Big Four AI Hallucinations: What It Means for Your Practice
This article will count 0.25 units (15 minutes) of unverifiable CPD. Remember to log these units under your membership profile.
Between 2025 and 2026, every single one of the Big Four accounting firms published a report containing material that AI made up. Deloitte Australia agreed to partially refund a government report after it was found to contain references to academic papers that do not exist and a fabricated quote attributed to a federal court judgment. A similar incident with the Canadian government followed months later.
EY published a report on cybersecurity threats to loyalty programmes. An outside AI detection firm found that most of its citations were hallucinated. EY withdrew the study. It had included a reference to a McKinsey report that was never written.
KPMG published a thought leadership report on the benefits of AI. It contained factual inaccuracies about several named companies, including case studies that never happened.
PwC had four Middle East publications flagged, spanning two years, with fabricated citations and fake footnotes.
Accounting Today ran a two-part investigation and reached the conclusion nobody in the profession wants to hear. Hallucinations remain untamed by even the world's largest accounting firms. Read that again. These are firms with dedicated AI governance functions, internal risk committees, mandatory tooling policies, and budgets that dwarf the annual turnover of most South African practices. They still shipped it. And in every case, the error was found by someone outside the firm.
So what is your review gate?
Here is the uncomfortable question. If four firms with hundreds of thousands of staff and formal AI governance frameworks could not stop a fabricated citation reaching a client deliverable, what exactly is stopping it in a five-person practice?
Be honest about the answer. In most small firms, the review gate is one person. You. And you are the same person who generated the draft, under time pressure, at 9pm, for a client who is already querying your fee.
This is not an argument against using AI. Your practice needs the speed. The point is narrower and harder: the tool does not fail loudly. A fabricated citation does not look like an error. It looks like competent work. That is precisely what makes it dangerous. As we covered in Can You Trust What AI Helped Build?, AI can omit material items and generate references that do not exist, and it can give you different answers to the same question depending on how you phrased it.
Where your liability actually sits
Two things are already binding on you. Neither of them mentions AI.
The first is professional competence and due care in the Code of Ethics. Competence is not just knowing the standard. It includes acting diligently in accordance with the requirements of the engagement. If you attach a source you did not read to a conclusion a client relied on, diligence is where the argument lands. The Code did not need updating to catch this, and the international ethics standard setter has said as much: the existing principles already cover most of the ethical challenges technology creates today. What it is now developing is practical guidance, not new rules.
The second is ISQM 1, if your practice performs independent reviews or any other assurance or related services engagement. ISQM 1 requires you to set quality objectives for the resources your firm uses, and that expressly includes technological resources. It also requires objectives around how engagements are performed and reviewed, and a process to monitor and fix what is not working. An AI tool that is fed client data with no policy, no approved tool list, and no documented review step is an unmanaged firm resource. That is a quality management gap with your name on it, whether or not anything has gone wrong yet.
And if you sign audit work, note that regulators are already looking. The PCAOB has flagged the increased use of technology, including generative AI, as an inspection focus area, with attention on how firms document and control its use.
The controls that actually stop this
The firms that manage the risk best treat it as a governance problem before a technical one. Human review, scaled to consequence. As one specialist firm CEO put it, anything involving technical conclusions, regulations, citations, legal interpretations, client recommendations or audit conclusions "has to be validated by a human".
That gives you a workable rule. Not every AI output needs the same treatment. Match the review to what an error would cost.
Note what the top tier requires. Not a glance at the citation. Opening the source. If you cannot find the paragraph the AI quoted, the quote does not go in the file. Full stop.
Do these five things this week
Write a one-page AI policy. Which tools your practice may use, what client data may never be uploaded, and who signs off on AI-assisted output. One page. Date it. It is your evidence that you managed the resource.
Ban unverified citations. Any reference, section number, case name, or SARS interpretation note that came out of an AI tool gets opened and checked before it enters a client file. No exceptions for internal notes that might later be shared.
Pick your top tier. List the three deliverables in your practice where a fabricated fact would cost you a client or a complaint. Those get a second read, even if the second reader is your spouse checking that every source link opens.
Log it. Add one line to your working papers when AI assisted a conclusion, and note what you verified. It costs 20 seconds and it is the difference between a defensible file and a bad afternoon.
Tell your clients. Most SME owners are pasting their own numbers into free AI tools right now, with no policy at all. Reviewing their AI use is a service you can scope, price, and bill. That is the growth angle hiding inside this risk.
Small practices carry the cost of standards written for large firms, as we set out in Stop Applying Big-Firm Ethics to Your Small Practice. This one is different. Here the large firms failed first, in public, and handed you the case study for free. Use it. The signature at the bottom of the report is still yours. The AI does not sign anything.
👉 Join CIBA and we will show you how to turn AI risk into a service clients pay for, with a review gate that protects your name.
Source articles: Accounting today: False info, real problems: The human in the AI loop and False info, real problems: Can accountants tame AI hallucinations?
