FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Auditors
Audit firms should certify AI tools before use, recertify them when they change, monitor their effect on quality and decommission them properly. The FRC's 2025 thematic review found gaps in all of these at six large firms.
Part of: AI in Auditors
In short
The FRC treats certification of automated tools, including AI, as part of ISQM (UK) 1. Its 2025 thematic review of BDO, Deloitte, EY, Forvis Mazars, KPMG and PwC found certification not always backed by documented policies, informal recertification triggers, patchy decommissioning, monitoring limited to usage and licensing, unclear accountability for global tools, and only two firms documenting tool limitations. Firms accepted existing processes may not address AI risks. Smaller firms buying third-party AI tools are not exempt: the FRC expects evidence on how the tool works, lawful training data, versioning and updates.
Certification is the firm's decision that a tool is fit for use on audits, made before teams rely on it. ISQM (UK) 1 paragraphs 32(f) and (g) require appropriate technological resources, and the FRC also cites paragraph 57(c). The FRC's March 2026 guidance makes certification against ISQM (UK) 1 one of the four mitigation categories that give appropriate confidence in AI output.
For AI tools, certification is harder than for a fixed calculation routine. Outputs can vary, models can be updated by a vendor, and the same tool can be appropriate for one task and misleading for another.
That is why it makes sense to link certification to the specific uses a tool is approved for. A generative AI tool certified for summarising documents is not automatically certified for classifying contracts, even if staff can technically use it that way. Recording approved and unapproved uses is the simplest guard against the misuse risk in the 2026 guidance.
The FRC's thematic review on certification of Automated Tools and Techniques (June 2025) looked at six large firms. It found:
| Area | Finding |
|---|---|
| Policies | Certification processes were sometimes not backed by documented policies. |
| Recertification | Triggers for recertifying a changed tool were informal. |
| Decommissioning | Policies for retiring tools were patchy. |
| Monitoring | Limited to usage and licensing, with no formal measurement of impact on audit quality. |
| Accountability | Unclear for globally deployed tools. |
| Limitations | Only two firms documented tool limitations. |
On AI specifically, firms were deploying machine learning tools, and generative AI use was mostly in productivity tools. Firms accepted that existing certification may not address AI risks, and the FRC urged them to make changes as soon as possible. These were findings about processes, not misconduct.
Many smaller firms are likely to buy AI features within audit software rather than build their own. The FRC's June 2025 guidance says that firms using third-party tools should still obtain evidence on how the tool meets auditing and ethics requirements, lawful use of training data, versioning and updates, and that assurance reports can help fill gaps. A practical central record covers:
Weak certification does not itself cause a claim, but it shapes how defensible an AI-assisted audit is when a claim arrives. If a firm cannot show why it was confident a tool worked, or which version ran on the file, the defence is harder. Where one uncertified or out-of-date tool affected many audits, several claims may follow, raising aggregation questions. Insurers may ask at renewal how AI tools are governed. See what to document about AI use for PI and audit firm PI cover.
Related: FRC guidance explained, agentic AI, methodology chatbots and document vouching tools.
Apex arranges PI for audit firms and can help you present your tool governance to insurers at renewal. See the AI in audit hub.
ISQM (UK) 1 requires appropriate technological resources, and the FRC treats certification of AI and other automated tools as part of meeting it. The FRC 2026 guidance lists certification against ISQM (UK) 1 as one of four mitigation categories.
No. It found weaknesses in how firms certify, recertify, monitor and decommission automated tools. It was a review of processes at six large firms, not an enforcement action.
They need to be satisfied the tool is appropriate before relying on it. The FRC says firms using third-party tools should still obtain evidence on how they meet auditing and ethics requirements, training data, versioning and updates, and assurance reports can help.
Firms should set this in writing. Possible triggers include a model change, a major software update, use on a new type of task, or evidence from monitoring that output quality has changed. The thematic review criticised informal triggers.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
