AI in audit: where automation changes the economics of the engagement

Gartner's 2026 poll of 743 audit professionals found that 93 per cent of audit leaders report some level of AI use, but only 38 per cent have an AI strategy. The poll is a signal of what AI finds easiest to do in audit work; it is not a measure of external audit firm practice. Even so, the pattern is instructive: wide use, little direction.

The uses cluster around language. Gartner reports that 60 per cent of respondents use AI to draft audit issues, ratings or reports, 41 per cent to review drafts and 35 per cent to prepare stakeholder communications such as presentations. Thirty-seven per cent of audit leaders and auditors use it for general productivity tasks. These are valuable but modest: they save time at the edges of the engagement.

The core of audit work is less affected so far. Fewer than a third, 30 per cent, use AI for audit testing, and only 12 per cent apply it to quality assurance reviews. At departmental level, 35 per cent use AI for risk assessment and audit planning and 26 per cent for knowledge management. Risk assessment is the use that, in our view, deserves the most attention.

A strategy matters because of how AI changes risk. Without one, individual teams adopt tools with different standards for validation, data handling and documentation, and the firm cannot demonstrate a consistent approach to inspectors. A strategy need not be long. It should say which engagements and procedures are in scope, what outcomes are expected, which quality indicators will be tracked and who decides.

Our reading is that the gap between drafting and testing is a gap in investment and confidence, not capability. Drafting tools are inexpensive and low-risk. Testing tools need data pipelines, validation and regulatory comfort. Firms that move first on testing and risk will build advantages that are hard to copy, because those advantages depend on accumulated data, templates and experience rather than software licences.

Gartner's earlier benchmark of more than 1,000 audit leaders shows the same early-stage pattern, with 42 per cent of chief audit executives calling GenAI embedding an important priority for 2025, 28 per cent still exploring and 21 per cent piloting. The implication for a managing partner is that most competitors are using AI for convenience. What to do: map where your own firm uses AI, separate drafting uses from testing and risk uses, and set a target for moving effort towards the latter.

Three families of procedure change materially. The first is full-population testing of transactions, where analytics replaces sampling. Accountancy Age reports that KPMG's AI transaction scoring scans millions of entries to flag anomalies of interest to auditors. The second is anomaly detection and pattern recognition across ledgers, sub-ledgers and external data. The third is document analysis, where models read contracts, board minutes and correspondence at a speed no team can match.

Deloitte, according to the same report, is using AI to streamline time-intensive tasks including reviewing board minutes and complex contract analysis. These tasks are repetitive, text-heavy and bounded, which makes them well suited to current models. They are also tasks where junior staff time has traditionally been spent, which means the economics of the pyramid model change as they are automated.

The change in what is possible matters more than the change in cost. Testing a whole population rather than a sample alters the question an auditor can answer. Instead of inferring from a sample that the population is probably free of material error, the auditor can identify specific unusual items and investigate them. That is a stronger assurance conclusion, if the data is complete and the tests are well designed.

It is worth being precise about what AI adds beyond conventional analytics. Rules-based data analytics has existed in audit for years. What is new is the ability to handle unstructured data such as contracts, emails and board papers, to combine signals across sources and to explain anomalies in plain language. That broadens the evidence an auditor can examine, but it also raises new questions about the completeness and reliability of the model's output.

The effect on staffing is significant. Junior auditors have traditionally learned the business by performing tests and reading documents. If agents do the first pass, firms must find other ways to develop judgement: structured review of exceptions, rotations through risk assessment and coaching on challenge. Partners who ignore this will find the pipeline of capable seniors thinning within a few years. The training model is part of the economics.

The implication is that AI belongs first where data is structured, volumes are large and the test is rule-based or pattern-based. What to do: rank your audit procedures by data volume, repeatability and risk, and prioritise automation where all three are high. Pilot on a small number of engagements, compare results with conventional work, and document the comparison so that it can be shown to inspectors.

Some procedures resist automation. Assessing management's estimates, evaluating going concern, challenging forecasts, judging fraud risk and exercising professional scepticism rely on context, experience and the ability to question people. AI can prepare material for those judgements, for example by summarising evidence or flagging inconsistencies, but it does not make them, and it cannot take responsibility for them.

Overclaiming is a commercial and regulatory risk. A firm that tells clients AI replaces judgement is exposed if an AI-assisted conclusion proves wrong. The FRC's guidance, published on 26 June 2025, follows a thematic review of the six largest firms' processes to certify new technology used in audits, and it includes documentation guidance on how AI is used in the audit file.

The FRC's guidance has a two-part structure that includes an illustrative example of one way AI can be used in an audit, and its documentation guidance reflects the UK government's five AI principles. The signal for firms is that regulators are open to AI but expect the auditor to remain responsible, to understand what the tool does and to retain evidence of the work done.

Judgement can be supported in ways that matter. For estimates, AI can gather comparable data, test assumptions against market information and highlight changes from prior periods. For fraud risk, it can identify behavioural anomalies. The auditor still decides. The key discipline is to record how the AI output was used, what the auditor challenged and what conclusion was reached, so that the file shows the auditor's thinking and not simply the tool's.

Professional scepticism can also be eroded by over-reliance. Automation bias, the tendency to accept an automated output without challenge, is a recognised concern in any technology-assisted decision. Firms should train teams to treat AI output as evidence to be evaluated, build review steps that test a sample of outputs against source documents and encourage teams to report cases where the tool was wrong. Those cases are valuable learning, not embarrassments.

The implication is that firms should be explicit about which procedures AI supports and which it does not. What to do: classify each audit area as automated, assisted or human-led, publish the classification internally, and make sure engagement teams know where they must apply judgement and record it. A clear boundary protects both quality and the firm's position with its regulator.

Accountancy Age reported the FRC's finding that the Big Four, BDO and Forvis Mazars had embedded AI-powered technologies into their audit processes without formally assessing the effect on audit quality. None of them, bar one unnamed firm, had defined key performance indicators to monitor the tools' contribution to audit quality. KPMG UK's head of audit quality said the firm monitors adoption using a range of KPIs.

Quality remains a live issue. PCAOB inspection data reported by Accounting Today show aggregate Part I.A deficiencies at the US Big Four rising from 12 per cent in 2020 to 16 per cent in 2021 and 26 per cent in 2022, then holding at 26 per cent in 2023. Across all firms, 46 per cent of engagements reviewed in 2023 inspections had at least one Part I.A deficiency.

The dispersion between firms is wide. In the 2023 inspections, the Part I.A deficiency rate was 18 per cent at PwC, 21 per cent at Deloitte, 26 per cent at KPMG and 37 per cent at EY. Bloomberg Law reports that EY expected its pending 2025 inspection to show deficiencies in less than 10 per cent of audits, from 28 per cent in its latest published report, and has pledged to spend $1.4 billion on AI globally.

Quality data also show why inspectors will be curious about AI. A firm with a high deficiency rate cannot assume that technology will fix the problem, because weak methodology automated at scale is still weak methodology. Conversely, a firm with strong quality processes can use AI to extend them. The spread between firms in 2023 suggests that firm-specific execution matters more than industry-wide trends.

Audit committees are a second audience. They are increasingly asking auditors how technology is used, what data is shared and what assurance exists over the tools. A managing partner who can answer with a clear description, a quality metric and an example is better placed than one who offers general statements about innovation. Prepare a standard briefing for audit committees and update it each year.

The implication is that quality metrics are the language regulators and audit committees will use to judge AI. What to do: define a small set of indicators before scaling, such as deficiencies found in inspection, review notes per engagement, rework hours and late-stage adjustments, and track them for AI-supported engagements against comparable conventional ones. A firm that can show improvement has a commercial story; one that cannot has a risk.

Ideagen's 20-year review of SEC audit fee data shows a market that is consolidating fast. Total audit fees reached $18.7bn in FY2025, a new high, even as the number of registrants reporting fees fell to 6,674, the lowest in the 20-year series. The Big Four together held 69 per cent of all audit fees, a share that has stayed close to seven-tenths of the market for two decades.

Average total fees per company rose to $3.36mm in FY2025 from $3.14mm the year before, a fourth consecutive annual increase, as fees are spread across a smaller population. Accounting Today reports that average audit fees paid rose from $681,000 in 2003 to $2,243,000 in 2022, more than tripling over the period. Audit has become more expensive per client for two decades.

Against that backdrop, clients and audit committees will ask what AI means for price. A firm that has invested heavily in technology and still bills on hours will struggle to explain why the fee has not fallen. A firm that cuts fees will struggle to fund investment. The tension is real, and it is sharper for mid-tier firms that lack the scale of the largest four to spread investment.

Clients' own AI use matters for pricing as well. Companies are automating finance functions, and cleaner, more structured data lowers the cost of audit. A firm should recognise where client improvements reduce its effort and where they increase risk, for example when management uses AI to generate journal entries or estimates that the auditor must then understand. The fee should reflect both effects, not only the auditor's own technology.

Competition will also reshape pricing. The Big Four hold 69 per cent of audit fees, and a firm outside that group competes with both their scale of investment and their brand. Mid-tier firms may find that specialisation, whether in sectors, in particular risk areas or in technology-enabled continuous assurance, is a more reliable route than matching the largest firms' spending. Pricing then follows differentiated value rather than a comparison of hourly rates.

The implication is that repricing needs a deliberate position, not an ad hoc response to each client. What to do: decide which parts of the fee reflect risk, regulation and judgement, which reflect labour that AI will reduce, and which reflect the investment in technology and data. Be ready to explain each, and to show the client what they get in return for the fee they pay.

Hourly pricing rewards inefficiency and punishes investment. If AI halves the hours spent on testing, a time-and-materials model halves the revenue from testing, while the firm carries the cost of the tools. The natural response is to move to fixed fees tied to scope, with clear change-control, and to price the risk assessment and judgement elements separately from the compliance testing that AI makes cheaper.

We see three workable models. A scope-based fixed fee prices the engagement by entity complexity and risk, with AI-driven efficiency retained by the firm and shared through a stable fee. A tiered model offers a base audit plus enhanced assurance, such as continuous testing or deeper analysis of controls. A shared-benefit model returns part of the saving to the client if overruns are avoided. Each needs transparent assumptions.

Overruns are where the economics bite. Engagements that exceed budget do so mostly because risks surface late: a misstatement found in the final weeks, a control that fails, a client system that cannot supply data. Risk assessment across the whole population, earlier in the cycle, brings these issues forward. Bloomberg Law notes that EY now tackles more than two-thirds of its work before a client's fiscal year closes, which is consistent with that logic.

The scale of investment at the largest firms is substantial. EY's global pledge of $1.4 billion on AI illustrates the order of magnitude a Big Four firm is prepared to commit. A smaller firm cannot match it, nor does it need to. It needs a focused programme: a few use cases with clear returns, shared tools where possible and partnerships with technology providers that share development cost.

Return on investment should be tracked as rigorously as in any other business case. Measure hours saved on specific procedures, the reduction in late-stage adjustments and overruns, and the effect on staff retention and recruitment. Many firms find that AI-enabled working helps attract graduates who expect modern tools. That benefit is real but hard to measure, and it should not be the main justification.

The implication is that the business case should be built on avoided overruns, write-offs and rework, in addition to hours saved. What to do: baseline the last three years of overruns by cause, estimate how much would be addressed by earlier risk assessment, and use that estimate in the investment case. This approach produces a more defensible return than a headline hours saving, which clients will simply ask you to pass on.

The constraint on scaling is rarely the model. It is data access, documentation and governance. Gartner found that only 38 per cent of audit leaders have an AI strategy, which suggests that many programmes are running without agreed rules for approval, validation and monitoring. A firm needs a register of AI tools, an owner for each, a validation process and a defined route for changes.

Data is the second constraint. Full-population testing depends on complete, reliable extracts from the client's systems, and the quality of that extract is often outside the auditor's control. Data security, client confidentiality and data residency must be handled with care, particularly where tools use external models. Contracts with technology providers should specify where data is processed and who can see it.

Independence and responsibility remain with the auditor. The FRC's thematic review of the six largest firms' processes to certify new technology shows that certification of tools is a matter regulators look at directly. A firm should be able to explain how each tool was tested, what limitations were identified, how output is reviewed and who is accountable. Without that, an AI-assisted conclusion is hard to defend.

Change management is the last constraint. Experienced auditors may distrust tools they did not build, and juniors may use them without enough scepticism. Training should cover both: what the tool does, where it fails and how to document its use. Champions on engagement teams, drawn from respected seniors, do more to build adoption than central mandates. Feedback loops that let teams report errors improve the tools and build trust.

Finally, consider the effect on the firm's identity. Auditors are valued because they are independent, rigorous and sceptical. AI that supports those qualities strengthens the firm; AI that substitutes for them weakens it. Leaders should be able to say, in one sentence, how each AI use supports the firm's role as a trusted verifier. If a use cannot pass that test, it should be reconsidered, however efficient it appears.

The implication is that governance is a source of speed, not a brake. Firms with clear controls can deploy faster because engagement teams trust the tools. What to do: establish an AI governance group of audit quality, technology, risk and legal leaders, publish a short policy, and require each new use case to pass a standard validation before release to engagement teams.

Karter McKinley helps accounting and professional-services firms turn AI into an operating and commercial plan: classifying procedures, designing pilots, setting quality metrics, building the investment case and shaping the fee model. We work alongside audit quality, technology and risk leaders; we do not provide audit or legal opinions. This briefing is general information, not professional advice.