AI in Auditing and the CPA Exam: What the AICPA Practice Aid Means for You

If you are studying for the CPA Exam right now, you have probably felt a flicker of exam-day anxiety every time artificial intelligence comes up in class, on social media, or in a job interview. If you are already a licensed CPA working in audit, you have likely felt a different version of that same worry. Are you keeping pace with how AI is changing the way financial statements get audited? The accounting profession’s standard-setting body has already stepped in to guide auditors through this shift, and understanding that guidance will make you more confident, not more anxious, about AI on exam day and in practice. 

AI shows up on your CPA Exam the same way it shows up in practice—as a factor that changes how you gather, evaluate, and respond to information, not as a brand-new subject you have to learn from scratch. The current AICPA CPA Exam BlueprintsOpens in new window build on long-tested audit fundamentals, such as internal control evaluation, risk assessment, evidence sufficiency, and frame technology, including AI, as a lens on those same fundamentals. In your career, this means AI is less a separate topic to master and more a new variable layered onto skills you are already building—professional skepticism, evidence evaluation, and sound audit judgment. 

That framing matters because it removes a lot of the questions around “new content.” You are not starting over. You are applying familiar audit concepts to a newer kind of technology that both your future clients and your future audit teams are already using. 

The AICPA practice aid, titled “Artificial Intelligence (AI) Considerations for Financial Statement AuditorsOpens in new window,” provides nonauthoritative guidance for two distinct situations— when an entity uses AI in its financial reporting process or controls, and when the auditor uses AI to perform the audit itself. The practice aid is organized into two sections. Section 1, “Considering Entity Use of AI Within an Audit of Financial Statements,” reflects the views of the AICPA Assurance Services Executive Committee’s Artificial Intelligence Working Group and AICPA staff; it has not been approved or disapproved by the AICPA Auditing Standards Board (ASB). Section 2, “Auditor Use of AI in an Audit of Financial Statements,” has been reviewed by AICPA Audit and Attest Standards staff and is presumed appropriate, though it also has not been acted on by a senior AICPA technical committee. 

Section 1 walks through foundational AI concepts, the AI life cycle (data, modeling, validation and deployment, and monitoring), client acceptance and continuance considerations, understanding the entity, its environment, and its system of internal control, identifying and assessing risks of material misstatement, performing audit procedures in response to those risks, and evaluating the sufficiency and appropriateness of audit evidence. Section 2 takes the form of frequently asked questions covering firm-level quality management, engagement team competence, planning to use an AI tool to obtain evidence, engagement partner direction and review responsibilities, and engagement letter language when AI is used in an audit. 

Importantly, the practice aid defines itself as an “other auditing publication” under AU-C section 200, meaning it can help auditors understand and apply generally accepted auditing standards (GAAS), but it does not carry authoritative status on its own. Auditors are expected to use professional judgment to assess how relevant and appropriate its guidance is to their specific engagement. 

AI affects audit evidence by changing how financial data and reports are generated, which means auditors may need new ways of applying existing standards to judge whether that evidence is sufficient and appropriate. The practice aid notes that AI can execute tasks that mimic human perception and cognition, such as reading and interpreting text or images, analyzing queries, and generating structured content like reports or summaries. When an entity uses AI to produce financial information, that output can feed directly into financial reporting, flow into other calculations, or support the execution of a control. 

This evolving nature of evidence does not lower the bar for sufficiency and appropriateness—it raises new questions about where the data came from, how the AI model was built and validated, and whether its outputs can be corroborated. The practice aid devotes an entire chapter to evaluating the sufficiency and appropriateness of audit evidence specifically because AI-generated information needs this closer look before an auditor can rely on it. 

AI changes risk assessment and internal control evaluation by introducing new ways that misstatements can occur and new points within a process where controls need to operate effectively. The practice aid explains that AI-enabled business processes and controls affecting financial reporting can fundamentally alter the risk landscape tied to internal control, books and records, and financial reporting generally. 

To respond, the practice aid guides auditors through updating their understanding of the entity’s system of internal control, specifically the control environment, the entity’s own risk assessment process, monitoring activities, the information system and communication, and control activities, all viewed through the lens of how AI is embedded in them.  

No, AI does not replace auditor judgment, and this is one of the most common misconceptions candidates and even some practitioners carry into their study of this topic. Despite AI’s ability to perform human-like tasks, AI does not possess human accountability. Responsibility for evaluating and relying on AI-generated outputs remains with the people on the audit, not with the technology itself. 

In other words, AI can help generate information, flag patterns, or accelerate certain procedures, but it cannot exercise the professional skepticism, direction, supervision, and review responsibilities that belong to the auditor and the engagement partner. The practice aid’s Section 2 FAQs specifically address matters an engagement partner should consider when determining appropriate direction, supervision, and review procedures when an AI tool is used in the audit, reinforcing that human judgment stays firmly in the loop at every stage. 

AI-related concepts appear on the CPA Exam primarily through how technology affects audit evidence, risk assessment, and internal controls, and the current AICPA CPA Exam Blueprints place that content in two different places depending on the lens being tested. The AUD core section, which every CPA Exam candidate must pass, tests your ability to apply audit concepts, including how technology and automated tools affect the planning and performance of an audit, the evaluation of internal controls, and the sufficiency and appropriateness of evidence. The BAR discipline section tests data analytics and technology-enabled business reporting within a broader business analysis context. AI’s role in the control environment may also be tested in the ISC discipline section. 

The distinction matters because AUD asks you to apply audit judgment when technology, including AI, is part of the entity’s environment or the audit itself, while BAR asks you to analyze data and reporting from a broader business and technical perspective. Candidates sometimes assume AI is tested as a standalone, heavily technical topic. In reality, the current AICPA Blueprints weave it into existing audit and business analysis skills you are already building section by section. 

You can prepare for AI-related audit concepts with confidence by treating them as an extension of core audit skills, not a separate subject requiring separate study time. Focus on strengthening your understanding of how risk assessment, internal control evaluation, and evidence of sufficiency work in general, since those fundamentals are exactly what AI-related scenarios test on exam day. 

AI-related concepts are tested indirectly, through questions about how technology affects audit evidence, risk assessment, and internal controls, rather than as a standalone topic with its own exam section. The current AICPA CPA Exam Blueprints embed this content within the AUD core section, the BAR discipline section, and may include the ISC discipline section, so your preparation should focus on strong audit and data analytics fundamentals first. 

Yes. The AICPA published the practice aid “Artificial Intelligence (AI) Considerations for Financial Statement Auditors” to provide nonauthoritative guidance on AI’s effect on financial statement audits. It addresses both an entity’s use of AI in financial reporting and controls, and an auditor’s use of AI to perform the audit, though it supplements rather than replaces existing generally accepted auditing standards (GAAS). 

Not according to current AICPA guidance. The practice aid states plainly that AI does not possess human accountability, meaning responsibility for evaluating and relying on AI-generated outputs stays with the auditor. AI can support tasks like data analysis and document review, but professional judgment, skepticism, and engagement oversight remain human responsibilities under auditing standards. 

AI changes risk assessment by introducing new points in a client’s processes and controls where misstatements could occur, particularly where AI tools feed directly into financial reporting or related controls. The practice aid guides auditors to update their understanding of the entity’s control environment, risk assessment process, monitoring activities, and information systems specifically to account for how AI is embedded in them. 

If you want a clearer picture of exactly where these concepts fit into your study plan, check out a free demo of the Gleim CPA Review System and see how our realistic exam emulation can help you walk into the AUD core section, the BAR section, and the ISC section ready for whatever the current AICPA Blueprints ask of you.