first checks that the general ledger data is complete and accurate and holds the fields it needs, including date, time, poster, description, value and account references. You may be asked for a full export, or for access to the accounting system, and for evidence that the file is complete.

Documents in bulk. You may be asked for every set of minutes for the year, or every contract of a type, so that a tool can read them all. In the FRC's contract example, the contracts the tool scores above a threshold the firm has set become the sample the auditor tests.

Questions on what is flagged. An unusual journal or a contract with a refund clause produces a question for whoever posted or negotiated it. Good descriptions on journals and a tidy contract file make those questions quicker to answer.

What does not change. Where the auditor asks your bank or customers to confirm balances, it still controls the requests and the replies; it still attends the stock count where stock is material, unless impracticable; and it still asks management for written representations, the letter of representation. The directors still approve the accounts only if satisfied that they give a true and fair view (Companies Act 2006 s393(1)).

Your data. How the audit firm processes and stores your data should be set out in its engagement letter and terms, so ask before the audit starts where it is processed and on what terms.

If your team uses AI too. The auditor has to understand the systems behind your accounts, including the IT environment (ISA (UK) 315 para 25(a)(iv)), so tell them what you use and how you check its output. The guide on how to use AI in a finance department covers that side, and AI for the month-end close covers the close.

If you need an audit that meets the current standards, ask us: Innate offers statutory audits signed by an ICAEW-registered partner firm, which your company appoints as its auditor, with our platform doing the legwork to save you time and money.

What are the benefits and risks of AI in an audit?

The benefits are the ones the FRC itself points to. A tool can look at the whole population, every journal, or every contract uploaded, and pick out the unusual items. And it moves people's time towards judgement: the minutes tool is meant "to enhance the quality and efficiency" of that work by letting the auditor "focus their time on the most relevant areas".

The FRC names three risks to audit quality:

• Misuse of output. A person misreads what the tool produced. The FRC's example is a tool that checks contracts for leases and summarises the lease terms; an auditor who reads that as a complete summary of the contracts may miss other obligations in them that may need a provision.
• Deficient output. The tool gets it wrong. The FRC says this risk "can not be eliminated as LLMs have inherent limitations", for example a finite capacity that can oversimplify.
• Non-compliant methodology. The firm's method allows approaches using AI tools that fail to meet the auditing standards, which can be hard to judge when the tool's output is unlike traditional evidence.

Nor, when the FRC looked in 2025, was the effect being measured. At the six largest firms, its June 2025 thematic review found "no formal monitoring performed by the firms to quantify the audit quality impact" of their automated tools, a finding about such tools in general, not only AI.

This guide makes no claim that AI makes an audit cheaper or quicker; for what drives fees, see audit fees in the UK. If you are comparing firms, how to choose an auditor covers technology among the other questions.

AI in external audit and internal audit: the difference

The statutory auditor is an external audit firm or individual, independent of the company, which reports to the members (the shareholders) under the Companies Act 2006 (s495(1)) and the ISAs (UK). An internal audit function works for the company, reviewing its risks and controls for management and the board, under its own professional standards (the Institute of Internal Auditors' Global Internal Audit Standards). Both may use similar tools, but much of what is written about AI in internal audit is not about the statutory audit.

So, how do auditors use AI? As a set of tools for reading, sorting and checking, with the engagement team deciding what the results mean, and with you answering their questions as before. For more guides on AI in auditing, see the hub.