Envelope Phone-volume

Login

Login

Envelope Phone-alt

Artificial intelligence is rapidly reshaping the business landscape – and audit is no exception. From AI-generated financial models to predictive procurement systems and algorithm-based credit decisions, Australian entities are increasingly embedding AI into their core operations. For Registered Company Auditors (RCAs), this raises a critical question: how do we audit what we don’t fully understand yet?

The growing use of AI is not only changing how clients operate – it’s also introducing new categories of risk that traditional audit procedures were never designed to address. As we move deeper into 2025, AI risk is no longer theoretical. It’s real, it’s here, and it’s audit relevant.

Why AI Risk Matters in the Audit Context

The risks associated with AI go far beyond cybersecurity or data privacy. At their core, they challenge auditors’ ability to assess:

• Completeness and accuracy of AI-generated outputs
• Management’s assumptions and judgments embedded in algorithms
• The integrity of data sources and model logic
• Control environments where AI applications operate without human oversight

When these risks intersect with financial reporting – such as revenue recognition systems, loan provisioning models, or forecasting engines – the potential for material misstatement becomes real.

ASIC and international regulators are increasingly warning that auditors must not overlook or under-assess the complexity and risks of AI-based systems within the control environment.

What Should RCAs Be Doing Differently in 2025?

Many auditors still approach technology risks generically – treating AI like any other IT system. But AI brings unique characteristics: opacity, adaptability, and unpredictability. That requires a different level of inquiry, documentation, and scepticism.

In practice, RCAs need to:

• Understand the purpose and function of any AI systems used in financial reporting processes
• Evaluate management’s oversight and governance over AI model development, deployment, and updates
• Challenge the reliability of outputs, especially if they replace traditional accounting estimates or forecasts
• Consider bias and discrimination risks, particularly in AI models that impact provisions, pricing, or valuations

Importantly, the auditor doesn’t need to be a data scientist – but they must know what questions to ask and when to bring in expert support.

A New Angle on Risk Assessment

The application of ASA 315 (Revised) is more relevant than ever. Auditors must now treat AI-related processes as significant areas of risk where relevant, and adjust procedures accordingly. This might include:

• Enhanced walkthroughs of AI-embedded processes
• Additional testing of control design and implementation
• More robust documentation of audit judgment around model reliance

Without these steps, RCAs risk underestimating the implications of AI on material classes of transactions or key disclosures.

Where the Profession Is Heading

Audit firms globally are beginning to formalise their approach to AI risk – developing checklists, model evaluation protocols, and AI governance frameworks. In Australia, this trend is likely to accelerate, especially as ASIC and the AUASB turn their attention to technology-enabled environments in their inspection cycles.

At the same time, assurance over AI models themselves is likely to become a new service line – creating both a challenge and an opportunity for forward-looking RCAs.

Final Thoughts

AI is no longer an emerging issue. It’s a live audit consideration that demands updated skills, sharper professional judgement, and, in many cases, collaboration with experts. The good news? Auditors are well positioned to assess complex systems – we’ve been doing it with internal controls, estimates, and judgments for decades. The key is to evolve our lens and our language.

For Australian RCAs, the question isn’t whether AI is relevant to your next audit – it’s how ready you are to respond when it is.