IFAC: AI, Analytics and the Auditor's Changing Role
This article will count 0.25 units (15 minutes) of unverifiable CPD. Remember to log these units under your membership profile.
On 27 August 2026, IFAC published How Technology Is Changing What It Means to Be an Auditor by Sawan Shah on its Knowledge Gateway. The argument in the article is short: technology is not making auditors less relevant. It merely widening what they are asked to assure.
Work moves from sampling to whole populations
Audit was always shaped by a practical limit of too much data, not enough time, so you sampled and used judgement. However, with the use of technology that limit is disappearing. Analytics tools now test complete datasets, flag anomalies and point attention at where the risk actually sits. The direction of travel is continuous assurance, with monitoring close to real time.
So what this change and what it does not? Auditors have always interpreted evidence and this has not changed. What has shifted is the balance, as collection is being automated, so interpretation takes up more of the day. The judgement is still there, just applied to results rather than to gathering data.
The article cites Deloitte UK reporting that 90% of internal audit functions now have digital and analytics plans fully integrated with their strategy, with generative AI tools in regular use.
What AI can do and what people do
Technology can process contracts at scale, flag unusual journal entries, summarise documentation and help with audit planning. What stays human is evaluating whether evidence is sufficient, challenging management's assumptions, applying professional scepticism, and taking accountability for every key decision, including the opinion.
Where the new work is
Three adjacent markets are named, and this is the part that matters commercially.
Sustainability assurance. ISSA 5000 engagements work alongside reporting frameworks such as IFRS S1 and IFRS S2 or GRI, and focus on reporting boundaries, data collection, internal controls, calculation methodology and whether the assumptions hold together. That is controls testing with a different subject matter, which is precisely why it belongs to this profession.
AI governance. Assurance can extend to model oversight, documentation quality, testing discipline, bias and drift monitoring, and human-in-the-loop controls, with the OECD AI Principles and the NIST AI Risk Management Framework as reference points and ISAE 3000 (Revised) as an engagement framework.
Cybersecurity assurance. The article makes a distinction worth memorising. ISO/IEC 27001 and the NIST Cybersecurity Framework are control standards that an organisation gets certified or benchmarked against. Independent assurance over those controls is delivered through engagement standards such as ISAE 3402, and the SOC report is the output. A certificate is not an assurance opinion. Clients confuse those two constantly, and correcting that confusion is itself a conversation worth having.
What this means for you as a business accountant
Most CIBA members prepare numbers rather than test them, so it is tempting to file this as somebody else's problem. It is not. It just reaches you from the other direction.
Think about what happens when the person reviewing your client's ledger can test every transaction rather than 40 samples. Under sampling, a mis-posted VAT input had a fair chance of never being looked at. Under full-population testing it surfaces every time. SARS already works this way, profiling and analysing at scale rather than pulling files at random. In practical terms, your work is read by a machine before a human ever sees it.
That raises the value of something accountants have always given away for free. If you can show where a figure came from, which system produced it and what supports it, your compilation holds up under any amount of analytics. If the answer is that the software did it, you have a documentation gap wearing a technology excuse.
There is a pricing consequence as well. Automation is compressing capture, processing and reconciliation, which is exactly the work most practices still bill by the hour. When the hours fall, the fee falls with them, unless the fee has moved onto interpretation, controls and data quality first.
The good news is that the openings here need no audit registration. A data quality review before year end. A written AI use policy for a client whose staff are already pasting financial information into chatbots. Sustainability data readiness work ahead of any local adoption of IFRS S1 and S2, which is mostly a measurement and controls problem. Agreed-upon procedures on a specific balance. The machine is taking the capture work and leaving you the judgement work, and judgement has always been worth more. Most practices have simply never charged for it separately.
The skills that decide who gets paid
Technical accounting knowledge stays essential and stops being enough on its own. Shah names three additions. Data literacy means you can interpret large datasets and push back on automated output instead of accepting it. Technology literacy means you understand how the client's systems work and where the controls and the technology risk actually sit. Human skills mean communication, adaptability, critical thinking and scepticism. As the routine work automates, those human skills are what separate one practitioner from the next.
What to do this week
Take your largest client and write down, in one paragraph, where the revenue figure comes from and what makes it reliable. If you cannot, that is the gap.
Open your last three compilation files and ask whether a tool reviewing every transaction would find something you did not. If the answer is probably, fix the process rather than the file.
List every tool in your practice that touches client data, and check that you can explain its output to a client or to a regulator. If you cannot, that is an accountability problem, not a software problem.
Then pick one of the three new markets and read the standard. ISSA 5000 or ISAE 3000 (Revised) is a weekend of reading, and it is the difference between quoting for that work and referring it away.
The purpose of the work has not changed. It exists to build trust in information. Technology raises the value of integrity, judgement and scepticism rather than replacing them.
👉 Join CIBA and we'll show you how to turn the assurance skills you already have into services clients will pay more for.
