The auditing profession is undergoing disruption not seen since the corporate financial collapse more than 20 years ago that led to the creation of the Public Company Accounting Oversight Board and the separation of consulting work from audit work.

Today, the disruption isn’t being driven by fraud or a lack of auditor independence, but by artificial intelligence. And like last time, auditing standards need an overhaul to respond to the threats posed and the opportunities created by AI.

In a recent request for public comments, the board asked commenters if it should pursue standard setting and research into this area. I hope the question was rhetorical, because the answer is a resounding yes and it should have started yesterday.

The board has taken some action on AI. It formed an inspections modernization council last month to improve audit quality. It reached out to firms about using generative AI in audits and has monitored AI use by auditors. Former PCAOB chair Erica Williams emphasized that AI adoption is no substitute for an auditor’s own knowledge and judgment.

It’s a good start, but it’s insufficient because it’s largely just applying existing standards to a new paradigm. The PCAOB needs to establish clear guidance on acceptable AI use before we have an audit failure resulting from improper AI use. Odds are we’ve already had one but just don’t know it yet.

In the last two years, three of the four largest global accounting firms had to retract reports because of AI hallucinations. It’s only a matter of time until a firm is forced to retract an audit report because the AI hallucinated audit evidence or the auditors didn’t properly review or supervise the AI agents collecting and analyzing audit evidence.

Auditors are still responsible for the report they sign whether AI played a large role, a limited role, or no role at all in the audit in the same way they are responsible for the work of staff, interns, and other engagement team members. But the standards weren’t created for the capabilities AI-enabled auditors now possess.

Asking auditors to apply current standards — many of which were created when AI was still the plot of science fiction — to the AI audits of today and tomorrow will only lead to divergence in practice by forcing each auditor and audit firm to interpret the old standards in the new age.

It’s situations like this that the PCAOB was created for.

Audit standards place a heavy emphasis on sampling and interpretation of misstatements found in sampling. Even a few years ago, an auditor of a large public company could only expect to examine a small fraction of the revenue or expense transactions annually.

Now, by deploying AI on engagements, an auditor could obtain evidence for every transaction covering billions of dollars, effectively testing the whole population. Sampling no longer would apply. What does that mean when we have an audit with nearly 100% visibility to account balances and transactions? How often, where, and to what extent do we need the human auditor in the loop? That’s exactly what the PCAOB should research and set the standard for.

The need for strong AI auditing standards will only grow as more firms implement AI audit suites such as Trullion or Basis or create their own proprietary systems. We’re still in the early stages of adoption, but the road forward is clear.

Soon AI auditing will just be called auditing. Having AI agents on the engagement team will be the norm in the same way that public companies having AI assist in closing their books will be the norm.

Imagine a scenario where an AI enterprise resource planning system is audited in part by an auditor deploying an AI audit platform. What happens if they’re the same system? Is the auditor still independent if their audit suite is potentially trained on the same data it’s now auditing? That would seem to threaten the validity of the AI output even if the auditor is unaware of the conflict.

Or imagine an AI agent that finds an error later in the audit that it missed on a first pass and covers it up to avoid being recoded. We have seen AI chatbots blackmail employees and encourage a reporter to break up with their partner. Ethics, impartiality, and accuracy shouldn’t be assumed; they should be regulated by the PCAOB.

To be clear, the board shouldn’t discourage or curtail the use of AI audit tools. But it also shouldn’t sit on the sidelines and allow the standards of the past to be used in the future. It must lead the auditing profession’s push into the AI age.

AI progress is measured in months — not decades. The PCAOB should be prepared to respond quickly as AI tools evolve, their usage by auditors expands, and the inevitable audit failures occur. Even with its reduced budget and threats of being eliminated, the board must be ready to regulate and set standards that may be needed when a new AI tool or capability emerges. At a bare minimum, it should set standards for what we know about AI in audits today.

In 2002, when the PCAOB was formed, we needed to regulate auditor independence and establish mandated internal controls. In 2026, we need a PCAOB to regulate the use of AI, determine how much human in the loop is required, research the risks and opportunities, and write standards that can be consistently implemented by firms regardless of what AI model or AI audit platform they’re deploying. In other words, the standard setters need to start setting more standards.

This article does not necessarily reflect the opinion of Bloomberg Industry Group Inc., the publisher of Bloomberg Law, Bloomberg Tax, and Bloomberg Government, or its owners.

Author Information

Jack Castonguay is a CPA, associate professor of accounting at Hofstra University, and vice president of content at Surgent Accounting and Financial Education.

Interested in writing? Review our author guidelines, and submit pitches to Insights@bloombergindustry.com.