Accountancy Europe Says Firms Should Be Clear That Using Generative AI Does Not Shift or Dilute Individual Responsibility

Accountancy Europe's paper Generative AI in audit and assurance, dated September 2026, is about auditors who use generative AI, which it shortens to GenAI. It says it is "primarily aimed at SMPs", the small and medium-sized practices, and that it focuses on "practical opportunities, risks and considerations associated with the use of GenAI in audit and assurance engagements." Parts of it follow, not the whole.

Who Answers for the Work

The paper's section on responsibility and accountability asks where responsibility lies "when a tool contributes to an audit conclusion or piece of documentation." It says GenAI "cannot be held accountable in the way an auditor can, and its use does not change who is answerable for the work performed." Responsibility for the conclusions reached, the audit evidence obtained and compliance with professional standards remains with the engagement team and, ultimately, the engagement partner, "regardless of which tools were used to produce a draft or an analysis."

The same section then speaks to firms. They should be clear, including in their internal policies and quality management arrangements, "that using GenAI does not shift or dilute individual responsibility." Auditors need to be able to explain and stand behind any output that GenAI has contributed to. And firms should ensure that sign-off and review procedures "make this line of accountability explicit rather than assumed."

Explicit, not assumed.

Explicit is a word a reviewer can test. What would a firm's own sign-off and review procedures show, on a finished file, about who reviewed what a tool produced?

Convincing but Incorrect

On reliability, the paper says GenAI can generate "convincing but incorrect information," a phenomenon it says is commonly known as a hallucination, and that it may generate different outputs in response to the same or similar inputs and prompts. In an audit and assurance context, it says, this can lead to "inappropriate conclusions, insufficient audit evidence and documentation that does not accurately reflect the work performed."

Where GenAI is used to assist in performing audit procedures, the paper says auditors also need to consider the relevance and reliability of the information the tool uses, and that they "will need to review, understand and take responsibility for any output generated by GenAI." That includes verifying, where relevant, the sources on which the output is based, and whether they are appropriate and sufficiently up to date for the intended purpose. The paper also says outputs generated by GenAI "should be reviewed critically if it is intended to be used as audit evidence and should not replace professional judgement."

AI-generated outputs, it says, "can appear persuasive and authoritative, creating a risk of over-reliance." And professional skepticism, in the paper's words, "remains the core of the auditor's role."

Drafts and Checkpoints

In one of the paper's practical examples, an audit firm has accepted a new client. After a walkthrough of the revenue process, the engagement team uses a GenAI-enabled tool to organize the information collected and generate a first draft of the process documentation and the risk-and-control matrix. "The draft documentation is then reviewed, refined and supplemented by the audit team before being incorporated into the audit file." The paper adds that firms would also need to consider the confidentiality, governance and reliability issues associated with the use of public or general GenAI tools.

For agentic AI systems, which it describes as capable of carrying out multi-step tasks, the paper gives the example of an agentic tool embedded in an audit platform that "might be given a defined task," such as circularizing bank confirmations, matching the responses received against the general ledger and flagging exceptions. Rather than responding to a single prompt, the agent plans and carries out the individual steps itself, and presents its results, together with any exceptions, "to the auditor for review at defined checkpoints."

Review at defined checkpoints.

The auditor, the paper says, "remains responsible for evaluating the results, resolving exceptions and forming conclusions."