FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Auditors
When a client uses AI to produce estimates, provisions or revenue figures, the auditor must understand and test the controls over those models just as for any other system. Audit firms must also avoid building or supplying such systems where R606 of the Code prohibits it.
Part of: AI in Auditors
In short
Some audit clients use AI in financial reporting: models that set expected credit loss provisions, forecast inventory obsolescence, price complex items or automate revenue recognition. The auditor has to gain enough understanding of how these models work, how they are governed and what data they use to decide how much to rely on them. On the other side, the ethics Code restricts audit firms from providing IT systems services to audit clients: R606.6 prohibits them for public interest entity clients where a self-review threat arises. If a model-driven number is wrong and the audit did not catch it, the claim will test the auditor's work on the model.
Clients use machine learning to predict customer default rates, estimate returns provisions, flag slow-moving stock and match cash receipts. Some use generative AI to draft narrative reporting. In each case a figure or disclosure in the accounts depends on a model that management may only partly understand, often supplied by a vendor.
For the auditor, the questions are familiar but harder to answer: what data goes in, what logic produces the output, who checks it, and what happens when the model changes. A model that learns from new data can behave differently from one year to the next even if nobody changed it deliberately.
No auditing standard is specific to clients' AI. The auditor's existing obligations to understand the entity's IT environment and controls, test estimates and maintain professional scepticism apply in full. The engagement partner is responsible under ISA (UK) 220, and the file must show the work done under ISA (UK) 230 paragraph 8.
Independence is the AI-specific point. The IESBA technology revisions, adopted in the ICAEW Code from 1 July 2025, revised the rules on IT systems services to audit clients. R606.3 and R606.6 deal with these services, and R606.6 prohibits such services for public interest entity clients where a self-review threat arises. A firm that helps an audit client design or implement an AI reporting model may then be auditing its own work. See the IRBA pronouncement of the revisions for the text.
Where a client automates significant decisions about individuals, the UK GDPR rules on automated decision-making in Articles 22A to 22D, inserted by section 80 of the Data (Use and Access) Act 2025 and in force from 5 February 2026, may be relevant to the client's compliance.
Illustrative scenario: a lender client uses a vendor machine learning model to set its loan loss provision. The audit team tests that the model was run, reconciles inputs and reviews management's overlay, but does not examine how the model was validated. The model had been retrained on a benign period and understated losses on a newer product. After defaults rise, the provision proves materially short, and the company's new board pursues the auditor alongside its own claims against the vendor.
Common weak points are similar across clients: model changes made without a record, validation done by the people who built the model, overlays applied without support, and auditors testing the arithmetic of a model run while leaving its design untested.
A claim that the auditor failed to detect a misstated estimate would usually be handled as audit negligence under the firm's PI policy, subject to its terms. The auditor's duty is generally owed to the company, following Caparo, and the company's own responsibility for its model may be raised as contributory fault; see contributory negligence in PI claims. If the firm also provided advice or systems work on the model, the claim may straddle audit and non-audit services, which affects how the policy and any liability limitation agreement apply. See audit firm PI cover.
Related: AI in going concern and AI audit errors and PI.
Apex arranges PI for audit firms, including firms that also provide advisory work. A broker can check how your policy treats claims that involve both audit and non-audit services. See the AI in audit hub.
Enough to assess the risk of misstatement and decide what testing is needed. For significant estimates, that usually means understanding the data, the logic, validation and change controls, and may require specialist support.
Only within the independence rules. R606 of the Code restricts IT systems services to audit clients, and R606.6 prohibits them for public interest entity clients where a self-review threat arises. Check the Ethical Standard and Code before agreeing to any such work.
The directors are responsible for the accounts. The auditor may face a claim if a competent audit would have detected the error. The client may also have claims against its model vendor. How liability is shared depends on the facts.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
