ACRA's guidance on AI in audits, in plain English.

The guidance is for auditors and audit firms. It covers two situations: using AI to support audit procedures, and auditing information that a client prepared with the help of AI. ACRA frames it as practical considerations, not an exhaustive list, and recognises that firms adopt AI to different extents.

ACRA encourages auditors and firms to refer to it. In our reading, its points rest on duties that already apply, such as the ACRA Code of Professional Conduct and Ethics and the Singapore Standards on Auditing, so it should be read alongside them rather than as a separate rulebook. ACRA notes that AI use among accounting entities in Singapore rose from 6% in 2023 to 11% in 2024, and that agentic AI may be able to take on more multi-step work.

Using AI does not reduce an auditor's duty of honesty. AI should not be used to misrepresent the work done, to fabricate or alter information, or to pick the AI outputs that suit a conclusion already reached. Where AI was used, the file should represent accurately what was done and why the conclusion was reached. ACRA points out that integrity concerns can arise outside an engagement too.

In practice: record where AI was used, and never let an AI output stand in for work that was not done.

AI does not replace judgement. Its outputs deserve the same rigour as any other evidence or information, because they can be wrong in ways that are hard to spot: invented references, bias and misread context. ACRA also warns about automation bias, the tendency to accept what a system produces.

The guidance distinguishes two kinds of use:

• Work involving judgement, such as risk assessment or drafting audit documentation: where appropriate, check the output against the underlying sources and assess whether the conclusion is reasonable.
• Process-driven tasks that follow set steps, such as extracting data from documents or matching records to support: consider whether the output is complete and accurate.

In practice: review AI-prepared work as you would a junior's, and be able to say why you accepted it.

Responsibility does not move to the tool. Whatever part AI played, the auditor remains answerable for the audit work, what it concludes and the opinion issued. ACRA compares this with SSA 620 on using an auditor's expert: drawing on help does not lessen the auditor's responsibility for the opinion.

In practice: make clear who reviews each part of AI-assisted work and who is accountable for the final report, and review before anything is issued.

AI should not obscure how the work was done. A reader of the file should be able to follow how each AI output was checked, where the auditor exercised judgement, and what evidence supports the conclusion. ACRA suggests that the record may, where it helps, cover the prompts, the main assumptions, material edits made on review and the reasons an AI suggestion was taken up or set aside, and any limitation where an output could not be fully verified. Firms are expected to have policies on documenting, reviewing and overseeing AI-assisted work.

Transparency can extend to those charged with governance: auditors should be able to explain how AI was used, the safeguards and the judgement applied. ACRA links this to its Audit Quality Indicators framework.

In practice: ask whether an experienced auditor reading the file could see how AI was used and how its outputs were tested.

Confidentiality is a fundamental principle, and AI tools may process the client's financial, commercial and personal information. Auditors should understand how a tool processes, stores, retains and shares data, including whether inputs may be used to train its model. Where that is uncertain, they should not enter confidential or client-identifiable information. Only tools approved under the firm's governance and security requirements should be used.

Firms are expected to set policies on which tools may be used, what information may go into them and the safeguards against leakage, with controls proportionate to each tool's risks rather than one rule for all.

In practice: keep a list of approved tools, and know each one's data handling before client data goes in.

These are Nebis's suggestions for putting the guidance into practice. The last one goes beyond it.

1. Write down which AI tools the firm approves, and what information may be entered into each.
2. Find out how each approved tool stores, retains and uses data, including whether it trains on inputs.
3. Set a review rule: AI-prepared work is reviewed with the same scepticism as any other preparer's.
4. Decide what the file records when AI is used: where it was used, how outputs were checked, and why they were accepted.
5. Make sure the person who signs knows which parts of the file AI prepared.
6. Be ready to explain the firm's use of AI to those charged with governance.
7. Treat AI as a technological resource within your system of quality management under SSQM 1, with the risks and responses that follow.

Nebis is built on the same principle: AI prepares and the firm's people review and sign. Each drafted answer carries its reasoning and the evidence it relies on. Going concern, modified opinion and significant-risk conclusions get a second check by a different AI model before review. Anything changed after sign-off is flagged. Client data is not used to train AI models, and each AI model is approved for a task only after passing its tests.

How it works · Security and data · The audit workspace