FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Auditors
AI tools can score inherent risk and suggest audit responses, but the engagement partner remains responsible for the risk assessment under ISA (UK) 220. If a model rates a real risk as low and the team accepts it, the whole audit plan can miss its target.
Part of: AI in Auditors
In short
Risk assessment decides where audit effort goes, so an error here spreads through the rest of the file. AI planning tools draw on prior-year data, industry information and the client's figures to rate risks and propose procedures. The FRC's March 2026 guidance identifies automation bias as a key concern and makes human-in-the-loop review one of its four mitigation categories. The firm and engagement partner retain full responsibility for audit quality. A claim that the audit under-tested an area will usually focus on why the team accepted a low rating, and the file needs to answer that.
Audit planning tools increasingly include AI features. They read the trial balance and prior-year file, compare the client with sector data, and produce a draft risk assessment with suggested responses for each area. Some generate a planning memo. For a busy team, a pre-populated plan is a strong default: it looks complete, it is consistent with the firm's methodology, and changing it takes effort.
That is the problem the FRC calls automation bias. When a tool is right most of the time, people tend to accept its output without the challenge they would give a junior colleague's draft. In planning, the cost of that habit is high because every later procedure is sized from the risk ratings.
Illustrative scenario: a planning tool rates inventory valuation as low risk for a manufacturing client, based on several clean prior years. During the year the client changed its costing system and moved a product line to a new site, facts discussed with management but not fed into the tool. The team accepts the rating and performs limited inventory work. Overvalued stock is later written down, the bank calls in its facility, and the company's administrators look at the audit.
The model did what it was designed to do with the data it had. The failure was treating its rating as the risk assessment instead of an input to it. Other patterns: suggested procedures copied without tailoring, and fraud risk factors that the tool cannot see because they come from conversations rather than data.
Claims alleging inadequate risk assessment are usually framed as audit negligence and would generally fall within an audit firm's PI cover, subject to its terms, limit and excess. The defence will look at whether a reasonably competent auditor, knowing what the team knew, would have rated the risk higher. A file that records the team challenging the tool is much easier to defend than one that simply adopts it. Liability may also be limited by scope of duty and any liability limitation agreement. See audit firm PI cover explained.
Related: board minute summaries for risk assessment inputs, methodology chatbots, and the FRC guidance explainer.
Apex arranges PI for audit firms. A broker can discuss with you how insurers view AI planning tools and what evidence of review helps at renewal. See the AI in audit hub.
It can produce a draft, but the risk assessment remains the auditor's judgement. The FRC says the firm and engagement partner retain full responsibility for audit quality, and expects human review that applies professional scepticism to the tool's output.
It is the tendency to accept a tool's output without enough challenge because the tool is usually right. The FRC 2026 guidance names it as something reviewers must understand. In planning it can lead teams to under-audit an area the model rated low.
Yes. Recording where ratings were changed, and why accepted ratings were considered appropriate, shows how the output informed judgements as the FRC 2025 documentation guidance suggests. It is also strong evidence if the audit is later challenged.
Not usually by itself. Audit negligence claims are generally covered subject to the policy terms whatever tools were used. Insurers may ask about AI use and controls at renewal, so be ready to explain your certification and review processes.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
