When a Tool Is the Primary Source of Audit Evidence: Canada's Audit Regulator on Technology in Audits, October 2025

In October 2025, the Canadian Public Accountability Board, CPAB, which describes itself as "Canada's independent, public company audit firm regulator," published its Audit Quality Insights Report on its 2025 interim inspections results. It sets out initial observations from its 2025 work as of September 30, 2025, for the most part at the country's four largest audit firms, and it is written for audit firms, audit committees and the general public. Its preliminary findings on the use of technology in audits, it says, "are of heightened importance as more sophisticated technology and AI-enabled tools are increasingly adopted." Parts of the report follow, not the whole.

CPAB chooses files and audit areas by risk, a method that "is not designed to select a representative sample of a firm's audit work." Its inspections do not look at every aspect of every file, and results "should not be extrapolated across a firm's entire audit portfolio but instead viewed as an indication of how firms address their most challenging audit situations." As of September 30, it had inspected 59 of the 62 files planned at the four largest firms, and found significant inspection findings in nine of them.

Technology Used in Audits

CPAB observed an increase in the use of more sophisticated technology-assisted audit tools to evaluate large datasets and to identify transactions that represent higher risk or are outliers in a population. The tools its inspectors encountered "typically analyze the company's recorded transactions for specific accounts using a pre-determined set of criteria or algorithms." One of the most common criteria, it says, is an unusual account combination, such as a revenue transaction that does not have cash or accounts receivable as the corresponding account.

The report lists examples of deficiencies it identified "when the use of a technology-assisted audit tool provided the primary source of audit evidence." In the first, procedures to test the completeness and accuracy of the amounts recorded "were limited to the transactions that were identified as higher risk or outliers by the tool." In one instance, the report says, that resulted in approximately 98% of the revenue reported in the company's financial statements not being subject to further audit procedures.

In the second, significant reliance was placed on cash receipts as evidence that the revenue recognition criteria had been met. As the relationship between cash receipt and the satisfaction of the performance obligations decreases, for example when payment is received in advance of product shipment or when revenue is recognized over time, there is, in the report's words, "an increased need to consider what other audit procedures may be necessary to respond to the risk that revenue is materially misstated."

A flag on an outlier is evidence about that transaction. What, in the file, is the evidence about the transactions the tool did not flag?

Training, Supervision and Certified Tools

"It is critical," CPAB says, "that auditors are trained to understand the capabilities and limitations of technology-assisted audit tools, including AI-enabled tools," and that they consider whether a tool is appropriate for the specific facts and circumstances of the engagement. Coaching and supervision of audit teams "are essential when these tools are used to ensure sufficient exercise of professional skepticism and that tools are appropriate for the engagement."

On quality management, the report says that the development of firm policies, processes and guidance on the use of technology, including AI-enabled tools, requires "certification of all technology tools" in accordance with the Canadian standard on quality management, CSQM 1, and the provision of required training to practitioners who use them. A footnote adds that this requirement "is irrespective of whether the tool is developed globally, locally or by a third party." For off-the-shelf tools, it says, firms should consider whether a SOC 2 report over the information technology general controls is available. Certification and training, in the report's words, "are key to ensuring tools are fit for purpose and used as intended."

Agentic AI, and the Questions for Audit Committees

Looking forward, the report says that the next evolution in implementation of AI includes advanced analytics and the development of agentic AI systems "that are capable of performing tasks autonomously." These developments, it says, "introduce new complexities that must be carefully managed through strong governance frameworks, rigorous certification of the tools and robust safeguards to protect the integrity of the audit process." As reporting issuers embed AI into financial reporting processes, auditors "may also encounter additional challenges, such as addressing the reliability, completeness, and auditability of AI-generated information."

Among its considerations for audit committees are questions they may put to their auditors. On technology and AI-enabled tools, they include how the auditor "tested the accuracy of the dataset that is used and analyzed by the tool," and how the tool used comes to its conclusions. One asks the auditor to "describe how AI tools used in this audit have been tested and determined to be fit for purpose prior to their use." Another asks: "How has the engagement team demonstrated that professional skepticism was exercised when using technology tools?"