AI for Auditors in 2026: PBCs, Tie-Outs and Who Signs

AI can now extract and tie out audit evidence, rank journal entries by risk, draft PBC requests, summarize board minutes and contracts, and write first drafts of memos. It can't form an opinion, apply skepticism or carry the responsibility. The UK's audit regulator says people stay accountable for audit quality, so every output needs a reviewer.

Busy season tends to slip for dull reasons: a provided-by-client (PBC) list half answered, support that doesn't match the schedule, review notes that come back on a Sunday. Below: that work for external, internal and IT auditors, the software aimed at each part, and what the US Public Company Accounting Oversight Board (PCAOB), the UK's Financial Reporting Council (FRC) and the Institute of Internal Auditors (IIA) have said so far.

Where an auditor's week goes

Audit hours go to gathering evidence, testing it and writing down why the conclusion holds. O*NET's task list names examining records, interviewing workers, collecting data to detect deficient controls or fraud, and preparing detailed reports on findings. The Occupational Outlook Handbook separates external auditors, who check that a client's statements are free of material misstatement, from internal auditors, who look for waste, fraud and financial risk, and IT auditors, who review system controls. The lists overlap:

• PBC lists and evidence requests, plus the second and third reminder to the same AP manager.
• Walkthroughs and control narratives: the interview, the notes, the flowchart that has to match what the process owner said.
• Tests of details and tie-outs: invoices, bank confirmations and contracts traced back to a schedule.
• Journal entry testing, and explaining each item the filter pulls.
• Workpaper documentation a reviewer who wasn't in the room can follow.
• Review notes to clear, often across several files at once.
• Findings and management responses, for internal audit especially, then tracking whether the remediation date holds.
• Annual risk assessment and audit planning, usually rebuilt from last year's file.

Audit tasks AI can help with, and the software aimed at them

The audit tools below are specialist platforms, not general chat assistants; the last row is our own product, which covers only your inbox and calendar. DataSnipper, MindBridge, Fieldguide and Optro all ask for a demo and show no price on their main pages, so budget for a sales conversation.

Tying out evidence

Matching a figure on a schedule to the page it came from suits AI well, because a person can check the answer against the source. DataSnipper, built around Excel, advertises extraction from documents such as invoices and tax forms, plus tests of details, tests of controls and walkthrough documentation. DataSnipper says staff review the output and sign off, and that it doesn't train on customer data.

Scoring the whole population

Full-population analysis ranks every entry by risk rather than drawing a sample. MindBridge says it analyzes all of an organization's financial transactions with statistical models, business rules and unsupervised machine learning. Its own blog pitches "100% of transactions" against traditional sampling, which is a coverage claim, not an assurance claim: scoring every entry says nothing about the transaction that was never recorded.

PBC requests and the client back-and-forth

Request lists suit AI because they repeat from year to year and much of the delay is in the follow-up. Fieldguide describes agents that draft client requests, keep evidence and status in a shared portal, tie out workpapers and surface exceptions for practitioners to review. On the internal audit side, Optro, formerly AuditBoard, announced in October 2026 an agent that helps preparers clarify evidence requests and fix gaps before submitting.

Internal audit planning and testing

The same Optro announcement lists Autonomous Testing, extended from SOX to operational audit testing, and risk scoring that recommends starting scores with evidence attached. Treat a suggested score as a draft. It knows your data, not what the CFO said in the hallway about the ERP migration.

Memos, minutes and contracts

In 2024, generative AI in audit mostly meant writing and research. A PCAOB staff report from July 2024 found use at the firms it spoke to focused on administrative and research activities, such as first drafts of memos and internal tools for searching accounting guidance. By March 2026 the FRC was using two examples closer to the audit itself: summarizing board minutes, and reviewing contracts for revenue recognition testing.

Both examples fail quietly. An omitted board resolution leaves no trace in a tidy summary, and a contract tool that misses a side letter looks exactly like one that found nothing to report.

What PCAOB and FRC guidance asks of AI-assisted audits

Existing audit standards still govern AI-assisted work, and the responsibility doesn't move. These four documents are the ones to read first, and none of them is a dedicated AI auditing standard:

• PCAOB technology-assisted analysis amendments. These changes to AS 1105 and AS 2301 apply to audits of fiscal years beginning on or after December 15, 2025. When a test of details identifies items, the investigation should include whether they indicate misstatements or control deficiencies. The release expressly leaves AI to the Board's ongoing research.
• PCAOB QC 1000. The firm-wide quality control standard takes effect December 15, 2026. Accounting Today reported amendments adopted in September 2026, subject to SEC approval, so read the current text before building a firm AI policy around it.
• FRC, June 2025. The FRC's AI in audit guidance gives an example of AI on procedures over journals and covers how to document AI tools. Its review of six of the UK's largest firms, reported by Accountancy Age, found no formal monitoring of what automated tools did to audit quality.
• FRC, March 2026. The generative and agentic AI factsheet names three risks: misused output, deficient output and non-compliant methodology. Its mitigations are system design, certification, staff education and human-in-the-loop review. It binds no US firm, but the FRC describes the guidance as the first from any audit regulator.

Client data, retention, recordings and fabricated citations

Audit files hold unreleased financials, so settle where the data goes before counting time saved. For CPAs in public practice, Interpretation 1.700.040 of the AICPA Code, summarized by the Journal of Accountancy, offers two paths for a third-party provider: a contract keeping the information confidential, with reasonable assurance about its safeguards, or the client's specific consent. The AI for accountants page covers engagement letter wording for firms.

• Retention. For audits under SEC rules, Rule 2-06 requires keeping workpapers, plus memoranda, correspondence and electronic records containing conclusions, opinions, analyses or financial data, for seven years. Ask your firm's risk or legal team whether AI chat logs, prompts and transcripts fall inside that.
• Recording inquiries. A transcribed walkthrough beats scribbled notes, but it also creates a record. Federal law allows recording when one party consents, while California requires every party's agreement when the conversation is confidential. Ask the process owner first, and follow firm policy on what goes in the file.
• Fabricated sources. Deloitte Australia agreed to partly refund a government report in 2025 after a researcher flagged quotes attributed to a federal judge that didn't exist and citations to reports that don't exist. The revised report disclosed generative AI use, though Deloitte didn't say whether AI caused the errors. It wasn't an audit, but open every citation in an AI-drafted memo.

When the AI is what you're auditing

Internal auditors may also be asked for assurance over the company's own AI, which is a different job from using it. The IIA's AI Auditing Framework is free and covers governance, management and the internal audit function, with a quick-start checklist for assessing how an organization approaches, uses, manages and reports on AI.

Start with an inventory, since nobody can audit a model that finance adopted without telling anyone.

What stays with the auditor

Professional skepticism is the part of audit AI can't perform. Firms told PCAOB staff that human involvement remains essential, that whoever uses a generative AI tool still answers for the results and documentation, and that reviewers owe the work the same diligence. The FRC's 2026 announcement says people, meaning firms and responsible individuals, answer for audit quality.

• The opinion and the sign-off. A model has no license to lose and no name on the report.
• Materiality and scope. Deciding what matters on this engagement is judgment; a suggested risk score only informs it.
• Reading a person. The controller who gets vague about a reserve won't show up in a data feed.
• Coaching juniors. If first-years never tie out by hand, someone has to teach them what a wrong tie-out looks like.

Where Merlin fits for auditors, and where it doesn't

Merlin, our own Mac assistant, handles the communication around an engagement, not the engagement itself. It doesn't touch workpapers, test anything, run a PBC portal or act as a system of record, so it won't replace any tool above. It also needs Gmail and Google Calendar, which rules it out for a firm whose mail lives on Microsoft 365.

Where the firm's IT and risk teams approve it, these parts help a senior or manager juggling several clients:

• Who you owe. The Needs you group in the People panel lists a controller or partner whose email written directly to you has sat unanswered for at least two days and up to a month. It reads email only, so a voicemail won't appear.
• Commitments together. The To-do panel holds follow-ups Merlin finds, such as promising a partner the revised memo by Thursday, beside items you type in yourself.
• Prep before the status call. Meeting Brief arrives around 10 minutes ahead of an event, with sourced attendee backgrounds, prior discussions, commitments and agenda ideas.
• Replies you check first. Tell Merlin in chat what to say to the client and a card shows the draft to edit, sending only when you confirm. Routines, jobs Merlin does on a schedule or trigger, skip that card, so keep them away from anything client-facing until you've tested them.
• Recordings. Merlin keeps call audio on your Mac. Getting a transcript labeled by speaker takes a paid plan and uploads that audio to a transcription service, and the transcript is tied to your Merlin account. A confidentiality review needs to know both.

Trying AI on your next engagement

Pick one repeatable procedure on one low-risk engagement, and measure it by the review notes it creates. Document tie-outs are a sensible first choice.

1. Clear it with risk management first. Get the tool's data terms read, and settle whether a contract or client consent covers it.
2. Run it beside the manual work. Have a staff auditor tie out a sample by hand and compare, and count what the tool missed as well as what it found.
3. Decide the exception rules up front. Before a full-population run, write down the threshold, the grouping and who clears what.
4. Write down how you use it. Record the tool, the version, what was reviewed and by whom, so a reviewer or inspector can follow the file.
5. Track audit quality. Count review notes and rework, and report both alongside the hours saved.

If you're comparing recorders for walkthroughs, this comparison of meeting note takers separates bot and botless options.