FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Auditors
Generative AI can draft management letters and audit committee reports from working papers, but every finding must reflect what the audit actually found. Directors act on what auditors report, and on what they leave out.
Part of: AI in Auditors
In short
Management letters and reports to audit committees tell directors about control weaknesses and other matters found during the audit. Generative AI can turn working paper notes into polished drafts quickly. The risks are generic findings that do not match the client, invented or overstated points, and real issues lost in the drafting. Under the FRC's 2026 guidance these are deficient output and misuse risks, and the engagement partner remains responsible. If directors later say they were not warned about a weakness that led to a loss, the letter will be central evidence.
At the end of an audit, the team writes up control weaknesses and recommendations for management and those charged with governance. It is time-consuming, and often done under deadline pressure. Generative AI tools can draft the letter from the team's notes, standardise the wording, suggest recommendations and produce a summary for the audit committee.
The output reads well. That is the risk. A model trained on many management letters is good at producing plausible, general control points (segregation of duties, password policies, month-end reviews) whether or not they fit this client, and it may smooth over the specific, awkward finding that matters most.
The FRC's March 2026 guidance applies: deficient output covers hallucinations, omissions and distortions, and misuse covers relying on a tool for a task it was not built for. The human-in-the-loop category, with professional scepticism and awareness of automation bias, is the main safeguard. The factsheet says the firm and engagement partner retain full responsibility for audit quality under ISQM (UK) 1 and ISA (UK) 220.
Under the ethics Code, R320.11 requires a decision that using the output is appropriate for the intended purpose, and confidentiality applies to the working papers fed into the tool. ISA (UK) 230 paragraph 8 means the file should show how the report was prepared and reviewed.
Illustrative scenario: a team notes that a client's purchase ledger clerk can both set up new suppliers and approve payments. The AI-drafted letter folds this into a general recommendation on 'reviewing access rights', ranked low priority alongside routine points. The finance director skims it and takes no action. A year later the clerk is found to have paid a fictitious supplier. The company argues the auditor did not clearly report a serious weakness.
The opposite also happens: a draft includes a finding that was never tested, or describes a control as operating when the team only looked at its design. Directors may rely on an overstated positive message as much as on an understated warning.
Audit committee reports carry the same risk at a higher level. A summary that describes the audit as having found 'no significant issues' when the team flagged a judgement area for discussion can shape how the committee scrutinises the accounts.
Claims about what was or was not reported usually arise alongside a wider audit negligence claim, often after a fraud or a control failure. They would usually be handled under the firm's PI policy subject to its terms. Whether the auditor is liable for the loss depends on whether the duty extended to reporting that weakness in that way, and on causation, including whether the directors would have acted on a clearer warning. See scope of duty in auditor claims, contributory negligence and audit firm PI cover.
Related: board minute summaries, methodology chatbots and the FRC guidance explainer.
Apex arranges PI for audit firms and can help you understand how claims about reporting failures are usually handled under your cover. See the AI in audit hub.
Yes, as a drafting aid. Every finding must be checked against the working papers, and the team should set the priority of each point. The engagement partner remains responsible for what is reported to management and those charged with governance.
That real findings are diluted into generic recommendations, or that untested points are included. Directors rely on the letter both for what it says and for what it leaves out, so inaccuracy in either direction can feature in a later claim.
There is no specific FRC requirement to tell clients. What matters is that the content is accurate and reviewed. Some firms address AI use in engagement terms; the CCAB has consulted on an ethical AI statement that may say more when finalised.
Usually such claims are part of an audit negligence claim and would be handled under the firm's PI policy subject to its terms. Liability depends on duty, causation and what the directors would have done with clearer information.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
