Aipedia: Auditors

AI in audit: rules, risks and PI

Aipedia, by the Apex broking team · Last reviewed 2026-10-27

UK auditors can use AI, but the FRC says existing auditing standards still apply and the firm and engagement partner remain fully responsible for audit quality. For audit firms that means AI changes how work is done, not who answers for it when an audit fails.

Part of: AI in Auditors

In short

There is no binding AI-specific rule for UK statutory audit. The FRC published non-binding guidance in June 2025 (documentation of AI tools, with a journal-testing case study) and in March 2026 (generative and agentic AI, with three quality risks and four mitigation categories). Its 2025 thematic review found gaps in how six large firms certify automated tools. ISQM (UK) 1, ISA (UK) 220 and ISA (UK) 230 apply as before. If an AI-assisted audit is negligent, the claim is usually handled under the firm's PI policy in the normal way, subject to its terms and any liability limitation agreement.

How UK audit firms are using AI

Audit firms now use AI across much of the audit cycle. The FRC lists the uses it sees in practice: document matching, arithmetic checks, summaries of board minutes, chatbots that answer audit teams' questions, translation, contract classification, and agentic tools that automate some procedures. Some larger firms have built machine-learning tools that flag unusual journals or score risk; smaller firms may be more likely to buy analytics or generative AI features inside third-party audit software.

The FRC uses a broad definition of AI that covers machine learning, deep learning and generative AI. The point for practitioners is that the same standards apply whichever technique sits behind a tool. A tool that reads 10,000 invoices does not change what counts as sufficient appropriate audit evidence. It changes how easy it is to believe you have it.

The rules that apply

The FRC is the UK competent authority for audit and sets the ISAs (UK), ISQM (UK) 1 and the Ethical Standard. Recognised Supervisory Bodies such as ICAEW register and monitor audit firms. Neither has issued a binding AI rule. What exists is guidance:

Document	Date	Status
FRC: AI in audit, illustrative example and documentation guidance	26 June 2025	Non-binding
FRC thematic review: certification of Automated Tools and Techniques	June 2025	Findings from review of six firms
FRC: Generative and Agentic AI Guidance and factsheet	30 March 2026	Guidance that codifies good practice
ICAEW: Artificial intelligence in audit work	Current	Regulatory guidance page

Underneath sit the binding standards. ISQM (UK) 1 paragraphs 32(f) and (g) cover technological resources, and the FRC treats certification of AI tools as part of ISQM (UK) 1. ISA (UK) 220 makes the engagement partner responsible for quality. ISA (UK) 230 paragraph 8 governs documentation. The ethics Code, as revised by IESBA for technology and enforced by ICAEW from 1 July 2025, adds R320.11 (decide whether using technology output is appropriate for the intended purpose) and R606 (limits on providing IT systems to audit clients). The detail is in our FRC AI guidance explainer.

The main risks for audit firms

The FRC's March 2026 guidance groups the risks to audit quality into three types, which map neatly onto how claims arise:

Deficient output: hallucinations, omissions, distortions and faulty reasoning, for example a minutes summary that leaves out a related-party transaction.
Misuse of output: misreading what a tool produced, or relying on it for a task it was not built for.
Non-compliant methodology: an approach that fails to meet auditing standards, however good the tool.

Two further risks sit outside that list. Confidentiality: the FRC notes the cyber risk when audited entity data is put into cloud-based AI applications, but treats it as out of scope, so firms must manage it under the Code. Independence: building or supplying AI systems for an audit client can create a self-review threat, which R606.6 prohibits for public interest entity clients.

The common thread is automation bias. A tool that is right most of the time trains people to stop checking, and the failure that matters is the one nobody looked at.

Where PI insurance fits

ICAEW-registered audit firms must hold PI under the ICAEW PII Regulations: a minimum limit of £2m, or 2.5 times fee income with a £250,000 floor where fee income is below £800,000, and an excess no higher than the greater of £3,000 or 3% of fee income. ACCA audit firms follow the ACCA rules. None of these rules mentions AI, and the FRC guidance does not address insurance.

In practice an audit negligence claim is usually a civil liability claim whether the error came from a person, a spreadsheet or a model, and a PI policy usually responds subject to its terms. Three things shape the outcome more than the AI itself: who is owed a duty (see Caparo for auditors and scope of duty in auditor claims), whether a section 534 liability limitation agreement is in place, and how the policy's aggregation clause treats one tool fault repeated across many audits. See audit firm PI cover explained for the wider picture.

Practical controls for an audit firm

Keep a central record for each AI tool: function, appropriate use, development or vendor evidence, training and explainability, as the FRC 2025 guidance sets out.
Certify tools before use, set recertification triggers and decommission old versions.
On each file, record the tool and model version, why use was appropriate, input completeness and accuracy checks, and how output informed judgements.
Build human review points into every workflow, and train staff on automation bias.
Keep client data out of tools that the firm has not approved.
Check R606 before offering any AI or IT system to an audit client.

How Apex helps

Apex arranges PI insurance for audit firms and accountants who carry out audit work. A broker reviews your limits against the ICAEW requirements, checks how your policy treats AI-assisted audit work and helps you present your AI controls at renewal. For non-audit work, see AI in accountancy.

Aipedia guides for auditors

FRC guidance on AI in audit explained: what the June 2025 and March 2026 FRC documents ask firms to do, and why they still matter although they are not standards.
Machine learning journal entry testing: the FRC's own worked example, threshold calibration and claims where fraud was missed.
Full-population data analytics in audit: testing every transaction, data completeness and whether the output is sufficient evidence.
AI contract review for revenue testing: LLM scoring of customer contracts to select higher-risk items, and linking that to substantive work.
Summarising board minutes with generative AI: why a summary is not the minutes, and the signals it can drop.
AI in audit risk assessment and planning: model-scored inherent risk, automation bias and the engagement partner.
AI in going concern assessments: forecasting and stress tests used to challenge management, and claims after a collapse.
AI document matching and vouching: OCR and matching tools, input checks and wrongly accepted evidence.
Agentic AI performing audit procedures: bounded autonomy, human control points and errors that repeat across files.
Audit methodology chatbots for audit teams: internal question-answering tools and firm-wide quality risk.
AI translation of overseas audit evidence: machine translation in group audits and terms that change the accounting.
Auditing clients that use AI in reporting: model-driven estimates at the client, IT controls and R606 independence limits.
AI-drafted audit management letters: generic control findings and what directors rely on.
Certifying AI audit tools under ISQM (UK) 1: what the thematic review found and what smaller firms should document.
AI audit errors, liability caps and PI: firm, partner or vendor, section 534 agreements and renewal questions.

Sources

Frequently asked

Can UK auditors use AI on statutory audits?

Yes. Nothing in the ISAs (UK) or ISQM (UK) 1 prohibits AI. The FRC has published guidance on using it and says firms are still assessed against the existing standards. The firm and engagement partner keep full responsibility for audit quality, so tools must be certified, documented and reviewed.

Is the FRC AI guidance binding?

No. The June 2025 guidance says it does not represent a static set of FRC expectations, and the March 2026 guidance codifies good practice. Both are likely to inform how Audit Quality Review looks at AI on inspection, because the underlying ISQM (UK) 1 and ISA (UK) requirements are binding.

Does audit firm PI cover mistakes made by AI tools?

Usually the policy responds to a negligence claim regardless of whether a person or a tool caused the error, subject to its wording, exclusions and excess. The ICAEW PII Regulations contain nothing AI-specific. Check with your broker how your insurer treats AI use and what it expects to see at renewal.

Has the FRC sanctioned an auditor for misusing AI?

No FRC enforcement decision or Audit Quality Review finding turning on AI misuse had been published as at October 2026. The 2025 thematic review found weaknesses in how firms certify automated tools, not misconduct.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.