AICPA AI practice aid: Build Your Financial Reporting AI Inventory Before Audit Fieldwork
The AICPA AI practice aid, issued this week, tells auditors to treat a client's use of AI in financial reporting as a risk to assess and a set of controls to test. If your 2026 audit starts in January, inventory every AI touchpoint in your close now, with evidence of human review beside each one.
Why this matters now
On 2026-10-12 the AICPA published Artificial Intelligence (AI) Considerations for Financial Statement Auditors, a nonauthoritative practice aid for auditors who work under AICPA standards. The Journal of Accountancy described it on 2026-10-13 as a document in two parts. Part 1 covers how an organization's use of AI in financial reporting affects the financial statement audit. Part 2 covers the audit firm's own use of AI tools, with attention to quality management, supervision, and professional skepticism. Part 1 is the part that lands on your desk. It walks through what counts as AI rather than ordinary automation, how data quality, accuracy, completeness, relevancy, and diversity affect whether an AI system can be relied on, the new risks that AI introduces (data risks, model risks, hallucinations, explainability, and bias), and the controls that belong around AI in financial reporting. Jennifer Burns, the AICPA's chief auditor, is quoted saying that "the auditor remains responsible for the audit and the audit opinion." The auditor cannot hand that responsibility to your software, so the practical consequence is that they will ask you to show how you supervise it.
The calendar makes this an October task. Most QuickBooks companies that get audited are private companies with a December year end, audited under AICPA standards rather than PCAOB standards. Their auditors plan the engagement and run interim procedures in the fourth quarter, and the request list for year-end fieldwork usually arrives in November or December. This is the first planning season in which engagement teams have a written AICPA framework for the AI question, and many of them will be reading it in the same weeks they plan your audit. Showing up with an inventory and evidence turns an open-ended inquiry into a short meeting.
It also matters because AI is already inside the ledger, whether or not anyone decided to put it there. Intuit's October 2026 QuickBooks Online product update, published 2026-10-06, says QuickBooks Workforce Premium and Elite users can now draft payroll by uploading a CSV or Excel file into Intuit Intelligence, which extracts the data and asks for clarification before it is imported, and that the new Workforce certification trains bookkeepers on AI-powered anomaly detection and Payroll Tax AI. If your payroll provider or bookkeeper uses those features, the wages on your profit and loss passed through a model before a person approved them. The same is true of bank feed categorization suggestions and receipt capture in most cloud accounting stacks.
The coverage so far, including the AICPA's own announcement and the trade press summaries, is written for auditors. It explains what the engagement team should consider. What it does not do is tell a CFO or controller what to prepare, how to tell an AI touchpoint from a rule-based one, which touchpoints matter to the audit and which do not, or what evidence of review actually looks like in a QuickBooks shop. That is the gap this article fills. For the broader framework of source evidence, repeatable calculations, and release authority, see the earlier post on an accounting control framework for AI-assisted reporting. This article is narrower. It is about the audit, and about the next ten weeks.
What the auditor will ask about your AI use
Translate the Part 1 topics into the questions you will hear, and you get a short list.
First, where does AI touch financial reporting at all? The practice aid separates AI from ordinary automation, and the distinction is useful. A bank rule that posts every payment to a named vendor to a fixed account is automation. It does the same thing every time and you can read the rule. A feature that reads a memo line and suggests an account is AI. It can be right for a different reason each time, and you cannot read the rule. The auditor wants the second list, not the first, and most finance teams have never written it down.
Second, what data goes in and how good is it? The aid names quality, accuracy, completeness, relevancy, and diversity. For a bank feed model, the data is your history of past coding. If that history was sloppy for two years before a cleanup, the model learned the sloppy version. For a payroll draft, the data is a spreadsheet someone typed. Garbage in is still garbage out, but the auditor will now ask you to describe the garbage filter.
Third, what new risks come with the tool? The aid lists data risks, model risks, hallucinations, explainability, and bias. In ledger terms: a model trained on bad history (data risk), a model that behaves differently after the vendor updates it (model risk), a drafting tool that invents a reason for a variance that does not exist (hallucination), a suggestion nobody can explain after the fact (explainability), and a tool that systematically codes a class of transactions to the wrong place (bias). Each of these is a plain misstatement risk once you say it in English.
Fourth, what controls sit around each touchpoint? This is where the conversation goes well or badly. A control is not a feature of the software. It is a person who checks something, at a stated frequency, against a stated source, and leaves a trace. If you can name the person, the frequency, the source, and the trace for each AI touchpoint, you have what the auditor needs. If you say the system has a review step, expect a follow-up.
Two scoping notes. The aid is nonauthoritative and the download is members-only, so don't try to audit yourself against it. Ask your engagement partner how their firm's methodology applies it and what they will request. And the aid is for audits under AICPA standards. Public companies audited under PCAOB standards should expect similar questions, but from a different rulebook.
Build the AI inventory in one afternoon
Start with a worked example. A forty-person professional services company closes its books in QuickBooks Online, has a December year end, and expects audit planning calls in November. The controller sits down with the bookkeeper, the payroll manager, and the FP&A lead and asks one question of each process in the close: did a model touch this number before a person approved it? The answer produces five rows.
| Touchpoint | What the model does | Statement effect | Review evidence kept | Owner |
|---|---|---|---|---|
| Bank feed categorization suggestions | Suggests account and class for uncoded transactions | Expense lines on the profit and loss (flow for the period) | Monthly list of accepted suggestions over 1,000 dollars, with reviewer initials and a count of corrections | Controller |
| Payroll draft from spreadsheet upload | Extracts hours and amounts from a file and asks clarifying questions | Wages expense (flow) and payroll liabilities (balance at period end) | Draft register tied to approved timesheets before submission, signed by someone other than the uploader | Payroll manager |
| Receipt and bill capture | Reads vendor, date, and amount from an image | Accounts payable (balance) and expense (flow) | Sample of 25 captured bills per month compared to the image, exceptions logged | AP clerk |
| AI-drafted variance commentary in the board package | Writes explanations for budget versus actual differences | None on the ledger; affects what the board reads | Every number in the text traced to a report line; approver signs the package | CFO |
| Cash forecast model | Projects collections and disbursements | None on the ledger unless used in a going concern or impairment estimate | Assumptions page with a source for each driver, reviewed quarterly | FP&A lead |
Three things about this table. The statement effect column is not decoration. A wrong expense code misstates one period's profit and loss and washes out when the next period is coded correctly. A wrong payroll liability sits on the balance sheet at year end until someone finds it, and the auditor tests year-end balances directly. Rows that touch a balance deserve the stronger review. Second, the fourth row produces no journal entries, but it goes in the inventory anyway, because the board reads it and the auditor reads board minutes. Third, the fifth row is the one people leave out. A cash forecast is management information until the day it supports your going concern assessment or an impairment test. On that day it becomes audit evidence for an accounting estimate, and the auditor will want the assumptions, not just the output.
Once the rows exist, attach the evidence. For each row, collect one month of the review trace described in the fourth column and put it in the audit folder now, in October, while the month is fresh. If a row has no trace, that is a finding you get to fix before the auditor finds it. The fix is usually small: a saved report, a sign-off cell, a monthly email. The point is that the trace exists before fieldwork and not because of it.
Finally, write a one-page narrative that says, in order: the tools in use, the rows in the table, the date the inventory was last updated, and who owns it. This is the document you hand over when the question comes. Keep it in the same folder as your other process narratives so it is refreshed with them each year. If you want to keep the controls light enough to survive a monthly close, the post on audit-ready controls that do not slow the close covers the general case.
Accounting controls for AI-assisted reporting
Source data: the inventory starts from the systems themselves, not from memory. Pull the list of active bank rules and the categorization settings from QuickBooks, the payroll provider's record of which drafts were created by upload, the bill capture tool's log of captured documents, and the settings page of any drafting or forecasting tool that touches the package. Keep screenshots dated in October. Also keep the vendor documentation that describes what each feature does, so the auditor can read the vendor's words rather than yours.
Calculation: for each row, the review is a comparison with a deterministic result. Accepted bank feed suggestions compared to the vendor's invoice or contract. The payroll draft register compared to approved hours multiplied by approved rates, with the difference in a formula cell. Captured bills compared to the image amount. Variance commentary compared to the report line it cites. The calculation is boring on purpose. A reviewer who recomputes the number is a control. A reviewer who reads the number and nods is not.
Review: the reviewer is a different person from the one who accepted the suggestion, uploaded the file, or generated the draft. The reviewer checks that the comparison was done, that exceptions were resolved, and that the statement effect column still describes where the number lands. Debits and credits still have to balance after the model's suggestion is accepted, so the reviewer also confirms that a reclassification moved an amount between two accounts and did not create or destroy one. For balance sheet rows, the reviewer confirms the period-end balance ties to an external document: a payroll tax liability to the provider's filing, a payable to the vendor statement.
Decision: the CFO decides which touchpoints are in the inventory, which rows require a second reviewer, what dollar threshold triggers review of an accepted suggestion, and whether any AI feature is switched off until a review step exists. The CFO also decides what to tell the audit committee or the board about AI in the close, and signs the one-page narrative. That signature is what converts a list into a documented control environment. A control that exists only because the bookkeeper happens to be careful is not a decision anyone made.
Limits and common mistakes
The first mistake is answering that the company does not use AI. In 2026 that is rarely true for a company on cloud accounting software, and an auditor who then finds categorization suggestions in your bank feed will wonder what else you did not know about. Say what you use and how you check it.
The second is treating the practice aid as a rule you must comply with. It is nonauthoritative guidance for auditors. Your auditor's firm methodology and the professional standards govern the engagement. The aid tells you what the auditor is thinking about, which is useful, but it does not create obligations for you.
The third is an inventory with no evidence behind it. A list of tools is an answer to one question. The auditor's next question is how you know the output is right, and the only good answer is a trace of someone checking it.
The fourth is turning features off in December to avoid the topic. A mid-year change in how transactions are coded is itself a change in process that the auditor must understand, and the first eleven months still happened. Keep the feature, add the review, document both.
The fifth is confusing two disclosure questions. The aid notes that AICPA auditing standards do not require the auditor to disclose their own use of AI, though laws, regulations, contracts, or firm policies might. That is about the auditor. Whether you tell your board, your lender, or your investors about AI in your reporting is a separate decision with its own agreements behind it.
Last, this article is about the audit under AICPA standards and about a QuickBooks-sized company. It does not cover PCAOB requirements for public companies, SOC reports from your software vendors, or the design of AI governance beyond the close. The AICPA says more guidance will follow on the assessment of the risk of material misstatement and on audit evidence when a company uses AI, so expect the questions to get more specific next year. Spreadsheet models for close and reporting work, which you can adapt for the inventory above, are in the FinBoard templates library.
Frequently Asked Questions
What is the AICPA AI practice aid?
It is a nonauthoritative document titled Artificial Intelligence (AI) Considerations for Financial Statement Auditors, published by the AICPA in October 2026. Part 1 covers how an organization's use of AI in financial reporting affects the audit, and Part 2 covers how audit firms use AI tools in their own work.
Does the practice aid require my company to do anything?
No. It is guidance for auditors, not a standard for preparers. Its practical effect is that auditors now have a written framework for asking how your company uses AI in financial reporting and what controls sit around it, so preparing an inventory and review evidence makes the audit faster.
What counts as AI rather than ordinary automation in my books?
A rule you can read and that does the same thing every time, such as a bank rule that codes a named vendor to a fixed account, is automation. A feature that interprets data and suggests or drafts an answer, such as categorization suggestions, payroll drafted from an uploaded file, or receipt capture, is AI for this purpose.
Which AI touchpoints matter most to the audit?
Those that change a balance sheet amount at year end, such as payroll liabilities or accounts payable, because the auditor tests year-end balances directly. Expense coding errors matter too but tend to wash out across periods. A forecast matters once it supports a going concern assessment or an impairment estimate.
What evidence of review should I keep for each touchpoint?
A dated trace showing that a person other than the one who ran the tool compared its output to an independent source, such as a payroll draft tied to approved timesheets or a sample of captured bills compared to their images, with exceptions and corrections noted. One month of that trace per touchpoint is a good start.
FinBoard keeps the receipt behind every number. Reports built from your QuickBooks data drill down to the transactions underneath them, reports built with the FinBoard agent retain the conversation that produced them, and every change is logged with who made it and when, so the human review your auditor will ask about is already on record. See how FinBoard works for finance teams.
