FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Professional indemnity explained
MindBridge is an AI analytics platform that, according to its maker, scores every journal and transaction in a ledger to flag unusual or high-risk items for auditors. It matters because those scores shape what gets tested, and the audit firm answers for that choice.
Part of: Audit firm PI cover
In short
MindBridge says it analyses 100% of a client's transactions and scores each for risk using statistical, machine-learning and rules-based methods. KPMG UK, Buzzacott and BDO UK have each announced using it. The score is an input to the auditor's judgement, not a substitute: ISA (UK) 240 still requires the auditor to test journal entries, and the FRC says the human auditor is always accountable. If a fraud is later missed, the claim will turn on thresholds, follow-up and documentation, and audit firm PI usually responds subject to the policy terms.
In plain terms, MindBridge reads a client's whole general ledger rather than a sample, runs several kinds of test over every entry, and gives each journal or transaction a risk score. The audit team then decides which high-scoring items to examine. Everything below is the vendor's or an announcing firm's own description.
So the output is a ranking, not a conclusion. A high score tells the auditor where to look; a low score is the tool's view that an entry looks routine, which is exactly the judgement a claimant will later test.
| Point | What MindBridge says | What to ask |
|---|---|---|
| Assurance reports | Completed SOC 1 Type 2, SOC 2 Type 2 and SOC 3 Type 2 audits (security page) | Request the current SOC 2 report and read the exceptions and complementary user controls |
| ISO certification | ISO/IEC 27001:2022, 27017:2015 and 27018:2019, certified by A-LIGN | Check the certificate scope covers the service you use |
| Hosting and data region | Not stated on the security page | Where client ledgers are stored and processed, and any transfers outside the UK |
| AI training on customer data | Not stated on the security page | Whether client data is used to train or improve models, and on what contractual terms |
A ledger extract is among the most sensitive data an auditor holds. Your client's own data protection position, and your confidentiality duties, mean these answers belong in your file before you upload anything.
These are the firms' own public announcements, given as dated facts. Naming them is not a comment on their audits or a recommendation of the product.
None of the KPMG or Buzzacott releases sets out an explicit rule that the auditor must review the output. That duty comes from auditing standards and the FRC, not from the vendor.
ISA (UK) 240 paragraph 33(a) requires the auditor to "test the appropriateness of manual or automated journal entries recorded in the general ledger and other adjustments" made in preparing the financial statements, including entries at the period end (FRC ISA (UK) 240). A risk-scoring tool can help select those entries, but the selection remains the auditor's. The file should show:
The FRC's March 2026 guidance warns reviewers to stay alert to automation bias, the habit of trusting a machine's answer because it came from a machine. The standard is also changing: the FRC published a revised ISA (UK) 240 on 30 April 2026 with enhanced risk assessment procedures, effective for audits of periods beginning on or after 15 December 2026. Firms should check their MindBridge workflow against the revised wording. More detail: AI journal entry testing, full population testing and certifying AI tools under ISQM (UK) 1.
Illustrative example 1. Over three years, a finance director at a distribution company posts small manual journals moving costs into stock. Each entry is below the materiality the team set, and the analytics score them as low risk because they resemble recurring accruals. After the company enters administration, the administrators claim the lost profits and trading losses from the auditor. Their expert argues that the pattern was visible in the full-population output and that the team never looked below the top-scoring items.
ISA (UK) 240 itself recognises that, owing to the inherent limitations of an audit, "there is an unavoidable risk that some material misstatements of the financial statements may not be detected, even though the audit is properly planned and performed". The firm's defence will usually rest on showing its thresholds and follow-up were reasonable and documented. Audit firm PI usually responds to the claim and defence costs, subject to the policy terms. Three years of audits raise aggregation questions, and the policy that responds is usually the one in force when the claim is first made.
Illustrative example 2. A team receives thousands of flagged entries and clears them in bulk with a standard note. No loss follows, but a regulatory inspection criticises the work. PI usually responds to civil claims; whether it pays for regulatory investigation costs depends on the wording, and fines are commonly not covered.
For the other audit tools and the FRC position, see the AI audit tools hub and AI errors, liability and PI.
Apex arranges audit firm PI cover; a broker reads every enquiry.
It changes how items are selected, but it does not replace the auditor's judgement. MindBridge says it analyses the whole population and scores each transaction; the team still decides which items to test, how far to go below the high scores, and how to document why the selection was sufficient.
Possibly. A claimant would argue the firm relied on the score without enough judgement. Liability depends on whether the audit met the standard of a reasonably competent auditor, which turns on thresholds, follow-up and documentation. Audit firm PI usually responds to the claim, subject to the policy terms.
Its security page does not say either way, and it does not state a hosting region. Ask MindBridge directly, check the contract and data processing terms, and record the answer in your ISQM (UK) 1 assessment before uploading client ledgers.
Proposal forms increasingly ask about AI and analytics tools, especially for firms with listed or public interest entity clients. Describing how you use MindBridge, how outputs are reviewed and how the tool was assessed helps the insurer understand the risk and avoids disclosure problems later.
Tell us which tools your firm uses, what they produce and how output is checked. We will review how your PI and cyber cover respond and what insurers will ask at renewal. No fee and no obligation. Or call 0117 325 0027.
Book a PI programme review Get a PI quoteApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
