Canada's Audit Regulator Says Appropriate Human Oversight Remains Critical as AI Use Expands

The Canadian Public Accountability Board calls itself Canada's independent, public company audit firm regulator. Its interim inspection results for 2026 are dated November 2026. The report is meant for audit firms, audit committees and the general public.

Its observations stand as of September 30, 2026. They relate for the most part to the country's four largest audit firms. The full results will come in CPAB's annual report in March 2027. The report has a section on artificial intelligence in audits. Parts of the report follow, not the whole.

Fewer Significant Findings, With a Limit

By September 30, CPAB had completed 66 of the 70 files it planned to inspect at the four largest firms. It found significant inspection findings in four of them. In 2025 it found such findings in 10 files across 62 inspections.

A significant finding, in CPAB's definition, is a deficiency in the application of auditing or other relevant professional standards. With such a finding, the firm must do more audit work to support its opinion, make significant changes to its audit approach, or both. CPAB says the interim results "indicate a meaningful improvement at the four largest firms."

CPAB chooses files by risk, aiming at higher-risk audit areas. Its method "is not designed to select a representative sample" of a firm's work. Results should not be extrapolated across a firm's entire audit portfolio, it says. They should be viewed as an indication of how firms address their most challenging audit situations.

When the System Makes the Number

CPAB identified findings in audits of entities that process large volumes of transactions through highly automated systems. There, significant financial statement balances, including revenue, are often generated through several linked systems and applications. Manual involvement is limited.

Auditors need a sufficient understanding of how information flows through those systems, CPAB says. They need the same understanding of how key financial information is generated. Without it, there is a risk that errors in system-generated information, automated processing or data transfers between systems may not be identified. Such errors could affect large numbers of transactions.

The inspection findings included instances where auditors:

• did not obtain a sufficient understanding of the systems relevant to financial reporting, including third-party systems and service providers;
• relied on system-generated information without sufficiently assessing its reliability;
• did not test internal controls despite significant reliance on automated processing of large volumes of data.

The Section on AI

CPAB says the use of AI, including emerging AI-agent capabilities, continues to expand across the audit profession. As technology becomes more integrated into the audit process, it says, "maintaining appropriate human oversight, professional judgment, and accountability for audit conclusions remain critical."

CPAB says it remains focused on how firms' systems of quality management support the adoption and use of technology. That includes processes for evaluating and testing new tools, and for setting appropriate governance and safeguards. It also includes making sure staff have the necessary training, competence and support to use technology effectively.

CPAB oversees the audits of Canadian reporting issuers. As those companies adopt more AI in their financial reporting and operations, it says, auditors will also need to address the related risks, controls and auditability of AI-generated information. That "may require auditors to adapt their procedures to respond to these emerging risks."

Questions for the Audit Committee

The report suggests questions an audit committee might put to its auditor. On information systems, one asks how the auditor and management determined that system-generated information used in financial reporting was "complete, accurate, and reliable." Another asks what procedures were performed for the risk that systematic processing errors could affect entire populations of transactions.

On audit team expertise and professional judgment, one question asks how audit staff have been trained on new technology integrated into the audit process. Another asks: "Which elements of the audit, if any, were planned or completed by using AI tools?"

Could a firm answer that question from its own files, or only from memory?