FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Aipedia: Auditors
The FRC expects audit firms to document AI tools centrally and on file, certify them under ISQM (UK) 1, and keep a human reviewing output. Neither guidance document is a standard, but both describe what inspectors are likely to look for.
Part of: AI in Auditors
In short
The FRC has published two AI guidance documents for auditors. The June 2025 guidance uses a fictional journal-testing tool to show the judgements involved and sets out what to record centrally and on the audit file. The March 2026 guidance on generative and agentic AI names three risks to audit quality (deficient output, misuse of output, non-compliant methodology) and four mitigation categories, including human-in-the-loop review. Both are non-binding. Firms are still assessed against ISQM (UK) 1 and the ISAs (UK), and the firm and engagement partner remain accountable.
| Publication | Date | Status | Main content |
|---|---|---|---|
| AI in audit: illustrative example and documentation guidance | 26 June 2025 | Non-binding | Journal-testing case study; central and audit file documentation |
| Thematic review: certification of ATTs | June 2025 | Review findings | Weaknesses in how six firms certify automated tools |
| Generative and Agentic AI Guidance and factsheet | 30 March 2026 | Guidance codifying good practice | Three risks, four mitigation categories, two worked examples |
The FRC called the 2025 document its first guidance on AI in audit, and describes the 2026 guidance as the first from any audit regulator globally. The 2026 guidance was not issued in response to quality deficiencies and is aimed at firms' central technical teams. All three are collected on the FRC's AI in audit library page.
Part 1 follows a fictional firm building an in-house tool that flags unusual journals within its fraud procedures. It walks through the judgements a firm faces: which model to use, how to combine AI with rules-based routines, how to calibrate thresholds, and how to check the quality of the data going in. The aim is to show reasoning, not to approve a method. Our page on machine learning journal entry testing looks at this use in detail.
Part 2 splits documentation into two levels.
The tool's function and appropriate use; how it was developed, including data sources, legal basis, model choice and bias mitigation; why the firm is confident it works; training for users; explainability; and alignment with the government's five AI principles.
A description of the tool and its purpose, the tool and model version, why using it was appropriate (including checks on the completeness and accuracy of input data), confirmation of central approval, and how its outputs informed the auditor's judgements.
The FRC defines explainability as "a measure of the extent to which the behaviour or decisions of a tool can be understood", and says the level needed depends on the use. For third-party tools, firms should still obtain evidence on how the tool meets auditing and ethics requirements, lawful use of training data, versioning and updates; assurance reports can help fill gaps. The standards cited are ISQM (UK) 1 paragraphs 32(f) and (g) and 57(c), and ISA (UK) 230 paragraph 8.
The review of BDO, Deloitte, EY, Forvis Mazars, KPMG and PwC found certification processes not always backed by documented policies, informal recertification triggers, patchy decommissioning, monitoring limited to usage and licensing, unclear accountability for globally deployed tools, and only two firms documenting tool limitations. Firms accepted that existing certification may not address AI risks. See certifying AI audit tools under ISQM (UK) 1.
The 2026 guidance names three risks: deficient output (hallucinations, omissions, distortions, faulty reasoning), misuse of output (misreading it, or using a tool for a task it was not built for) and non-compliant methodology. It then sets four mitigation categories that together give appropriate confidence in output quality:
How much of each is needed is a matter of professional judgement. A lightly tested tool needs heavier human review; a well-certified tool still needs some. The worked examples are board minute summaries and LLM contract review for revenue testing, and the guidance also covers agentic tools. Auditors should document on file that a GenAI-enabled tool was used. Cybersecurity and data risks are out of scope.
Neither document is a standard. The 2025 guidance says it "does not represent a static set of FRC expectations". But both rest on binding requirements, so a firm that ignores them may struggle to show compliance with ISQM (UK) 1 and ISA (UK) 220 on inspection. The 2026 factsheet is explicit that the firm and engagement partner "retain full responsibility for audit quality", and the FRC said at launch that it is people, the firms and Responsible Individuals, who are accountable.
Alongside the FRC, ICAEW's audit regulation page on AI says clear policies, training and oversight are essential, and the IESBA technology revisions add R320.11 on relying on technology output and R606 on IT services to audit clients.
The FRC guidance does not address insurance, and no regulator has made a statement on AI and auditors' PI. Its practical effect is evidential. If an AI-assisted audit is challenged, the central record and file documentation the FRC describes are what show the auditor acted with reasonable skill and care, and they help an insurer defend the claim. Gaps in that record make a claim harder to defend. See audit firm PI cover explained and what to document about AI use.
Apex arranges PI for audit firms and can walk through how your cover and your AI documentation fit together. Start from the AI in audit hub.
No. The guidance is about using AI well where firms choose to. It does not encourage or require adoption. Firms that use AI tools must still meet ISQM (UK) 1 and the ISAs (UK), and the guidance shows how documentation and oversight can support that.
The FRC 2025 guidance suggests a description of the tool and its purpose, the tool and model version, why use was appropriate including checks on input data completeness and accuracy, central approval, and how outputs informed judgements. The 2026 guidance adds recording that a GenAI-enabled tool was used.
It is written for any firm using AI, though the 2026 guidance is aimed at central technical teams and the thematic review covered six large firms. Smaller firms buying third-party tools should still gather evidence on how the tool works and meets auditing and ethics requirements.
Not in detail. The 2026 guidance notes the cyber risk when audited entity data is put into cloud-based AI applications but treats cybersecurity and data risks as out of scope. Firms must manage confidentiality under the ethics Code and data protection law.
Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.
Start a PI quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.
