Photo by Şeyda Nur Uğur

The more we automate auditing, the more we are forced to confront a problem that technology cannot solve for us: human reasoning and judgment.

I was reading this FT “AI has arrived in auditing. Are regulators ready? It’s a good article indeed, and a hot topic as well, but I sometimes think such discussions give too much importance to the technology and not enough to the people using it.

Because when you strip away the technology, the software, the dashboards, the anomaly detection, the automated workpapers, and the audit is still the same thing it was 30 years ago. Essentially, someone is trying to verify whether a set of financial statements is true and fair. Someone is trying to decide what is risky, what is material, what evidence is enough and then signing their name at the end of the file. Job done!

Tools have changed drastically many times before. There was a time when auditors once physically counted inventory with clipboards and pencils or observed inventory counts. Following came the mighty spreadsheets and the data analytics. And now the dawn of AI! The method changes, but the responsibility doesn’t move. The opinion still has a human name on it, not a software or a faceless machine.

That’s why I’m not entirely convinced by the idea that regulators need to “keep up” with AI in the way people suggest. Regulators don’t approve Excel. They don’t approve of RFID scanners. They don’t approve of inventory counting robots. What they care about is whether the auditor obtained sufficient appropriate audit evidence and applied professional judgment. How you get the evidence matters, but not as much as whether the conclusion is reasonable and defensible.

In that sense, the pressure should perhaps be less on regulators to keep up with the tools and more on auditors to maintain control over them. An auditor cannot say, “The AI said it was fine,” any more than they can say, “The spreadsheet said it was fine.” The responsibility has always been personal.

That has not changed, and I don’t think it will.

Where I do think the conversation gets more interesting is when we move away from regulation and start talking about human judgment. Because auditing, for all its technical standards and methodologies, is at its core a judgment profession. You are constantly making judgment calls with incomplete information and limited time. You decide where to look, how much to test, when to push the client, when to accept an explanation, and when something feels wrong even though it technically reconciles.

And this is where the unpleasant truth sits.

Give good, ethical, curious professionals better tools, and they will probably produce better audits. Give the same tools to people who are disengaged, overly commercial, or willing to cut corners, and they will produce very efficient, very well-documented, immaculate audit files, but very poor audits!

Technology does not remove human nature. It amplifies it.

There’s a line often attributed to Plato that good people do not need laws to tell them to act responsibly, while bad people will find a way around the laws. Whether he said it exactly like that or not, the idea holds up remarkably well in auditing. You can write thousands of pages of standards, but a determined person can still find a way to technically comply while missing the point entirely.

I’ve seen audit files that were immaculate and well-documented with every box ticked. Every memo cross-referenced and every conclusion supported by something. And yet, when you stepped back and looked at the whole picture, it didn’t make sense. The business was struggling, but there was no going-concern risk. Margins were collapsing, but revenue was “low risk”. Complex estimates were waved through because management sounded confident in meetings. Nothing was obviously wrong in isolation, but the overall story was wrong.

That kind of failure is not a technology failure or a standards failure. It’s a judgment failure.

This is why I sometimes worry that the profession is focusing too much on what AI can do and not enough on what it might quietly do to auditors themselves, particularly younger ones.

A lot of audit training, whether we admit it or not, happens through slightly painful experience.

You write a risk assessment, and a manager asks why you rated revenue as low risk. You design a test, and a senior tells you it doesn’t actually address the assertion. You conclude too quickly, and a partner asks, “How do you know?” That process, repeated over years, is how judgment is built.

If AI starts drafting the risk assessment, suggesting the procedures, selecting the samples, and even writing the workpapers, then the junior auditor’s role becomes reviewing and editing rather than thinking from scratch. That may make audits faster. It may even make them more consistent.

But we should at least ask what happens to professional judgment if people spend their formative years reviewing a machine’s thinking instead of developing their own.

Judgment is a muscle. If you don’t use it, it weakens.

None of this means AI is a bad thing for auditing. Far from it. Anyone who has devoted evenings manually agreeing invoices to a listing, casting spreadsheets that don’t quite add up, or reformatting client data exports that look as if they were designed to cause emotional distress will know that a lot of audit work is mind-numbing. If technology removes some of that and allows auditors to focus more on irregular transactions, estimates, and areas where things can actually go wrong, that is a genuine improvement.

But we should not pretend that better tools automatically mean better audits. They mean better audits by good auditors. In the hands of poor auditors, they may simply mean faster completion and nicer-looking files.

So when we talk about whether auditing standards need to change because of AI, I think the honest answer is yes, a bit, but not as much as people think. Some standards regarding audit evidence, documentation, and quality management will need to be updated to explain how you document AI-generated work, validate tools, and review outputs. That’s sensible and probably necessary.

But the core principles of auditing, scepticism, sufficient evidence, professional judgment, responsibility for the opinion, those do not change just because the tool is more sophisticated. The standards already assume that auditors use tools. AI is just a more effective tool.

If there is a real risk in all of this, it is not that the standards are outdated. It is that people may start to believe that judgment has somehow been automated, that if the system reports nothing unusual, then nothing unusual exists, and that if the model says the estimate is reasonable, then it must be reasonable.

That is a very dangerous mindset, and it is not a standards problem. It is a human problem.At the end of every audit, after all the testing, meetings, late hours, clearance points, and review notes, someone signs the audit opinion. Not a machine. A person. And what that signature really says is not “AI checked this” or “the file is complete” but “in my professional judgment, this is true and fair.”

That word again. Judgment.

So perhaps the real question is not whether regulators are ready for AI, but whether auditors are ready for a world in which their tools are getting smarter while their responsibility stays exactly the same. Technology will keep changing. It always has. The difficult part of auditing has never been the tools. It has always been the people, their integrity, their courage, and their willingness to ask one more question when something doesn’t feel right.

AI will not fix bad judgment, nor will it replace good judgment. It will intensify both. And that, more than any change to auditing standards, is what will shape the quality of audits over the next decade.