The Canadian Public Accountability Board Sets Out Questions for Auditors Who Use Technological Tools, Including Whether the Team Understands How a Tool Makes Decisions

A CPAB Exchange paper by the Canadian Public Accountability Board, The evolving use of technology in the audit, is dated December 2025. It says Canadian audit firms "are embedding advanced technologies in their audit workflows and beginning to make use of agentic artificial intelligence (agentic AI)," and that to take advantage of these innovations, "audit firms will need to address the additional risks that come with these advancements." It identifies additional risks, building on the key messages of a CPAB publication of 2024 on AI in the audit. Parts of it follow, not the whole.

What CPAB's Inspections Saw

CPAB says it is seeing a growing use of advanced technology in audits. In its 2025 inspections it noted instances where auditors relied on automated tools and techniques "as the primary source of audit evidence for a specific class of transaction." Where they did, "in some instances CPAB observed limited procedures to validate the completeness and accuracy of the data inputs."

In one tool, the paper says, "substantive testing was generally limited to transactions flagged as higher risk or outliers, with no additional testing performed on the transactions determined to be low risk by the algorithm." That raised concerns about "the transparency around how risk classifications were determined by the tool, and whether the auditor sufficiently challenged the outputs." For a description of significant findings relating to the use of technology, the paper points to CPAB's 2025 interim report. In that tool, the algorithm's own call decided which transactions got no additional testing.

Firm-Level Considerations

The paper points to the Canadian Standard on Quality Management, CSQM 1, whose framework for managing quality within an audit firm includes establishing policies and procedures addressing the development or acquisition, implementation and ongoing maintenance of technological tools used in engagements. CPAB says it is "critical" that firms establish quality objectives, identify and assess quality risks, and design and implement responses to the quality risks related to the use of advanced technology on audit engagements.

"Audit firms should also be mindful of the risk of overreliance on technology," the paper says. "This risk increases when the output or results appear authoritative, are difficult to understand or lack sufficient information to allow auditors to challenge the underlying assumptions." It is important, it says, that auditors continue to exercise an appropriate level of professional skepticism, for example when the auditor is unable to understand or challenge the output provided, "or key decisions are contained within an algorithm."

The paper gives "some examples of firm-level responsibilities and responses to quality risks that could be considered" by firms planning to use technology in audit engagements. One is to review and update processes for approving audit tools, which could include policies around how often a tool's effectiveness is reassessed, "for example, when a new version of the underlying large learning model is introduced." Another is monitoring and oversight, to "Ensure tools are used only on approved engagements and remain fit for purpose." On training, its examples include understanding the knowledge, training and expertise needed to review the output, "or how to develop critical thinking skills of junior auditors." And another is to establish formal escalation and whistleblowing procedures, "including processes to identify and address anomalies within tools, or ethical concerns around use of AI in the audit."

Questions for the Engagement Team

"Where it is used effectively, technology can enhance audit procedures, but it does not replace professional judgment," the paper says. When an auditor is using a technological resource, it is important that they have "a clear understanding of how and why the technology is being used and the basis for the decisions being made."

CPAB lists six questions that may help to guide that use. Are the relevant inputs clearly understood by the engagement team? Has the accuracy and completeness of the data been evaluated? Does the engagement team understand how the tool makes decisions? Can outputs be corroborated through other relevant sources? Are the outputs explainable? Has the engagement team sufficiently challenged any conclusions drawn by the tool?

The Auditor's Role and Transparency

"CPAB has noted that many audit firms consistently state that the audit will remain human-led and that the use of AI or advanced technology will include a human in the loop. However, effective adoption requires more than just explaining this concept or including it in training. It requires a behaviour shift and clear articulation of the desired involvement at each stage of the audit."

For example, it says, at the beginning stages the audit partner may want to consider how to set appropriate expectations for the engagement team on how technology will be used, including any specific planned uses of AI. Through fieldwork, it is important to consider how the team will evaluate the effectiveness of any tools used and review technology-driven decisions. During the final stages, it is important for senior members of the engagement team to consider how they assess the overall use of technology, "including whether professional skepticism was exercised to address the identified risks of material misstatements."

As technological resources operate more autonomously, "including where agentic AI is utilized," CPAB says supervision and oversight mechanisms "may need to be enhanced." One example it gives is a clear, documented roadmap of the steps taken or decisions made by the tools, with sufficient detail retained in the audit file "so an experienced auditor with no prior involvement can clearly understand the nature, timing, and extent of the procedures performed, the results and evidence obtained, and the significant matters and professional judgments that informed the conclusions." Another is a challenge mechanism that will alert engagement teams "when technology makes decisions that could affect parts of the audit strategy." Could an experienced auditor with no part in the work follow what the tool decided, and why?

It is also important, the paper says, to be transparent with other stakeholders, "including those charged with governance (i.e. audit committees) and regulators," about how technology is used in the audit. That could include explaining how technology is used in the audit workflow, the extent to which auditors use automated tools and techniques to perform procedures, and any related decision making. "This transparency is essential to the oversight role that audit committees play in supporting audit quality."