FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Auditors
AI analytics let auditors test every transaction in a population instead of a sample, but the result is only as good as the data extract behind it. Testing 100% of an incomplete file gives confidence that is not earned, and that is where claims start.
Part of: AI in Auditors
In short
Full-population testing uses analytics, often with machine learning, to run tests over every record in a ledger or sub-ledger. It can be stronger evidence than sampling, but only if the extract is complete and accurate and the test actually addresses the assertion. The FRC expects input completeness and accuracy checks to be recorded on file, and ISQM (UK) 1 requires the tool itself to be certified. If an analytics result gives false comfort, a negligence claim will usually focus on the data checks, and scope of duty principles may limit the loss the auditor must cover.
Instead of picking 40 sales invoices, an audit team can load the full sales ledger into an analytics tool and match every invoice to dispatch records and cash receipts. AI features cluster unusual items, spot duplicates, and flag transactions that break the expected three-way match. The output is usually a set of exceptions for the team to follow up, with the rest of the population treated as tested.
That last step is the risk. 'Tested' depends on the data received, the logic applied and how exceptions are resolved. An analytics run that reports few exceptions can mean the population is clean, or that the extract was missing a branch, a period or a category of transaction.
The FRC's June 2025 guidance asks firms to record on the audit file why use of a tool was appropriate, including checks on input data completeness and accuracy, and how outputs informed judgements (ISA (UK) 230 paragraph 8). Centrally, the firm should record what the tool is for and why it is confident it works, under ISQM (UK) 1 paragraphs 32(f) and (g).
The March 2026 guidance adds that misuse of output, including relying on a tool for a task it was not built for, is a distinct risk to audit quality. An analytics tool designed to find duplicates does not test valuation. The ethics Code adds R320.11: decide whether using the output is appropriate for the intended purpose.
Illustrative scenario: an audit team runs a full-population revenue test and reports a small number of exceptions, all cleared. The client's data was extracted by its own finance team from the main system. A second invoicing system used by one division was not included, and nobody reconciled the extract to the general ledger. That division had recognised revenue early on several contracts. After a profit warning, the company's new board alleges the audit should have picked this up.
Other failure points: exceptions closed in bulk with the same explanation, tests run on the wrong period, and file wording that says '100% of transactions tested' when only one assertion was addressed.
An audit firm's PI policy would usually respond to a claim that analytics work was negligent, subject to its terms. Audit PI wordings may not single out analytics, but wordings vary and it is worth checking yours. The defence often turns on whether the extract checks were reasonable, which the file must show.
The amount at stake depends on the scope of the auditor's duty. Courts ask what risk the duty was meant to guard against, and losses outside that may not be recoverable; see scope of duty in auditor PI claims and Caparo for auditors. Where one faulty data routine was used on many audits, aggregation can affect how limits and excesses apply.
Related: journal entry testing and AI document matching and vouching.
Apex arranges PI for audit firms. A broker can check your limit and aggregation terms against the way your firm runs analytics across its client base. See the AI in audit hub.
Not automatically. It can give stronger evidence, but only if the data is complete and accurate and the test addresses the right assertion. An incomplete extract can give more false comfort than a well-designed sample, because the coverage looks total.
The audit team. The FRC expects the file to record checks on input completeness and accuracy. Relying on the client to confirm completeness without independent reconciliation is unlikely to be enough where the output is used as key evidence.
Sometimes, but the file should say exactly which. A three-way match across a ledger may give good evidence of occurrence while saying little about cut-off or valuation. Stating the assertions covered avoids misusing the output for purposes the test was not designed to address.
It can. The recoverable loss depends on what the audit was meant to protect against, not on every loss that followed the audit. This is a legal question decided on the facts, and it applies whether or not AI was used.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
