The Intelligent Audit

Artificial intelligence (AI) is a key contributor to recent technological innovations, including autopiloted cars. Although AI application is still under development for cars, it is already implemented, operating and has room for expansion in financial audits.

A financial audit requires time-consuming, labor-intensive research into an enterprise and its financial statements. The audit goal is to collect evidence that allows the auditor to form an opinion on whether the financial statements properly represent the enterprise in all material respects. Using AI technologies in the audit process improves, but does not replace, the audit profession. AI enhances audits by increasing efficiency, effectiveness and accuracy. Accounting and audit professionals should strive to research and become thought leaders on the future of their professions and relay that expert knowledge to senior leadership. These professionals have a role in ensuring that their organizations are innovators and adopters of AI to provide the best services possible to clients.

Applying AI Technology to Tools

Computer scientist John McCarthy conceived the term “artificial intelligence” in 1955. He believed “every aspect of learning or any other feature of intelligence can be, in principle, so precisely described that a machine can be made to simulate it.”¹ Although AI has been studied for decades, only recently has the technology behind AI prospered into usable tools.

The backbone of AI is training computers, with the use of large data sources, to recognize patterns and accomplish desired computational and relational tasks.² The human aspect of AI is in this training; human inquiry, guidance and observation are needed for an AI system to operate successfully.

Machine learning (ML) and natural language processing (NLP) are types of AI. ML is “born from pattern recognition and the theory that computers can learn without being programmed to perform specific tasks.”³ ML is computers learning from data. Given this technology, machines can infinitely and independently adapt to produce consistent decisions and reliable results by identifying patterns and make classifications or predictions based on these patterns. Common uses of ML in everyday life are recommendations for other purchases that display during online shopping, social media showing not every post of friends but only those that it determines are of interest to the account holder, and self-driving cars.

NLP is

...a branch of artificial intelligence that helps computers understand, interpret and manipulate human language…to fill the gap between human communication and computer understanding.⁴

NLP improved tremendously over the past decade and enables computers to read, hear and interpret speech extremely quickly, consistently and without bias, especially compared to humans. Predictive and autocomplete typing via text or search engine; spell check; virtual assistants such as Amazon Alexa, Apple Siri and Windows Cortana; voicemail speech-to-text; and automatic translations are just some examples of NLP in daily life.

ML and NLP can also be applied to accounting and financial auditing.

AI’s Impact on Financial Audits

The financial audit process has been relatively stagnant and has not seen many revolutionary developments since the implementation of the US Sarbanes Oxley Act of 2002.⁵ The implementation of computer assistance vs. paper and pencil changed the form in which work is completed, but the historical nature remains the same. The financial audit is in a mature stage and has become sluggish and lacking in margins and innovation. Through the power of technology, the audit can develop far past the ticking and tying on which it is focused today, and deeper into the world of analysis and information processing.⁶

The technologies that power AI to be effective, efficient and applicable in the professional service field are coming of age and are ready for implementation. AI not only has the power to change an audit, but also has the capabilities to completely transform the process, especially in the planning of the audit, evaluation of internal controls and performance of substantive procedures.

The steps and outcomes of an audit remain the same, whether it is a traditional or an AI-assisted audit. However, the way in which tasks are completed is where the true impact of AI can be seen. Figure 1 compares audit procedures with and without the use of AI technologies. Although some parts of the process can be automated, the process still requires human involvement and judgment to reach a conclusion.

Planning Phase—Auditor and AI Computer Comparison
The audit begins with a planning phase, during which an auditor gains an understanding of the client’s industry and enterprise; performs a risk assessment; and determines the nature, extent and timing of procedures based on their reliance on internal controls. In a traditional audit, these tasks are accomplished by an auditor physically examining the industry and enterprise, holding discussions with management and manually taking notes, reviewing minutes from board of director (BoD) meetings, using judgment to evaluate risk of the environment and inherent risk that specific financial statement line items and significant classes of transactions carry, and, ultimately, determining how much reliance can be placed on internal controls.⁷ The traditional steps depend on the professional judgment and skepticism of the auditor. AI can automate these procedures and remove a level of uncertainty.

In an AI-assisted audit, the goals of the planning phase are the same as those of a traditional audit. AI can collect and analyze client and industry data, such as organizational structure (by analyzing organization charts or the details within a human resources information system), operational methods, and accounting and financial systems, from automatically gathered public data on the Internet, previous US Securities and Exchange Commission (SEC) filings, and client-provided documents that feed into the AI system through either connected sources or manual (human) collection and upload. AI can automatically produce a risk assessment report based on prior-year workpapers and the business environment and industry trends for the auditor to evaluate. NLP, paired with voice recognition, can record, summarize and produce minutes of meetings held with the client. Using ML, an intelligent device can evaluate the business understanding, risk assessment and prior audit information to propose a level of reliance that can be placed on internal controls.⁸ The AI machine outputs a level of reliance that is based on the data provided to the machine. Data intended to be used by AI systems should be complete and accurate so that the output is reliable.

The auditor uses the proposed reliance level, personal knowledge and judgment to set the control risk for the audit and plan the nature, extent and timing of procedures. In general, the AI tools used in the planning phase of an audit have a moderate impact on the way in which tasks of this phase are completed. Some tasks are automated, especially in the background research area, but the overall goals of this phase are rather judgment-based and cannot be highly impacted by the implementation of AI. This phase uses rather complex tools that are not yet fully perfected but are on their way. With an understanding of the business environment, assessed level of control risk and audit plan complete, evaluation and testing can begin.

Evaluation of Internal Controls Phase—Auditor and AI Computer Comparison
In the next audit phase, evaluating internal controls, the goal is to gain a deeper understanding of the client’s internal control system and evaluate the implementation and operation of these controls to assess their reliability. In a traditional audit, this process often includes reviewing internal control policies and procedures and interviewing those in charge of major processes, such as sales administration, accounting and finance, about sales processes to gain an understanding of the internal controls in place and the overall enterprise processes.⁹ Details from these interviews are manually recorded and posted to workpapers. After the interviews, the auditor conducts an operational test that typically includes observing employees performing their duties, reperforming processes and inspecting documents. These processes are relatively black and white—either the control performs as intended or it does not—meaning that this is an area that can be highly influenced by automation.

A primary consideration when evaluating the effectiveness of internal controls over financial reporting is an accurate understanding of the various business processes. AI can help reduce the effort and improve the accuracy of business process documentation. One of the AI tools that can help to improve and, in some cases, automate this documentation is process mining.

Process mining offers objective, fact-based insights, derived from actual event logs, that help you audit, analyze, and improve your existing business processes by answering both compliance-related and performance-related questions.¹⁰

Using the data that already reside in the system, process mining derives insights about business processes and automates the creation of business process documentation. Also, an auditor who is evaluating the internal controls environment can use AI voice recognition and NLP to autogenerate workpapers from interviews conducted. ML can be leveraged to inspect documents and determine if the appropriate approvals have been received as part of control testing. The AI tools that can be used in this phase can have a large impact on the audit by automating many time-consuming, routine processes.¹¹ A more robust evaluation of internal controls and a stronger understanding of business processes lead to more efficient and effective substantive testing and overall audit results.

Substantive Procedures Phase—Auditor and AI Computer Comparison
The third major phase of an audit is substantive procedures, which test the details (classes of transactions, account balances and disclosures) and analytical procedures to detect material misstatements. The amount of substantive procedures performed is directly related to the assessed level of audit risk, which is composed of control risk, inherent risk and detection risk. Traditional audits include many substantive procedures, such as:

• Manually observing the reconciliation of a sample of the warehouse physical inventory to inventory that is recorded on the books
• Sending confirmation letters to the client’s customers to confirm balances and investigate discrepancies
• Inspecting supporting documents of sales orders and cash receipts
• Reviewing journal entries that fit circumstances that could reflect fraud
• Analytically comparing the auditor’s estimates and industry averages for sales and other metrics to actual enterprise performance

These procedures can be completely overhauled by the implementation of AI, and this transformation has already begun. Digital applications, bar codes and drones assist with inventory observation and reconciliation. Online platforms manage confirmation requests between auditors and customers and use high levels of encryption technology.¹² ML and NLP technologies are able to inspect documentation of sales orders and cash receipts and automatically reconcile discrepancies. ML can identify the conditions under which journal entries may be fictitious, such as abnormally large amounts, unused accounts and end-of-year adjustments, and it can flag suspicious transactions with unusual patterns. ML can also impact audit analytical procedures by analyzing market trends and competitor movements to estimate sales.

The AI technologies related to substantive procedures are the most mature technologies in the audit process. The ability of AI to continuously analyze 100 percent of the data instead of samples provides a much more accurate opinion.¹³ Use of AI for analytics has been limited due to the complexity of client environments. Many client enterprises use more than one enterprise resource planning (ERP) system, including legacy systems with disparate database schemas. Depending on the situation, this challenge can be addressed with automated tasks, such as process mining, or with a structured approach, such as extract-transform-load (ETL), to consolidate disparate data. “ETL is a type of data integration that refers to the three steps (extract, transform, load) used to blend data from multiple sources.”¹⁴ This approach can be used by audit professionals in a mixed-technology environment. By transforming the data into a common data model and utilizing a stand-alone database (note: these can be owned by the client or audit firm depending on data privacy preferences), the auditor can use AI to perform functions otherwise unavailable in legacy systems. This makes it possible to gain the same level of insight across the system, as in a ready-to-use ERP, such as SAP.

Closing Procedures—Auditor and AI Computer Comparison
After the tests of controls and details and the analytical procedures, it is time to form an opinion on the client’s financial statements and issue an audit opinion. These closing procedures include aggregating audit findings and issues, manually evaluating the potential impacts, and forming a categorical opinion (clean, qualified/modified, adverse or disclaimer). With the assistance of AI, a score can be calculated based on the client’s risk of material misstatement, the number of errors found and their effect, and automatically evaluate audit risk.¹⁵ This could take an opinion from a category to a continuous numerically graded range, therefore removing some of the ambiguity to which a categorical opinion could lead. The overall audit opinion is still based on professional judgment, but with the help of AI, the opinion is much better supported by facts and figures.

After an opinion is formed, the audit report is compiled. Traditionally, this step is completed using the audit standard format. NLP can automatically create a draft of the audit report from the known final opinion, audit procedures, risk of material misstatements and results.

Audit enterprises need to carefully consider the AI tools to use in their processes. Some AI tools require installation in the client environment; other AI tools reside in the cloud and process and store sensitive data as described previously. These considerations can be addressed through a vendor management process, which ensures that the AI software meets certain accepted standards, such as Service Organization Control (SOC) 2, which includes trust services principles related to security, confidentiality and privacy. Additional attestations and certifications are available, such as the International Organization for Standardization’s (ISO) ISO 27001 certifications. Like for any other tool an auditor chooses to use, due care should be exercised to ensure that AI is not introducing any risk to the client’s system, security, confidentiality or privacy.

Many auditing enterprises, from the Big Four to regional and local, are implementing AI in their audits. These enterprises have either developed their own AI software or partnered with enterprises that specialize in AI, such as IBM Watson. Generally, audit enterprises begin using AI tools for managing confirmations and requests, analyzing contracts, simplifying the inventory process, and journal entry analysis.¹⁶ Although the larger audit enterprises have the capital to support AI development that smaller enterprises may not have, vendors, such as Mindbridge AI, have developed affordable off-the-shelf software solutions that may be more viable for audit enterprises that want to begin using AI, but do not have the means or desire to develop or fully customize it.

AI’s impact can also vary depending on the type of industry or enterprise. AI is not a one-size-fits-all type of tool, but, rather, a diverse technology that can be adapted to unique environments. Industries that are heavily automated and use AI such as manufacturing and healthcare are much more able to employ the full power of an intelligent audit. Industries that lack automation cannot experience the same benefits from an intelligent audit due to the difficulty in transferring their manual processes into workable data.

Will AI Replace the Auditor?

After reading and analyzing how AI technologies can be used throughout the audit process, some auditors may worry that they will be replaced by these technologies. Properly programmed AI tools can process massive quantities of data at lightning speed and quickly identify anomalies—all with a high rate of accuracy. However, AI is not yet capable of replacing “the judgment, skepticism or experience that humans bring to their work.”¹⁷ This statement shows that, with all the power that AI holds, it is still not enough to fully replace thinking humans and the story they can tell about the data.

With AI assisting in analytics and testing, auditors have more time available to investigate the reasons behind patterns and anomalies found by AI.¹⁸ AI can perform many tedious tasks and free the auditor to act as more of an advisor and perform more review and judgment, thereby improving the overall quality and confidence in the audit while simultaneously reducing risk. To prepare for the deep implementation of AI, auditors need to remain relevant and competitive. An auditor “...will need to be tech-savvy, a strategic thinker and strong communicator.”¹⁹ Even with AI, there will be a continued need for deep knowledge and expertise in traditional audit areas, but auditors also need to adapt to their changing environment. For students hoping to enter this field, it is recommended that they add a focus in technology and analytics on top of their accounting foundation to become an ideal candidate. For existing professionals, continuing education to gain comfort with and understanding of emerging technologies, while expanding critical thinking and analytic skills will help them remain competitive. The auditing field is rapidly changing due to advancements in AI. Therefore, the workforce needs to adapt to fit demands.

Endnotes

¹ Childs, M.; “John McCarthy: Computer Scientist Known as the Father of AI,” The Independent, 1 November 2011, www.independent.co.uk/news/obituaries/john-mccarthy-computer-scientist-known-as-the-father-of-ai-6255307.html
² SAS, “Artificial Intelligence: What It Is and Why It Matters,” SAS Institute Inc., 2019, www.sas.com/en_us/insights/analytics/what-is-artificial-intelligence.html
³ SAS, “Machine Learning: What It Is and Why It Matters,” SAS Institute Inc., 2019, www.sas.com/en_us/insights/analytics/machine-learning.html
⁴ SAS, “What Is Natural Language Processing?” SAS Institute Inc., 2019, www.sas.com/en_us/insights/analytics/what-is-natural-language-processing-nlp.html
⁵ Congress.gov, “H.R. 3763 - Sarbanes-Oxley Act of 2002,” USA, www.congress.gov/bill/107th-congress/house-bill/3763
⁶ Crosley, G.; A. Anderson; “The Audit of the Future: Daring, Disruptive and Data-Driven But Poised to Add Significant Value to Firms and Clients,” Crosley Company, 6 March 2018
⁷ Issa, H.; T. Sun; M. A. Vasarhelyi; “Research Ideas for Artificial Intelligence in Auditing: The Formalization of Audit and Workforce Supplementation,” Journal of Emerging Technologies in Accounting, Fall 2016, vol. 13, no. 2, p. 1-20, https://aaajournals.org/doi/10.2308/jeta-10511
⁸ PricewaterhouseCoopers Japan; “Audit Transformation: How Will AI Change the Audit,” Research & Reports, March 2018, www.pwc.com/jp/en/knowledge/thoughtleadership.html
⁹ Op cit Issa
¹⁰ Celonis, “What Is Process Mining?” https://www.celonis.com/process-mining/what-is-process-mining/#
¹¹ Op cit PricewaterhouseCoopers Japan
¹² Ibid.
¹³ Brennan, B.; M. Baccala; M. Flynn; “Artificial Intelligence Comes to Financial Statement Audits,” CFO, 2 February 2017, www.cfo.com/auditing/2017/02/artificial-intelligence-audits/
¹⁴ SAS, “ETL: What It Is and Why It Matters,” SAS Institute Inc., www.sas.com/en_us/insights/data-management/what-is-etl.html
¹⁵ Op cit Issa
¹⁶ Faggella, D.; “AI in the Accounting Big Four—Comparing Deloitte, PwC, KPMG, and EY,” Emerj, 17 May 2019, https://emerj.com/ai-sector-overviews/ai-in-the-accounting-big-four-comparing-deloitte-pwc-kpmg-and-ey/
¹⁷ Boillet, J.; “How AI Will Enable Us to Work Smarter, Faster,” EY, 7 June 2017, www.ey.com/en_gl/assurance/how-ai-will-enable-us-to-work-smarter-faster
¹⁸ Op cit Brennan
¹⁹ Guthrie, R.; “Preparing Tomorrow’s Auditors For The Future Of Tech-Driven Accounting,” Forbes, 30 August 2017, www.forbes.com/sites/forbesfinancecouncil/2017/08/30/preparing-tomorrows-auditors-for-the-future-of-tech-driven-accounting/#1bbd8faa1c27