AI Audit: A Practical Guide for UK Firms on Compliance and Quality Assurance

Jun 22

4 min read

Updated: Sep 19

The Financial Reporting Council (FRC) recently announced new sandbox programmes, including an Audit Tech and AI Sandbox, aimed at supporting UK firms that develop or adopt generative AI, agentic AI, advanced software, and other audit technologies. This development signals a clear message: experimentation with AI in audit is becoming expected, but it must be done with care, transparency, and accountability.

For UK audit firms, accountancy practices, and finance leaders, understanding how to adopt AI confidently while maintaining audit quality and regulatory compliance is essential. This guide explains what the FRC’s announcement means in practical terms and offers clear steps to help firms integrate AI into assurance work responsibly.

3D characters performing an AI audit for UK firms compliance

Why Experimentation with AI Is Now Expected

The audit profession faces increasing pressure to improve efficiency, accuracy, and insight. AI offers powerful tools to analyse vast data sets, detect anomalies, and automate routine tasks. The FRC’s sandbox programmes encourage firms to explore these technologies in a controlled environment, learning what works and what risks arise.

Experimentation is no longer optional. Firms that do not explore AI risk falling behind competitors who can deliver faster, more insightful audits. Regulators recognise this and want to support innovation while safeguarding audit quality and public trust.

Maintaining Audit Quality and Public Confidence

Despite the benefits of AI, audit quality remains paramount. The public and stakeholders rely on audits to provide independent assurance about financial statements. Any use of AI must not undermine this trust.

Firms must ensure AI tools are reliable, transparent, and subject to human oversight. The FRC emphasises that AI adoption should not replace professional judgement but support auditors in making better decisions. Clear documentation and accountability are critical to demonstrate that AI has been used appropriately.

What Firms Should Record Before Using AI in Assurance Work

Before integrating AI into audit processes, firms should create a clear record of their approach. This documentation helps meet regulatory expectations and supports internal governance.

Key elements to record include:

Use cases: Define specific audit tasks where AI will be applied, such as data analytics, risk assessment, or fraud detection.
Risk assessment: Identify potential risks related to AI use, including data bias, errors, or cybersecurity threats.
Data access and management: Document how data will be accessed, stored, and protected, ensuring compliance with data privacy laws.
Human review processes: Outline how auditors will review AI outputs and make final judgements.
Evidence and audit trails: Maintain records of AI-generated evidence and decisions to support audit conclusions.
Staff training: Provide training to auditors on AI tools, their limitations, and ethical considerations.
Board and leadership oversight: Ensure senior management and boards understand AI use and monitor its impact on audit quality.

Practical Use Cases for AI in Audit

AI can enhance many aspects of audit work. Some practical examples include:

Automated data extraction: Using AI to extract financial data from documents quickly and accurately.
Anomaly detection: Identifying unusual transactions or patterns that may indicate errors or fraud.
Risk scoring: Applying AI models to assess the risk level of audit areas, helping auditors focus their efforts.
Continuous monitoring: Using AI to monitor transactions in real time, providing early warnings of issues.
Natural language processing: Analysing contracts or disclosures to identify inconsistencies or compliance gaps.

Each use case requires careful planning and controls to ensure AI outputs are reliable and understandable.

Assessing Risks When Using AI in Audit

AI introduces new risks that firms must manage proactively:

Model bias: AI systems may reflect biases in training data, leading to unfair or inaccurate results.
Data security: Sensitive financial data must be protected from breaches or misuse.
Overreliance on AI: Auditors must avoid blindly trusting AI outputs without critical review.
Regulatory compliance: AI use must comply with audit standards, data protection laws, and ethical guidelines.

Firms should conduct thorough risk assessments and update them regularly as AI tools evolve.

Ensuring Human Review and Accountability

AI should assist auditors, not replace them. Human review is essential to interpret AI findings, apply professional judgement, and make final decisions. Firms should establish clear procedures for how auditors interact with AI outputs, including:

Reviewing AI-generated alerts or risk scores
Validating AI conclusions with additional evidence
Documenting decisions and rationale when AI results are overridden

This approach maintains accountability and supports audit quality.

Building Strong Audit Trails and Evidence

Regulators expect firms to maintain clear audit trails that show how conclusions were reached. When AI is involved, firms must:

Record the AI tools used, their versions, and configurations
Save AI-generated data and reports as part of audit evidence
Document how AI outputs influenced audit procedures and conclusions

This transparency helps demonstrate compliance and supports quality reviews.

Training Staff on AI Tools and Ethics

Successful AI adoption depends on well-trained staff. Firms should provide training that covers:

How AI tools work and their capabilities
Limitations and risks of AI in audit
Ethical considerations, including bias and data privacy
Procedures for human review and documentation

Ongoing training ensures auditors remain confident and competent in using AI.

Board and Leadership Oversight of AI Use

Senior leaders and boards play a key role in overseeing AI adoption. They should:

Understand the benefits and risks of AI in audit
Set clear policies on AI use and accountability
Monitor AI’s impact on audit quality and compliance
Support investment in training and technology

Strong leadership helps embed responsible AI use within firm culture.

What to take from this

The FRC's new AI sandbox marks a genuine shift in regulatory expectations, with firms now expected to be actively experimenting with AI in audit and the FRC creating a controlled environment to support that process responsibly. The scrutiny that follows will centre on governance — whether firms can demonstrate how AI was used, who reviewed the outputs, and how accountability was maintained at each stage.

Firms that take time now to define their use cases, establish human review processes, and train their people will find themselves in a considerably stronger position when that scrutiny arrives. The sandbox represents a practical window to build and test those foundations while the regulatory framework is still taking shape.