Where AI Fits in the Audit Lifecycle: Reality vs Hype in AI Auditing

Most executives think AI is about to transform audit into a mostly automated process that is faster, cheaper, and less dependent on people.

The premise is simple: if AI can analyze entire datasets rather than samples, then audits should become both more efficient and more reliable. This belief opens conversations around AI in the audit lifecycle, especially at the executive level.

But this view fails to understand a critical point:
Audits don’t have a data problem; they have a judgment and accountability problem.

It is essential to distinguish how AI in auditing actually works in practice.
That’s exactly where the difference between AI potential and the reality of audits become more noticeable.

Where the hype breaks down

Despite all these potential uses and features, the limitations of AI are still clear. AI is not responsible for signing audit reports, determining materiality, evaluating management intent, or independently providing full audit assurance.

In practice, these limitations are more visible. As our audit teams have added,

“If a staff member asks AI a broad question like "how do I account for this transaction?" without specifying the applicable framework (IFRS vs. ASPE), the entity's specific circumstances, or the relevant contractual terms, the AI may produce a technically correct answer for the wrong standard or a different fact pattern entirely.”

For less experienced staff member, this can lead to a false sense of confidence.

“We've also encountered situations where AI confidently cited non-existent standards or fabricated paragraph references; a classic hallucination issue. This is particularly dangerous in an audit context because the output reads as authoritative, and less experienced staff may not have the knowledge base to recognize the error.”
 
The key takeaway is that AI is a tool: it does not replace responsibility but improves execution of the audit lifecycle.

PKF Insight: The Real Shift in Audit (Execution vs. Assurance Layers)

There is a big misunderstanding in the market: companies are treating AI as an automation tool, when in reality, it presents a threat if not regulated closely.

To understand this, the audit lifecycle can be split into two distinct layers from an audit and risk perspective.

The execution layer is where the AI fits well. This includes data processing, pattern recognition, and repetitive testing procedures. AI performs strongly in these areas – improving speed, scale and coverage.

The assurance layer is where AI falls short. This includes evaluating evidence, professional skepticism, applying judgement and defending conclusions and taking responsibility.

AI struggles in this layer because it cannot understand the context completely, it cannot explain its reasoning in a regulatory sense and its decision-making procedure is not clear.

The critical insight is that the audit process is not just about analyzing data, but it is also about proving and defending conclusions. Today’s AI tools are not designed for defensibility in this regard.

This perpetuates a growing problem. Companies are increasing their dependence on AI; however, the governance, documentation, and validation frameworks are not keeping up with the pace.

In many cases, risk is growing faster than it is being managed. (Deloitte)

Implications of AI in Auditing for CEOs, CFOs, and Boards

This shift has great implications for decision makers, especially those managing financial reporting, risk and compliance.
 
Efficiency gains are real yet limited. AI will reduce manual input, improve efficiency of audit execution and improve data coverage. However, it will not eliminate audit complexity, reduce the need for supervision, or replace audit teams.

At the same time, companies that are adopting AI in audit workflows face new, unmanaged risks such as model risk, transparency risk and data risk.

Model risk arises from incorrect assumptions or flawed outputs, transparency risk stems from the inability to explain results or how decisions are made, and data risk from exposure of sensitive information.
 
These risks are not being properly managed by most companies yet.

Regulators have stated that even when AI is used in supporting tasks in audit procedures, auditors still fully remain responsible ensuring proper documentation and supervision. (PCAOB)

They are also asking questions:

These questions directly reflect the growing importance of regulation in AI in audit lifecycle adoption.

As our audit team noted, “What AI does change is the documentation trail. Firms need to consider transparency about AI use, responsibility and accountability, and retention of AI interactions”

“AI is raising the bar on what ‘good documentation’ looks like it’s enabling more complete, better-organized files, but it also introduces a new layer of documentation discipline around the AI process itself.”

Real-World Example: How AI Is Used in Audits Today

A mid-sized, multi-entity company used AI tools to analyze its entire population of transactions across ERP, payment and CRM systems rather than relying on sample testing. AI agents easily spotted patterns and anomalies that would have been hard to detect manually and significantly improved visibility.

However, the output was not decision-ready. Not all the flagged items were real risks, so the audit team had to use judgment, context, and materiality assessment. Sometimes the “issue” was simply normal business complexity, not control failure. (case study)

A real-world scenario can be seen at HSBC. The bank uses AI to monitor approximately 1.2 billion transactions monthly for signs of financial crime. However, this automated monitoring system resulted in many false positives, meaning there were many incorrectly flagged transactions that needed to be reviewed by humans. (HSBC fights money laundering)

Another example can be Deloitte’s $290,000 AUD Government Report. The company was paid by the Australian government to prepare a report about welfare crackdown and company heavily relied on AI for the research. A searcher auditing the report detected AI hallucinations including fake court cases, AI models filling in gaps and misinterpret data. (Deloitte pays money back to Albanese government)

These examples show how AI improves detection and visibility, yet judgement remains crucial in auditing.