Adopting AI in your practice is no longer optional. As Nidal Danoun put it in a recent Auditors Institute session: “that train has left the station”. The question now is how you adopt it and if your professional obligations are keeping pace. The answer to that matters more than most practitioners realise.
AI tools can improve efficiency, automate tasks, and assist decision-making. None of that shifts your legal, ethical, or professional obligations. Those cannot be outsourced.
Under APES 110, the five fundamental principles remain in place regardless of how a task is completed. These principles are:
If an AI tool produces an output you rely on, that output is yours to stand behind.
The same applies to third-party tools. Using a system someone else developed does not mean the risk stays with the developer. The risk remains with you. You need to know how the tool works, and when things go wrong, you need to be able to explain why.
Automation creates efficiency. It also creates complacency and the problem with complacency is that you don’t know when you’re in it.
AI systems are not like a spreadsheet formula. Set up a formula in Excel and it stays fixed. AI systems learn, drift, and update in the background without your input. The front-facing model may look consistent while things shift underneath. A system that produced reliable outputs previously may not be doing so now. You won’t know unless someone is checking.
That is the human oversight element. It is not optional. As Nidal put it, automation is the motherhood of complacency. Building the habit of review as a regular practice is what keeps that in check. It should not just be when something looks wrong.
You do not need to become an algorithmic expert. You do need to know what the tool is doing, and when things go wrong, how they go wrong.
That means understanding the AI-specific risk management well enough to explain it. It means your clients knowing that AI tools are being used in their engagement. Transparency is not optional. And it means treating AI-generated outputs the way you would treat work prepared by anyone else in your practice: review it before you rely on it.
Applying professional scepticism here is familiar territory. Auditors are trained to:
That same lens applies directly to the AI tools in your practice and in your clients’ operations.
Where AI is embedded in a client’s financial reporting processes: estimates, valuations, forecasting is a risk area and you should treat it as one.
Ethical decision-making starts before the judgment call. It starts with recognising that an issue needs your attention.
Biases (including unconscious ones) can block that recognition entirely. If a system has been producing outputs without any flags, the instinct is to keep trusting it. That instinct is exactly where ethical fading begins.
The five fundamental principles under APES 110 provide the framework. The question to keep asking is:
Self-interest threats, familiarity threats, and advocacy threats are all in play. The reasonable, informed third-party test still applies: would a respected industry peer see your use of this technology the same way you do?
Both ASIC and APRA have written to licensees and directors on AI governance. ASIC’s position centres on six essential practices::
The consistent message from regulators is this: the benefits of AI are real, but the risks are existing risks arriving at a new size, scale, and speed. Cybersecurity risk is not new. Privacy risk is not new. What is new is the magnitude of impact and how quickly it spreads.
As Nidal noted, the efficiency AI delivers is real. Some of that efficiency should be reinvested in keeping an eye on the tools generating it.
The Auditors Institute covers AI, ethics, and professional obligations across its CPD programme. View upcoming sessions at auditorsinstitute.com.au.
New to the website? Become a member.
See Membership Plan
RCA Webinar is free for
Purchase the appropriate membership to access it
SMSF Webinar is free for
Purchase the appropriate membership to access it
