Trust but verify: Using AI responsibly in a CPA firm
Elizabeth Barchenger, CPA | August/September 2026 Footnote
Editor's note: Updated July 27, 2026
Artificial intelligence has quickly become one of the most discussed topics in auditing. Firms are adopting AI in a variety of ways — from drafting memos and client communications to performing elements of audit testing. Whether this shift is “good” or “bad” is not the point. It is happening — rapidly — and it will continue to evolve.
The more important question is how we use it effectively and responsibly. Given the pace of change, this requires ongoing attention, reassessment and adaptation.
Fortunately, the guiding principle is not new for the accounting industry. It is simply being applied in a new way: Trust but verify.
AI is powerful, but not infallible
Many are familiar with the story of the attorney who used AI to research case law, only to later discover the cited cases were entirely fabricated. While AI systems have improved significantly — particularly newer tools that rely on curated or restricted data sources instead of the open internet — the risk has not disappeared.
Even tools designed to minimize hallucinations can still produce incorrect or misleading outputs.
For example, I recently used an AI tool with a curated data source to review documents and identify potential issues. The initial response appeared promising: It highlighted several transactions that would reasonably require follow-up.
However, when I asked for additional details so I could request supporting documentation from the client, the issue became clear. The account numbers in the additional details provided did not even use the same formatting as the transactions uploaded. When challenged, the tool admitted that it had not actually been able to read the uploaded document and had instead generated examples based on patterns from accounting guidance.
In other words, it provided a confident, well-structured — but entirely fabricated — answer.
I attempted to correct the issue by uploading the same data in a different format and asking the tool to confirm whether it could read the file before running the analysis. It proceeded to generate another list of transactions — again incorrect — without answering the capability question.
This pattern repeated multiple times across different files — the system provided an answer first and only acknowledged its limitations when directly challenged afterward.
This behavior is a critical risk in practice.
A staff member without deep familiarity with the client’s systems could rely on that output, requesting documentation for transactions that never existed. At best, that would result in inefficiency. At worst, it could undermine credibility with the client.
To be clear, this is not an argument against using AI. In fact, when I uploaded a PDF version of the same document, the tool performed very well — producing results consistent with what I would expect from manual procedures and even identifying a transaction I had initially missed.
The takeaway is not that AI is unreliable; it’s that its outputs need to be thoughtfully evaluated, not automatically trusted.
Inconsistency and change over time
In another test, I used AI to proofread and foot financial statements. The task was straightforward: check totals, internal consistency and spelling.
I ran three separate sets of financial statements, each containing the same intentional typo. The AI flagged the error in two cases but missed it in the third.
That inconsistency matters from an audit perspective. A human reviewer performing the same task would be expected to identify recurring issues across similar documents. With AI, results may vary even when the inputs are nearly identical.
Compounding this, AI tools evolve continuously. Updates can change behavior — sometimes in small ways that are not immediately obvious. A procedure that appears reliable today may produce different results later.
This reinforces the need for continuous monitoring, not just initial validation at the point of implementation.
The subtle risk of drift
AI can also introduce errors over time in conversational workflows. I used an AI tool to walk through an accounting question. The initial response was correct. However, as I asked follow-up questions, the system gradually shifted its position, eventually arriving at an incorrect conclusion that contradicted its original answer.
This type of “drift” can be particularly dangerous because it happens incrementally. Each step appears reasonable, but the overall conclusion becomes flawed. Without a solid understanding of the topic, a user may not recognize the shift.
These experiences highlight a practical reality for firms adopting AI: Efficiency gains are rarely immediate. In the early stages, time is spent testing tools, refining prompts, validating outputs, and learning where it performs well and where it does not. While this upfront investment may feel counterintuitive in a profession built on efficiency, it is necessary groundwork. Over time, as firms develop confidence in specific use cases, the expected time savings will begin to materialize.
The role of professional judgment
These examples point to the same conclusion: AI is a powerful tool, but it is not a substitute for professional judgment.
To use AI effectively in an audit environment, practitioners must:
- Understand the objective of the procedure. If you don’t know what the test should accomplish, you can’t evaluate whether the AI output achieves it.
- Evaluate the plausibility of the results. Do the numbers, formats and relationships make sense in the context of the client?
- Recognize limitations. AI may not always tell you when it cannot complete a task. You need to identify those gaps yourself.
- Corroborate key outputs. Particularly for audit evidence, independent verification remains essential.
- Maintain accountability. The responsibility for the work does not shift to the tool. It stays with the CPA.
- Participate in ongoing evaluation. AI tools should not be implemented and forgotten. Their performance should be periodically reassessed as part of the firm’s quality management and technology governance processes.
Moving forward
AI can perform many tasks — some of them quite complex — but it does not possess professional judgment. At some point, a knowledgeable CPA must step in, evaluate the output and determine whether it is reasonable. The effectiveness of any AI-assisted audit ultimately depends on the person using the tool: their understanding of the underlying work, and their ability to recognize when something doesn’t make sense. At a firm level, this also introduces the need for effective governance and oversight. Clear expectations around how tools are used, what data is appropriate to input and how output is reviewed are critical to achieving consistent, reliable results.
AI will continue to become more integrated into audit workflows. It will improve efficiency, enhance analysis and uncover insights that might otherwise be missed. Used appropriately, it can be a meaningful asset to the profession.
But it is not a replacement for experience, skepticism or judgment.
Firms that succeed in this environment will not be those that adopt AI the fastest — they will be the ones that adopt it the most thoughtfully. They will train their teams not just on how to use the tools, but on how to question them. They will embed review processes that assume AI output may be incomplete or incorrect, and they will reinforce that technology supports the audit — it does not define it.
The message is simple, but it bears repeating: Trust the tool, but verify the results.
Because, in the end, the quality of the audit still depends on the professional behind it.
Elizabeth Barchenger, CPA is an assurance services team director at Mahoney. Barchenger’s primary area of practice is providing audit and accounting services to clients in the real estate and not-for-profit industries, including those with Uniform Guidance and HUD reporting requirements.
