AI in Audit: FRC Guidance Explained

Q: What does good documentation look like on a file?

Illustration only. A firm audits a manufacturing company with a year end of 31 March. The senior uses the firm's approved AI tool to summarise twelve sets of board minutes during planning. The summary mentions a product recall but leaves out a board discussion about a possible breach of a loan covenant. Following the FRC approach, the senior compares the summary with the minutes, as the methodology requires, finds the omission and records it. The file notes the tool name and version, that it was used to focus the minutes review, that the full minutes were read for the periods discussing financing, and that the covenant point was added to the risk assessment. An experienced auditor picking up the file can see what was done, what the tool contributed and why the team was satisfied.

The FRC has published two pieces of guidance on AI in audit: AI in Audit, an illustrative example and documentation guidance, on 26 June 2025, and Generative and Agentic AI Guidance on 30 March 2026. Neither creates new requirements. Both explain how existing standards, mainly ISQM (UK) 1 and ISA (UK) 230, apply when a firm uses AI, and both make the same point: the firm and the engagement partner stay accountable for the audit.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

What has the FRC published on AI in audit?

The FRC keeps its AI material together on an AI in Audit page. It currently holds three documents:

AI in audit: illustrative example and documentation guidance (26 June 2025). This walks through a hypothetical AI tool used to test journal entries and sets out what should be documented about tools that use AI.
Generative and Agentic AI Guidance (30 March 2026). This covers the audit quality risks of generative and agentic AI tools, ways to reduce them, and how to judge whether their outputs can be relied on.
Generative and Agentic AI Guidance factsheet (30 March 2026), a short companion summary.

Alongside the June 2025 guidance the FRC published a thematic review of how the six largest audit firms certify automated tools and techniques. The FRC said the 2026 guidance is the first from any audit regulator globally on generative and agentic AI.

Does the FRC guidance change the auditing standards?

No. The FRC said its June 2025 guidance is not prescriptive and does not introduce new regulatory requirements. The 2026 guidance is presented as setting out existing good practice, and it was not issued in response to specific quality failures. The obligations still come from the ISAs (UK) and from ISQM (UK) 1.

The factsheet ties accountability to two standards: the firm keeps full responsibility for audit quality under ISQM (UK) 1, and the engagement partner under ISA (UK) 220. In the FRC’s words when launching the 2026 guidance, the human auditor is always accountable and the guidance does not alter that position.

Worried about an HMRC check? Tax investigation insurance pays your accountant’s fees if HMRC opens an enquiry or compliance check. Solar Protect cover pays up to £100,000 with no excess. It never pays tax, interest or penalties.

From £108.75 a year (£9.06 a month) for individuals, £117.57 for sole traders and £207.50 for companies and partnerships, including IPT and the £20 admin fee.

See my price in 2 questions or call 01795 841 310.

★★★★★ Rated 4.9 out of 5 on Trustpilot from over 160 reviews

What does ISA (UK) 230 require when AI is used?

ISA (UK) 230 on audit documentation requires the auditor to prepare documentation on a timely basis (paragraph 7) and to make it sufficient for an experienced auditor, with no previous connection with the audit, to understand the nature, timing and extent of the procedures performed, the results and the audit evidence obtained, and the significant issues arising, the conclusions reached and the significant professional judgements made (paragraph 8). The current edition is ISA (UK) 230 (Revised June 2016) (Updated September 2025).

The FRC’s documentation guidance applies that test to AI. It says automated tools and techniques that use AI will require documentation on the audit file, which may include tools deployed on component audits. For other AI tools, such as a drafting assistant, documentation on the file may not be required if an experienced auditor would not need it to understand the basis for the report or the significant issues, though teams may choose to record it anyway.

What should be documented centrally and what on the audit file?

The 2025 guidance splits documentation between the firm’s central team and the engagement team, and says the more widely a tool is used, the more of its documentation should sit centrally.

Level	What the FRC expects to be documented
Central (firm)	Description and function of the tool; when it is appropriate to use; how it was developed; why the firm is confident it works as intended; training and support for teams; how it is explainable; how its use aligns with the government’s five AI principles; version history
Audit file, AI enabled automated tools and techniques	Tool description and version; why use was appropriate; evidence of central approval; how the team considered the outputs
Audit file, other AI tools	May not be needed if an experienced auditor would not need it to understand the basis for the report
Third party tools	Same expectations, accepting that full design history may not be available; evidence on standards, data use, versions and updates

The five government principles listed are safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. ISQM (UK) 1 sits behind the central documentation: the guidance points to the requirement that firms obtain or develop, implement, maintain and use appropriate technological resources.

What does the FRC mean by explainability?

The guidance defines explainability as a measure of the extent to which the behaviour or decisions of a tool can be understood. The level needed depends on what the tool is used for. In the journal testing example, the firm required users to see which features of a transaction caused it to be flagged, so the team could follow up each flagged item with a reason rather than a score. For complex models, approximate or after the event explanations of how inputs affect outputs may be enough, rather than full transparency of the model’s inner workings. That example sits naturally alongside conventional journal entry testing, and the FRC’s hypothetical firm ran the AI tool alongside rules based routines rather than instead of them.

How does the 2026 guidance deal with generative and agentic AI?

The 2026 guidance is aimed mainly at central functions in firms that build these tools. It groups the risks into three categories:

Deficient output: the output of the tool is wrong or incomplete. The FRC says this risk cannot be eliminated because large language models have inherent limitations.
Misuse of output: an appropriate output is misused, for example a summary treated as complete.
Non compliant methodology: the firm’s methodology allows an approach that fails to meet auditing standards.

Mitigations fall into four groups: design and development suited to the intended use, robust certification, staff knowledge and business rules, and a human in the loop who directs, authorises or reviews the tool’s actions or outputs. The reviewer should apply professional scepticism, be competent to spot deficiencies and be aware of the risk of automation bias. How much of each mitigation is needed is a matter of professional judgement. Cyber and data risks are outside the scope of the guidance, so firms still need to deal with those separately.

The worked examples are summarising board minutes as part of risk assessment and reviewing contracts to pick higher risk items for revenue testing. In the board minutes example, the methodology requires the auditor to review the tool’s output and corroborate its completeness and accuracy against the minutes, and the auditor records on the file that a generative AI tool was used. The guidance notes that judging confidence in an output involves the quantity and quality of evidence obtained, not just its reliability, which links back to obtaining sufficient appropriate audit evidence.

What does this mean for a smaller audit firm?

The guidance is written with large firms’ central teams in mind, but the same standards apply to every registered auditor. A smaller firm buying an AI feature from its audit software provider is in the third party position: it should still be able to say what the tool does, when it is appropriate to use, why the firm trusts it and how the team reviewed its output. Expect file reviewers, including in FRC audit quality reviews and professional body monitoring, to ask how an AI output was tested before it was relied on. Where an AI assisted procedure misses something, the claim is against the firm; AI insurance for accountants explains how cover can respond.

What does good documentation look like on a file?

Illustration only. A firm audits a manufacturing company with a year end of 31 March. The senior uses the firm’s approved AI tool to summarise twelve sets of board minutes during planning. The summary mentions a product recall but leaves out a board discussion about a possible breach of a loan covenant.

Following the FRC approach, the senior compares the summary with the minutes, as the methodology requires, finds the omission and records it. The file notes the tool name and version, that it was used to focus the minutes review, that the full minutes were read for the periods discussing financing, and that the covenant point was added to the risk assessment. An experienced auditor picking up the file can see what was done, what the tool contributed and why the team was satisfied.

Frequently asked questions

Is the FRC AI guidance mandatory?

No. The FRC says it does not introduce new requirements. It explains how existing standards such as ISQM (UK) 1, ISA (UK) 220 and ISA (UK) 230 apply when AI is used.

Do I need to record every use of ChatGPT on an audit file?

Not necessarily. AI enabled automated tools and techniques need documenting on the file. For other AI tools, the test is whether an experienced auditor would need the information to understand the basis for the report or significant issues.

Who is responsible if an AI tool gets something wrong?

The firm under ISQM (UK) 1 and the engagement partner under ISA (UK) 220. The FRC says the human auditor is always accountable. See also the ethics of AI use in practice.

Does the guidance cover data security?

No. The 2026 guidance limits its scope to risks to audit quality, so cyber security and data risks need to be handled through the firm’s other policies.

Using AI in your practice? Solar AI Cover brings professional indemnity, cyber and liability cover together for firms that use or build AI, and Solar Protect runs fee protection schemes for accountancy practices. See AI insurance for accountants or ask about a practice scheme.

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 6 November 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.