AI auditing: how AI in financial reporting is changing what audit risk means

In February 2026, COSO issued internal control guidance dedicated to generative AI, built on the same five components that underpin ICFR for most US issuers. That publication answers a question most writing on AI auditing still leaves open. The phrase usually describes AI as an instrument the auditor picks up. It increasingly describes something else: a model operating inside the financial reporting process, producing figures that reach the statements, and therefore owed the same evaluation as any other part of the control environment.

This article works through that second meaning. What audit risk a reporting-side model creates, who carries accountability for overseeing it, and how assurance methods are being rebuilt around evidence that now has to cover the model itself.

What is AI auditing? Two directions to distinguish

The useful way to split the term is by which side of the audit boundary the model sits on. Same technology, opposite obligations.

AI on the assurance side

On this side, the model works for the auditor. It ranks transactions by exposure, classifies entries for review, and tests populations that manual procedures could never reach in the time available. Audit firms and software vendors emphasize this direction because the payoff is measurable in detection rates and cycle time. Continuous controls monitoring belongs here: control tests execute on every data extraction, so a breakdown surfaces within days of occurring instead of at the next review.

AI on the preparer side

On the other side, the model does the accounting. It assigns journal entries to accounts, calibrates an expected credit loss, allocates revenue across performance obligations, or produces the first draft of a disclosure. Each of those outputs lands in the trial balance or the notes, which puts the model inside the population the auditor has to test.

Generative systems raise the stakes because their behavior varies between runs. The Center for Audit Quality has observed that generative AI may not always provide reliable or repeatable information, and that people stay in the loop to oversee, understand, and evaluate the relevance and reliability of what it produces (Audit Committee Oversight in the Age of Generative AI, July 2024). Re-performance is the foundation of control testing, and a system that answers differently on the second attempt undermines it.

Organizations that recognize only the assurance side end up with sharper detection sitting on top of an untested preparer side. The concepts needed for the second side already exist in audit practice: the control environment, model validation, and sufficiency of evidence. For AI governance at enterprise scale, the artificial intelligence audit article covers the frameworks. What follows stays with financial reporting.

How AI in financial reporting introduces new audit risk

Model risk management is the discipline that identifies, measures, and limits the exposure created when a model produces incorrect output or gets applied outside the conditions it was built for. Banking supervisors codified it first. The Federal Reserve's Guidance on Model Risk Management (SR 11-7, April 2011) treats a model as any quantitative method applying statistical, economic, financial, or mathematical techniques to turn input data into estimates, and locates the exposure in decisions taken on the strength of a flawed or misapplied one. That definition predates generative AI and still describes most of what runs in a reporting chain.

Four failure modes

• Flawed assumptions. Every model embeds a view of how the underlying activity behaves. A miscalibrated parameter or an unsuitable deployment context corrupts output at the rate the model runs, which for an automated process means continuously.
• Unrepresentative data. Output quality tracks input quality. Historical entries carrying legacy coding errors, gaps in a period, or an unbalanced mix across entities will produce estimates that look coherent and are wrong, sometimes for a full reporting cycle before anyone notices.
• Model drift. Performance decays as the activity it was trained on changes. A classifier calibrated on last year's vendor mix loses accuracy as procurement shifts, without any change to the code and without any alert unless monitoring was designed in from the start.
• Opacity. A result that cannot be traced back through its reasoning can be assessed for plausibility and little else. Plausibility falls short of the standard for audit evidence.

Replayability is what makes a model testable

Opacity is the failure mode that engineering choices can settle in advance. A deterministic system returns the same output for the same input and can be re-executed, which puts it within reach of standard control testing. A system that reasons afresh on each run cannot be re-performed, and a control that resists re-performance is difficult to place reliance on.

Supervizor X, Supervizor's design approach to AI in audit analytics, applies four conditions together: reliable output, because inputs are standardized at source; deterministic behavior, so identical inputs return identical results; traceable analysis, because the work is decomposed into auditable steps with generated explanations; and data safety, because client data never trains a model. The property that qualifies an AI tool for use in assurance is the same property that qualifies an AI model for reliance inside reporting.

Supervisory guidance has an acknowledged gap

In April 2026 the Federal Reserve, OCC, and FDIC replaced SR 11-7 with revised model risk management guidance (SR 26-2). It extends those principles to traditional statistical and quantitative models and to non-generative AI, while stating that generative and agentic systems fall outside its formal scope as novel and rapidly evolving. The agencies signaled a separate request for information on how banks use AI.

Two qualifications matter for anyone outside banking. This is supervisory guidance for banks, not an ICFR rule, and it binds no general corporate issuer. Its model definition and inventory expectations travel across industries because nothing more specific has been written. The most developed model risk framework available says openly that it does not yet cover the technology generating most of today's concern.

What makes an AI model high-risk in financial reporting

Scrutiny should follow consequence. Five factors set the tier, and each can be scored by an auditor without specialist machine learning knowledge.

Rating the technology instead of the application is the error that recurs most. An identical algorithm carries one risk level in an internal forecasting aid and another when it sets a number that gets reported. Purpose and exposure decide the tier.

Replayability works differently from the other four. It governs whether any of them can be verified. A model touching thousands of material transactions with no reproducible output belongs at the top of the register whatever it scores elsewhere, because nothing about its behavior can be independently confirmed.

The audit committee's oversight role

Where the responsibility has landed

Board attention arrived fast. EY's Center for Board Matters found the share of S&P 500 companies naming AI among committee responsibilities more than tripled in a year, from 6% to 20%, most often assigned to the audit committee (proxy statement review, 2025). Allocation still varies: PwC's 2024 Annual Corporate Directors Survey recorded 57% of directors placing primary oversight of emerging technology with the full board and 17% with the audit committee. AI governance now heads the list of challenges audit partners see facing audit committees, according to the CAQ's Audit Partner Pulse Survey (Spring 2026).

Validation stays with management. A committee's job is to confirm that a lifecycle exists around every model feeding the statements, covering development, independent validation, and monitoring, and that high-risk ones get reviewed by people other than those who built them. Review by the build team is self-review, and self-review is the gap through which a defective model keeps running.

The representation letter is the pressure point

Management representations assert that the financial statements are complete and accurate, and that internal control over financial reporting operates effectively. When models perform part of that work, the assertion covers them by implication whether or not anyone has looked.

That makes three checks worth running before sign-off: whether the model inventory is complete enough to support the assertion, whether AI-related judgments reaching the notes are disclosed, and whether the representation language reflects the fact that automated systems now execute controls the letter vouches for. At the 2025 AICPA and CIMA Conference on Current SEC and PCAOB Developments, SEC Chief Accountant Kurt Hohl addressed AI as an emerging issue and noted that auditor independence faces increasing pressure in the age of AI, given both technological and ethical complexities.

When an AI model becomes part of ICFR

Once a model takes over a task a key control used to perform, it enters the scope of internal control over financial reporting. The mechanism is the same one that brings any automated control into scope. What changes is that the logic can no longer be read off a configuration screen.

AI-assisted journal entry coding illustrates the point. A model assigning entries to accounts that a reviewer previously assigned is executing a control activity, and a systematic coding error becomes a control failure capable of misstating balances at the volume the model processes. Estimates go further still, since a model producing an expected credit loss or allocating revenue exercises judgment that was previously documented by a person.

COSO's February 2026 publication, Achieving Effective Internal Control Over Generative AI, applies the five components and 17 principles of the 2013 Internal Control, Integrated Framework to exactly this situation. Its argument turns on the move from deterministic, rule-based technology to probabilistic models, and its conclusion is that set-and-forget assurance fails for a system whose behavior shifts over time.

Where SOX 404 picks it up

Section 404(a) of the Sarbanes-Oxley Act obliges management to assess and report on ICFR effectiveness. Section 404(b) obliges the external auditor to attest to that assessment, with non-accelerated filers and smaller reporting companies below the SEC's revenue threshold exempt from the attestation requirement.

PCAOB Auditing Standard AS 2201 governs how that attestation gets performed, including how auditors evaluate whether controls are designed appropriately and operating effectively. A key control executed by a model is inside that perimeter. Where the model resists testing, reliance on the control cannot be supported, and unsupported reliance is a deficiency. Amendments to AS 2201 take effect on December 15, 2026, which makes the next audit cycle a reasonable moment to revisit how models inside key controls are documented.

How internal and external audit are adapting

Coverage stopped being the limiting factor

Sampling exists because examining every item by hand was impossible, so auditors tested a subset and extrapolated, accepting sampling risk as the cost. Transaction-level analytics lifts that limitation. Platforms built for continuous audit analytics, Supervizor among them, run tests across the entire transaction population on each data extraction, closing the coverage gap that sampling leaves structurally open.

The composition of audit risk changes with it. Sampling risk is the probability that the selected items happened to exclude the misstatement, and full-population testing removes it. Model and data risk take their place, because ranking and prioritization now determine what gets human attention. The question shifts from whether the right items were selected to whether the logic that ranked them holds up.

Evidence has to reach the model

Conclusions resting on model output require evidence about the model. The IIA's Artificial Intelligence Auditing Framework, updated in 2024 and structured on the Three Lines Model, gives internal audit a way to assess AI governance alongside controls over data and algorithms. The IIA's Global Internal Audit Standards, issued in 2024 and effective January 2025, require auditors to consider the reliability of technology their conclusions depend on.

One point about external standards gets reported loosely and is worth stating precisely. The PCAOB's 2024 amendments to AS 1105 and AS 2301 address technology-assisted analysis of information in electronic form, and the adopting release states explicitly that they do not address other technology applications such as artificial intelligence. No PCAOB standard currently imposes requirements specific to AI in the audit.

The exposure is real and so far undocumented

Honesty on one point is more useful than a convenient example. As of publication, no primary source records a case where an AI or algorithmic model caused an actual misstatement, material weakness, or restatement at a listed company. The SEC's 2024 actions against Delphia and Global Predictions concerned firms overstating their AI capabilities, which is a disclosure matter.

Absence of a documented case reflects timing, not safety. Integrating AI into existing processes and technologies now ranks as the single greatest challenge for 48% of chief audit executives in Protiviti's Top Risks 2026 survey of 1,540 board members and executives. The first documented failure will surface through a restatement or a material weakness disclosure.

Building AI into your audit risk assessment

AI belongs inside the risk assessment already running. Three steps put it there.

1. Map where models cross into reporting. Walk each cycle and record every point where a model produces, transforms, or approves something that reaches the ledger. Unmapped models stay unassessed, and the map is the first artifact the audit committee will request.
2. Tier them with the taxonomy already in use. Score each entry against the five factors above, anchored to a recognized framework such as the IIA's or the NIST AI Risk Management Framework (version 1.0, 2023), so AI risk reads in the same language as every other line of the register.
3. Set the revalidation trigger before deployment. Define the drift threshold, the monitoring frequency, and the event that forces a fresh validation. Retrofitting monitoring after go-live is how drift goes unnoticed.

The inventory does the heavy lifting. Seven fields make it usable:

Maintenance is where inventories fail. A spreadsheet stays accurate for roughly one quarter. Analytics infrastructure carries the work instead: it tests the full transaction population that models act on, monitors the controls they feed, and subjects model-generated entries to the same checks as manually posted ones. Supervizor's audit analytics software runs that testing across the procure-to-pay, order-to-cash, and record-to-report cycles. Adoption makes the timing pressing: active use of AI inside finance functions climbed from 30% to 75% between 2024 and 2026, in KPMG's 2026 Global AI in Finance survey of 1,013 senior finance leaders. 

Conclusion

Three moves close the gap: map the models touching financial reporting, tier them on purpose, exposure, and replayability, and test the high-risk ones as the controls they now are. Analytics infrastructure for full-population testing is already available. Supervisory guidance is not. The Federal Reserve's April 2026 revision placed generative and agentic AI outside its formal scope, leaving the systems most likely to appear in a 2027 close without a dedicated framework.