Such That Another Professional Can Understand: Australia's Auditing Standard Setter on AI Audit Tools, July 2025

In July 2025, Australia's Auditing and Assurance Standards Board, the AUASB, issued a web page called Impact of AI on Auditors. It sets out "some considerations for auditors" in three settings: when they use AI tools on audit engagements, when the entity under audit uses AI in producing information that is, or could be, material to the reports under audit, and when AI is used to improve communication in documents. One setting is left out by name. The page "does not deal with the use of AI in an audit firm's internal quality management processes."

Its standing is set out in a note headed "Important note." The page "is not an authoritative publication of the AUASB," it "does not establish new principles or amend existing standards," and it "may be updated or replaced with regard to any future IAASB guidance," guidance it says may be developed as part of the technology project of the International Auditing and Assurance Standards Board. Its considerations are for applying the AUASB's standards. Parts of it follow, not the whole.

The Tool and the Standard

The page cites subparagraph 32(f) of ASQM 1, the standard on quality management for firms that perform audits, reviews and other assurance work. That subparagraph, the page says, "requires any AI audit tools obtained or developed for use in performing audits to be appropriate and to be appropriately implemented, maintained, and used."

In the page, an AI audit tool includes automated software tools that extract information from unstructured sources, identify patterns or anomalies in information, or make "judgements" or "recommendations" based on an analysis of information "for consideration by the auditor." Such a tool "uses criteria that may be changed by the tool based on information available, identification of patterns and relationships, by drawing on analysis used by similar applications and/or analysis of past exceptions identified." The tool may change its own criteria.

AI audit tools can make an audit more effective and more efficient, it says, but they "must be used appropriately, or audit quality may be compromised." They may be what it calls "black-box" systems, where "It may be challenging or impracticable to understand how the tool is arriving at its conclusions or outputs." Firms, it adds, "also need to consider and manage data privacy and data security risks, as much of the data that auditors use is proprietary data of the audited entity."

What Auditors Are Asked to Weigh

Tools "should be reviewed, assessed and approved for use at firm level, whether developed internally or externally," and firm tools "should be reviewed and approved for specific uses on each engagement." Partners and staff who use them "should be properly trained to understand and use such tools appropriately and effectively, including knowing their limitations," and avoiding what the page calls automation bias.

The considerations on inputs "may include" what data the tool uses "and what relevant data is not being taken into account," whether the data is sufficiently current, biases in data sources that could affect the results, whether "the data used is reliable and independent," and whether assumptions "are reasonable and supportable." AI can create challenges that go beyond black boxes, the page says, "because the logic used can change and code reviews and reperformance may not be possible."

Outputs should be test checked for accuracy, and auditors "should maintain professional scepticism and critically evaluate outputs, including considering the possibility of bias in the results and AI hallucination." The page explains hallucination as a tool that "generates inaccurate or misleading information as factual." The design, use, results and conclusions, it says, "should be reviewed by the audit partner and firm specialists." And the page says it flat: "AI tools are not a substitute for human judgement."

A Record Another Professional Can Understand

To enable the review of its logic, the page says, the tool should produce what it calls an audit trail, "showing the data used and the logic applied to that data." Where "the data used and logic applied by the AI tool cannot be explained," it warns, "The auditor may be unable to challenge information and judgements underlying the entity's financial/sustainability report."

The consideration on documentation describes a record "Such that another professional can understand the matters outlined above, including the design and use of the tool, the specific data and assumptions used, the logic applied, outputs and the basis for any conclusions reached by the auditor." The reader it has in mind is another professional.

The measure the page offers is a person, not a tool: another professional who opens the file and can follow the data, the logic and the basis for the conclusion. Where a tool's logic can change, as the page says it can, a file that holds only the tool's output gives that reader no logic to follow.

When the Entity Under Audit Uses AI

The page also looks at the use of AI by the entity under audit. "Auditors must consider the risk that technology poses to entities as part of the auditor's risk assessment process." Where an entity relies on AI applications in processes that produce or support material information or judgments, the page says auditors need to understand those applications, and identify and assess the risks, in deciding the nature and extent of the audit work. Its considerations on understanding the business, and on inputs, processes and outputs, it says, "are similarly relevant in gaining sufficient appropriate audit evidence on the completeness and accuracy of information produced by the audited entity's AI applications."

Auditors "should also be alert to the possibility of AI being used to fabricate documents that purport to be from third parties and support information in financial and sustainability reports," and "may need to place greater reliance on independent third-party data sources," such as direct confirmations, "to validate evidence authenticity."

There may be further challenges, the page says, where the information comes from a third party's proprietary AI applications. If there are restrictions on the auditor accessing "the logic, data and assumptions used, there may be a limitation on scope if suitable alternative procedures are not possible."