'AI cannot audit itself' — a response

An auditor's job is to examine a company's financial records and internal controls—the policies and procedures that keep accounting accurate and prevent fraud. Traditionally, auditors (trained accountants working for independent firms) manually reviewed transactions, interviewed staff, and tested the company's own safeguards. Increasingly, audit firms are deploying artificial intelligence—algorithms and machine-learning tools—to scan millions of transactions, spot unusual patterns, and flag risks faster than humans could alone. The article's reader is responding to a concern: if AI finds errors or detects fraud, but the AI's reasoning is opaque (meaning the auditor can't fully explain why the AI made its judgment), does the audit still meet its core requirement of providing independent professional assurance? The piece argues that auditor independence and professional skepticism—hallmarks of strong internal control—cannot be outsourced to machines.

• AI can process huge volumes of transaction data quickly, but it operates as a 'black box'—auditors often can't explain the reasoning behind its conclusions.
• Internal controls require independence: an unbiased party (the auditor) must assess whether the company's own controls are working → AI lacks human judgment and skepticism.
• If auditors blindly trust AI findings without understanding them, they've abandoned professional responsibility, which is a core element of effective control systems.
• Human oversight of AI is necessary so auditors can question results, understand limitations, and take accountability for their opinions to the public.

Internal controls

Policies and procedures a company puts in place to safeguard assets, ensure accurate accounting records, promote efficiency, and prevent fraud.

Auditor

An independent accountant (usually from a separate firm, not employed by the company) who reviews financial statements and internal controls to provide assurance they are accurate and reliable.

Independence

The auditor's status as an impartial outsider with no financial stake in the company's success, allowing them to give an honest opinion.

Professional skepticism

An auditor's critical, questioning mindset—assuming transactions may contain errors or fraud until proven otherwise, rather than trusting everything at face value.

Black box

A system (like some AI algorithms) that produces outputs but whose internal reasoning is hidden or too complex for users to fully understand or explain.

Audit opinion

The auditor's formal statement (usually 'clean,' 'qualified,' or 'adverse') on whether a company's financial statements are fairly presented in accordance with accounting rules.

1. 01

   Auditors issue formal opinions that investors and lenders rely on. How would you feel relying on an AI-generated opinion you couldn't explain to a lender?

   Show answer

   Answer: Students should recognize that audit opinions carry legal and professional accountability—the auditor's name and credibility are on the line. If the auditor can't defend an AI conclusion in court or to regulators, they've shifted responsibility without maintaining professional control. Confidence in financial statements depends on human judgment backed by evidence.
2. 02

   Does using AI to audit actually strengthen internal controls if the auditor doesn't understand the AI's conclusions?

   Show answer

   Answer: The key point to draw out is that internal controls depend on independence and understanding. If the auditor is merely a rubber stamp for AI output, the control has broken down. Strong controls require someone who can question findings, understand the logic, and take responsibility—all human qualities.
3. 03

   What would a 'strong' system of internal controls look like in an audit firm that uses AI—what safeguards would you add?

   Show answer

   Answer: Students should suggest layers of human review: someone who understands both the AI tool AND the audit objective; clear documentation of what the AI is testing and why; procedures to verify AI findings with manual sampling; and a hierarchy where AI surfaces risks for human auditors to investigate. This mirrors how companies design controls—multiple checkpoints, not single decision-makers.

Open by drawing a simple two-column table on the board: 'Auditor's Job' (verify accuracy, detect fraud, maintain independence, issue professional opinion) vs. 'What AI Can Do' (process data fast, spot patterns humans miss, work 24/7). Then ask: "Which column covers *all* of the auditor's job?" The gap is professional judgment and accountability. Use the analogy of a GPS vs. a driver: GPS is a tool, but the driver is still responsible. If the driver blindly follows GPS into a lake, we don't blame the GPS. Walk through one concrete scenario—an AI flags a $5M transaction as unusual—and ask students: "What questions should the auditor ask next?" This shows why human skepticism can't be replaced. Leave them with: "Tools serve people; people are responsible."