The Age of Generative AI: How the Profession Can Respond

Since the public release of various cutting-edge generative artificial intelligence (genAI)-powered chatbots in November 2022, curiosity and engagement with advanced genAI technologies has surged exponentially. While AI and machine learning have long been established, the accessibility and ease of use of genAI chatbots has ignited widespread interest among individuals and businesses alike. What does this mean for the financial reporting profession?

A recent survey by the Center for Audit Quality (CAQ) found that one in three audit partners see companies in their primary industry sector deploying or planning to deploy AI in their financial reporting process. This is not just a passing trend; it represents a significant shift as companies explore the transformative potential of AI in enhancing accounting and financial reporting practices.

Auditors need to recognize the emerging importance of genAI and stay informed in an ever-changing landscape. Auditing in the Age of Generative AI is a resource for auditors looking to understand how this technology is enhancing accounting and financial reporting processes and how the profession can respond to this emerging area.

What is GenAI Technology?

GenAI is a subset of artificial intelligence based on probabilistic technology that can create content, including text, images, audio, or video when prompted by a user. GenAI creates responses using algorithms that are often trained on open-source information, such as text and photos from the internet. Based on this training, when prompted by a user, genAI technologies make predictions of the next character, word, phrase, pixel, etc. to formulate a probable response to the user prompt. In other words, genAI is a predictive technology, and therefore, the outputs are based on what the genAI technology has determined is a probable response. This makes genAI skilled at performing tasks that involve drafting content, summarizing data, and recognizing patterns and trends in large amounts of data. AI chatbots, like ChatGPT and Copilot, are well-known examples of GenAI.

“Because of both the simplicity and utility of GenAI, it has the power to transform a vast amount of business processes, including those impacting financial reporting. For example, GenAI can summarize and analyze vast amounts of information to generate accounting memos or prepare a first draft of financial statements.” – Dan O’Malley, CPA, Audit Senior Manager, Crowe LLP

For auditors, the probabilistic nature of genAI is a key distinction from other technologies that they may have historically encountered in a company’s financial reporting processes, which may inform auditors’ identification and assessment of risks of material misstatement, including the identification of process-level risks or risks arising from IT.

However, despite genAI’s impressive capabilities, humans still need to be involved to oversee genAI technologies and apply critical thinking skills. Information produced by genAI is not necessarily factual and may not be able to be replicated by the same genAI technology, even if the same input is provided again. When auditors are performing audit procedures over information produced by genAI, the auditor’s responsibility to obtain sufficient and appropriate audit evidence under applicable auditing standards remains unchanged.

Deploying GenAI: What Auditors Should Know

New risks can arise when deploying genAI in financial reporting processes and ICFR. As auditors obtain an understanding of the company’s use of genAI, they will need to consider how its use may impact the identification and assessment of risks of material misstatement, including the identification of process-level risks or risks arising from IT. In our publication, we have compiled a list of several potential risk areas and accompanying questions for auditors to consider.

One area that we explore is risks that may arise related to the company’s governance of genAI. Overall governance is critical to enable the company to know where and how genAI technologies are being used and to understand and evaluate the impacts of its use on processes and internal controls. The following questions may be useful for auditors to consider how the company’s governance of genAI may impact their risk assessment:

• Who (individual or group) in the company is responsible for oversight of the use of GenAI?
• Has the company developed a framework for the responsible use of GenAI?
• Has the company established policies regarding the acceptable and ethical use of GenAI?
• How are policies regarding the acceptable and ethical use of GenAI documented and communicated to appropriate individuals throughout the company?
• How does the company monitor compliance with policies regarding the acceptable and ethical use of GenAI?
• Does the company have a process to track and monitor the use of GenAI throughout the company, including use by third-party service providers?
• How does the company evaluate the impact (nature and affected groups) of GenAI technologies being deployed?
• How does the company track risks arising from the use of GenAI technologies and mitigating responses?

“Before organizations can fully embrace genAI, they should understand the risks and have a plan to implement responsible practices to manage new and evolving risks. This is what we refer to as responsible AI.” – Jennifer Kosar, Trust and Transparency Solutions Leader at PwC US

For many current genAI use cases in financial reporting processes and ICFR, keeping a human involved in the process (“a human in the loop”) may address some of the risks arising from its use. A human in the loop is responsible for reviewing the accuracy and completeness of company inputs entered into the genAI technology, understanding the explainability and interpretability of the outputs, and reviewing the outputs to determine quality, reliability, and appropriateness. Most importantly, human involvement with genAI technology requires a high degree of vigilance and professional skepticism.

Additional Auditor Considerations

Auditors should assess if their audit engagement team has the appropriate knowledge and skills to respond to the risks of material misstatement related to the use of genAI. Depending on the skillset of the audit engagement team, additional training related to genAI may be necessary or it may be appropriate to involve an individual with the requisite knowledge, skill, and ability related to genAI.

As the use of and reliance on GenAI technologies evolves, audit procedures will likely need to adapt as well. For example, the nature of outputs from GenAI technology may be complex or otherwise unable to be independently replicated or verified by a human. In these cases, it will be critical for companies to have appropriate processes and controls surrounding GenAI, including human oversight of the technology, which are designed to respond to the associated risks.

“A number of years ago a popular mantra when deploying AI was ‘Let the humans do what humans do best, and let AI do what AI does best.’ That is still true today, but the scope of what AI can do has not only drastically changed, but the capabilities are far more accessible. These rapid changes present the risk that limitations are overlooked with insufficient human review, oversight, and governance.” -Kevin Murphy, Director, Audit Innovation at Grant Thornton

Auditors are well-qualified to meet new challenges arising from the use of genAI by applying and building on their expertise in identifying and assessing risks, exercising professional skepticism, and developing appropriate audit responses.

As generative AI continues to evolve and become a component of how financial reporting professionals operate, the CAQ will monitor its impact on our profession and beyond. To get the latest insights, explore our resources and subscribe to our newsletters to learn more.