A review of global guidance reveals four major themes that NFRA’ could focus on while developing its own tools or issuing guidance for the auditing community: documentation and explainability, human oversight, risk management and data privacy, and professional competence.

Documentation and Explainability: The FRC’s AI in Audit guidance stresses that the black box nature of many AI models necessitates clear documentation around governance, development and explainability. Firms must maintain an audit trail of what the tool does through its entire lifecycle.This includes documentation of the model’s purpose, the data on which the AI was trained and validated including data sources, selection criteria, and data quality controls. But the guidance also warns about over-documentation that can divert resources from the main functionality of enhancing audit quality. The PCAOB spotlight document also highlighted that organisations are developing guardrails to document underlying source data and reduce the probability of “hallucinations” or false outputs.

Human Oversight and Professional Judgement: All the guidance documents unequivocally emphasise human involvement. The spotlight asks the engagement team to remain alert and responsible for results, when using AI. Supervisors are advised to apply the same diligence while reviewing work. AI outputs do not relieve auditors of their responsibility, they merely reduce it by taking on the grunt work. The aim of the AI tools should be to augment and not to replace humans. The CAQ’s Generative AI paper articulates a “human in the loop” principle i.e., employees should review the accuracy and completeness of inputs, understand the explainability of the outputs and be able to defend the same. The level of human involvement should be proportional to the risk profile and the kind of task at hand, but vigilance and professional skepticism are non-negotiable.

Risk Management and Data Privacy: Privacy and security risks are heightened where generative AI relies on third-party or cloud infrastructure, considering the sensitivity of client data and audit working papers. The PCAOB spotlight observes that data privacy and security risks limit generative AI’s use in audit procedures, prompting some firms to prohibit AI use altogether. The risks include data poisoning (intentionally providing AI with unreliable data to influence the entire workflow and produce unreliable output), or malicious prompt injections (giving malicious prompt directly or disguising it as data that causes the model to ignore its original developer instructions). In order to combat these risks, the NIST AI RMF provides a broader risk management framework which organises risk management activities into govern, map, measure and manage functions. Audit firms can be made aware of the characteristics of a trustworthy AI that also considers societal dynamics and human behaviour. Even the White House Executive Order and the EU AI Act calls for a safe, secure and trustworthy AI through explainability, human oversight and risk-based classifications of AI systems. There needs to be robust data governance, model validation, version and access control, and regular monitoring. NFRA’s challenge recognises some of these requirements by mandating explainability and strict confidentiality.

Professional Competence and AI Literacy: There is a need to increase professional competence of auditors by increasing AI literacy, applying critical thinking and assessing risks and controls. Creating guidelines and standards would only help so much, if the people who supervise the process are not properly trained. Auditors are expected to develop new skills in data analytics, machine learning and ethical AI.