Aipedia: Auditors

Agentic AI performing audit procedures

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

Agentic AI tools can carry out several audit steps in sequence with limited human input, and the FRC expects firms to build in human control points and oversight. Because one agent may run on many audits, a single fault can repeat across a whole portfolio.

Part of: AI in Auditors

In short

Agentic AI goes beyond producing a draft: it plans and carries out a series of actions, such as requesting data, running tests, documenting results and proposing conclusions. The FRC's March 2026 guidance covers agentic tools that automate some procedures, and applies the same four mitigation categories, with human-in-the-loop review central. The firm and engagement partner remain fully responsible. The particular insurance question is aggregation: if one flawed agent configuration affects many engagements, whether the resulting claims are treated as one or many under the policy can change how much cover is available.

What agentic AI does in audit

A generative AI tool answers a prompt. An agentic tool is given a goal and works through steps to reach it. In audit, that might mean pulling a bank confirmation response, reconciling it to the ledger, flagging differences, drafting a working paper and marking the procedure ready for review. Some tools chain several procedures together.

The FRC's Generative and Agentic AI Guidance (30 March 2026) notes agentic tools that automate some procedures among the uses it sees, and its launch announcement presented the guidance as support for firms adopting emerging AI. The more steps an agent takes before a person looks, the more an early error can flow through.

What the FRC expects

The FRC's three risks (deficient output, misuse of output and non-compliant methodology) and four mitigation categories apply. For agents, the practical emphasis falls on:

System design and development: defining what the agent may and may not do, and where it must stop for a person.
Certification against ISQM (UK) 1: testing the whole workflow, not just individual steps, and recertifying when it changes.
Staff education and governance: reviewers who understand what the agent did, not just what it concluded.
Human-in-the-loop review and oversight: control points where professional scepticism is applied, with awareness of automation bias.

How much of each is needed is a matter of professional judgement. The firm and engagement partner retain full responsibility for audit quality under ISQM (UK) 1 and ISA (UK) 220.

What can go wrong

Illustrative scenario: a firm deploys an agent to perform cash procedures on its smaller audits. A configuration change means the agent treats reconciling items under a tolerance as cleared without listing them. Across one busy season it runs on many files. Reviewers see 'no exceptions' and sign off. On one client a long-running misappropriation sat in those small reconciling items. Once found, the firm has to consider every other file the agent touched.

Cascading errors are the defining risk: a fault in one step feeds every later step, and a fault in the agent's design repeats on every engagement it runs.

How PI usually responds, and aggregation

Each resulting claim would usually be dealt with under the firm's PI policy as an audit negligence claim, subject to the terms. The harder question is how claims arising from one underlying fault are counted. Many policies contain an aggregation or series clause that can treat related claims as one. That can help, by applying one excess, or hurt, by applying one limit to all of them. The outcome depends heavily on the exact wording; see how aggregation affects limit and excess. For ICAEW firms, the PII Regulations set the minimum cover, but the firm's own exposure may justify more. See audit firm PI cover.

Practical controls

Map every step the agent takes and decide where a person must approve before it continues.
Log the agent's actions on each file so a reviewer can see what it did.
Recertify after any configuration or model change, and record the version on each file.
Monitor outcomes across engagements, not just usage, so systemic faults surface early.
Have a plan to identify every affected file if a fault is found.

How Apex helps

Apex arranges PI for audit firms and can review your policy's aggregation wording and limit against the way your firm deploys AI agents across its audits. See the AI in audit hub.

Sources

Frequently asked

Does the FRC allow agentic AI on audits?

The FRC's 2026 guidance covers agentic tools that automate some procedures and does not prohibit them. It expects the four mitigation categories, including human oversight, to give appropriate confidence in output, with the firm and engagement partner retaining full responsibility.

What is a human control point?

A step in an automated workflow where the tool must stop and a person reviews and approves what it has done before it continues. Placing them where errors would be costly or hard to spot later is a key design judgement.

Should the audit file record what an agent did?

Yes. ISA (UK) 230 paragraph 8 requires documentation that lets an experienced auditor understand the work performed. For an agent, that means a record of the steps taken, the version used, the control points passed and who approved the output at each one.

Why does aggregation matter for agentic AI?

Because one flawed agent can cause errors on many audits. Whether the policy treats the resulting claims as one claim or several affects how the limit and excess apply. The answer depends on the wording, so it is worth reviewing before an incident.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.