The PCAOB and the Financial Statement Auditor at the Autonomous Frontier

Remarks as prepared for delivery

Good afternoon and thank you Mauricio [Codesso]. It is a privilege to join you this afternoon at Rutgers Business School as we mark the 75th World Continuous Auditing & Reporting Symposium. I always appreciate the opportunity to discuss the vital role that financial statement auditors and the PCAOB play in our capital markets. The timing of today’s event is especially notable given the extraordinary pace of change across the landscape of accounting and auditing. That pace is difficult to overstate. It has been said that today may be the slowest day of artificial intelligence (AI) development we will ever experience. The future implications for financial reporting, accounting, auditing, and regulation are profound. This afternoon, I would like to share a few thoughts about what this period of change may mean for the auditing profession and the PCAOB. I offer them not as final answers, but as a starting point for what I hope will be a thoughtful and engaging panel discussion.

Before I continue, please know that although my remarks this afternoon are provided in my official capacity as a PCAOB Board member, the views I express are my own and do not necessarily reflect the views of the full Board, my fellow Board members, or the PCAOB’s dedicated staff.

During my time, I want to focus on the following four topics: first, the history and significance of this symposium and Professor Miklos Vasarhelyi's contributions to it; second, the evolution of technology in financial reporting, accounting, and auditing; third, the new risks these capabilities bring; and finally, how the PCAOB, with its investor protection mandate, appropriately takes account of these developments with a focus on preserving the judgment, professional skepticism, accountability, and evidentiary discipline on which audit quality depends.

WCARS - A Symposium that Anticipates the Future

The World Continuous Auditing & Reporting Symposium (WCARS) began at Rutgers in 1998.¹ Since then, the series has convened at Rutgers and at host institutions across Europe, Asia, Australia, the Middle East, and the Americas.² This is truly a global series. For nearly three decades, WCARS has fostered a continuing exchange between academic researchers and practitioners concerning technology-enabled financial reporting, accounting, and auditing.

That exchange has grown from relatively early discussions of electronic records and continuous monitoring to today’s questions about AI governance, generative AI (or Gen AI), autonomous and agentic AI systems, and continuous assurance. This 75th symposium represents 75 opportunities to test assumptions, share research, challenge accepted practices, and bring academic insights into conversation with the realities of auditing and financial reporting.

At the center of this history stands Professor Miklos Vasarhelyi. I should add that I am grateful for the long-standing relationship that I and the PCAOB have had with him and for his leadership in the use of technology in auditing long before it was fashionable. Professor Vasarhelyi, as the director of the Rutgers Accounting Research Center and the Continuous Auditing and Reporting Laboratory, is credited with developing the original continuous audit application.³

The origin of this application is worth retelling. From 1986 to 1990, at AT&T Bell Laboratories, Professor Vasarhelyi developed continuous auditing to test whether AT&T’s billing systems were correct. The result was the Continuous Process Auditing System, or CPAS. As he and Fern Halper described it in a 1991 paper in Auditing: A Journal of Practice & Theory, CPAS “monitors key operational analytics, compares these with standards, and calls the auditor’s attention to any problems.”⁴ Consider that sentence: analytics, standards, and human auditor follow-up for exceptions. That was the architecture of modern continuous monitoring, and notice that the auditor was not removed from the process. Rather, the auditor was directed to add judgment to the process. Professor Vasarhelyi’s later work extended that progression into big data, audit analytics, and artificial intelligence in a paper he coauthored titled “Artificial Intelligence Co-Piloted Auditing.”⁵ What he and his co-authors called “co-piloted auditing” involves an “audit setup where auditors’ capabilities are enhanced through artificial intelligence, facilitating optimal outcomes across a variety of tasks.”⁶ I will come back to this paper.

This history is instructive. Ideas that once appeared ambitious or even speculative can and do become ordinary features of all areas of the financial reporting ecosystem. At the same time, not every innovation develops as expected. Technology rarely moves in a straight line, and adoption does not consistently result in quality.

From Ledgers to Agents: A Short History of Technology in Accounting and Auditing

Viewed in that broader context, the changes we are experiencing today are part of a much longer story of innovation, adaptation, and advancement. The history of accounting has always been, in part, a history of information technology. The evolution began when the handwritten ledger standardized the recording of transactions. Double-entry bookkeeping provided a structure for preserving balance and accountability. Mechanical calculators accelerated computation. The arrival of punch-card systems increased the speed at which large quantities of data could be sorted and summarized.

This advancement continued as mainframe computers moved accounting records from paper into electronic systems. Then, enterprise resource planning systems integrated purchasing, inventory, payroll, production, sales, and financial reporting. The onset of spreadsheets placed unprecedented analytical power on the desktops of individual accountants, although they also introduced risks involving the use of formulas, access and version control, and undocumented changes.

In more recent years, database systems made it possible to analyze transactions across multiple dimensions. The advent of the internet enabled distributed financial systems, electronic confirmations, remote work, and near-instantaneous access to information. Robotic process automation allows organizations to automate repetitive, rules-based processes. Data analytics enabled auditors to examine entire populations, identify outliers, visualize relationships, and detect patterns that may not be apparent from traditional audit techniques.

This evolution brings us to artificial intelligence, which continues and accelerates this progression but introduces something different. I recently heard it said that a calculator is a tool, but a calculator does not think for itself. Traditional software generally follows instructions written in advance and will produce the same result each time. Many AI systems infer patterns from data. Generative AI can produce new text, code, images, analyses, and explanations. Agentic AI can go further by decomposing objectives into tasks, selecting tools, retrieving information, interacting with other systems, and revising its approach.

In other words, the technology is progressing from calculating, to automating, to generating, and now, with agentic AI, to acting. This progression has profound implications for accounting and auditing.

The Jagged Frontier

In his book, “Co-Existence: The Next Phase of AI,”⁷ Professor Ethan Mollick asks, “How do we live and work with machines that are sometimes, but not always, smarter than we are?”⁸ Professor Mollick describes AI capability as a “jagged frontier.”⁹ Some tasks that appear extremely difficult for humans fall within AI’s capabilities. Other tasks that appear simple remain beyond AI’s dependable reach. That frontier is not smooth, stable, or always predictable. Although this might add confusion or uncertainly, the jagged frontier provides “the sources of enormous opportunity…[t]he jaggedness creates a much more interesting situation: countless configurations where human capabilities and AI capabilities complement each other.”¹⁰ This should resonate with auditors.

Auditing involves considering evidence in context. Evidence that is persuasive for one purpose may be insufficient for another. An audit procedure that addresses one risk may not address a different risk. A model that performs well on familiar data may fail when the underlying population changes. The central question is therefore not whether AI is “good” or “bad,” or whether it is “better” or “worse” than a human auditor. The more useful questions might include:

• For which audit objectives is the model demonstrably capable?
• On what data was it trained, configured, or tested?
• Under what conditions does it perform reliably?
• And who remains responsible when it fails?

Those principles align naturally with the responsibilities of the financial statement auditor. The future of auditing should not be defined by replacing human professional judgment with machine output. It should be defined by using technology to extend the auditor’s capabilities while preserving human accountability for the conclusions reached and the opinion expressed.

AI in Accounting and Financial Reporting

The vision of the future of auditing is no longer hypothetical as auditors’ use of AI is moving from experiment to practice. Mark Babington, of the UK’s Financial Reporting Council (FRC), said in 2025 that “AI tools are now moving from experimentation to becoming a reality in certain audit scenarios.”¹¹ We also know that the influence of AI begins even before the audit: Within a company’s finance functions, AI can assist with transaction classification, account reconciliations, cash-flow forecasting, variance analysis, preparation of management reports, contract review, and the drafting of financial statement disclosures.

That can create considerable efficiencies. But it can also concentrate risk. A mistake by a traditional automation script may be consistent and therefore detectable. An AI agent may respond differently depending on its instructions, available data, model version, surrounding context, or interaction with another system. Its error or hallucination may be plausible, well written, even sound like a correct answer, and therefore be difficult to recognize.

A useful principle is simple: the greater the autonomy of the system and the significance of the financial reporting consequence, the stronger the governance, validation, documentation, and human oversight should be.

Weighing the Benefits and the Risks

I do not think that anyone seriously questions that responsible use of AI in the performance of audits can have significant benefits. The Technology Task Force of the International Forum of Independent Audit Regulators (IFIAR) identified benefits of more consistent execution across engagements, enhanced risk assessment using predictive analytics or real-time data, and the identification of unusual or unauthorized transactions.¹²

At the same time, using AI in the performance of audits involves risks that an auditor must navigate. The FRC organizes the technology risks to audit quality into three categories: deficient output, misuse of output, and a methodology that does not comply with auditing standards.¹³ For agentic AI systems, the FRC also warned of “amplification risk” that could arise when “individually insignificant errors or biases introduced by one [AI] component get magnified when subsequently processed by itself or other components, leading to potentially significant deficiencies in the final output.”¹⁴ The IFIAR Technology Task Force also cautions of the “potential over-reliance on outputs without sufficient challenge of the work performed.”¹⁵

While the opportunity is real, so is the caution. A system that identifies “unusual” entries may miss a fraudulent entry specifically structured to appear ordinary. It may produce too many false positives. Or, it may direct the auditor toward mathematically unusual items rather than items that are risky in the context of management incentives and controls.

Agentic AI and Co-piloted Auditing

The distinction between generative AI and agentic AI is also important. A generative AI system usually responds to a prompt. An agentic AI system pursues an objective. It may plan, act, evaluate, revise, and act again. In a multi-agent environment, different agents may assume specialized roles and exchange information.

The academic paper that I mentioned earlier, “Artificial Intelligence Co-Piloted Auditing,”¹⁶ contemplates an audit approach in which foundation AI models augment the human auditor’s work, with “auto-piloted” workflows, in which agents perform complex and interdependent audit tasks. This research explores the possibility of a collaborative, synergistic interaction between auditors and AI models for a “co-piloted audit process” that “capitalizes on each other’s strengths to deliver comprehensive and accurate audits.”¹⁷ The authors suggest that “[t]his transformation will impact not only the workflows but also redefine the competencies required across the various roles within audit firms.”¹⁸

As the technical capabilities continue to advance, however, I would caution that an auditor should guard against letting concepts like “co-piloted audit” cause the auditor to forget who is in charge in that arrangement. The auditor should resist automation bias, the tendency to accept a machine recommendation or conclusion because the system is sophisticated and appears to be objective. The critical thinking skill that has always been important to an auditor’s obtaining and evaluating audit evidence is no less important in an AI-assisted audit, where it should also be applied to watch for whether an agent’s output shows signs that something may be awry with the agent’s work.

The Role of the PCAOB

Of course, one question that arises is how a regulator, such as an audit regulator, should approach its responsibilities with respect to regulated entities’ use of AI. Research by Marc Eulerich, Scott Summers, and David Wood concluded that clear and stable regulatory standards can lead auditors and companies toward more efficient investment in AI, while vague or evolving guidance may cause overinvestment, underinvestment, or reluctance by companies to adopt potentially beneficial systems.¹⁹ The authors write that “regulatory clarity is not a mere administrative detail.”²⁰

I agree with this central principle. Clarity and innovation should not be viewed as opposing goals. Regulatory clarity can facilitate responsible innovation. At the very least, regulation should avoid posing unnecessary obstacles to innovation.  

I regularly ask the leaders of audit firms registered with the PCAOB if our standards in any way limit, hinder, or prohibit their ability to implement technology tools in their audits, including the ability to innovate using AI. The answer I have consistently heard is that the standards pose no such obstacle. If the answer were otherwise, I would hope that we would look carefully at eliminating the obstacle.

Beyond that principle, there is the question of whether additional PCAOB regulation is necessary to take account of new risks in an age of increasing AI usage. On that question, it is important to distinguish between two broad categories: issues relating to how a company’s use of AI affects the information that an auditor reviews, and issues relating to how an auditor’s use of AI in its work affects the audit process.

The first category – the company’s use of AI – has important implications for the nature of audit evidence. AS 1105, Audit Evidence, defines audit evidence as “all the information, whether obtained from audit procedures or other sources, that is used by the auditor in arriving at the conclusions on which the auditor's opinion is based.”²¹ As companies increase the use of AI to process, post, and analyze financial transactions, their ability to produce evidence of the underlying logic of actions performed by AI may become difficult. A company’s AI output cannot be viewed by an auditor as reliable merely because it is detailed, internally consistent, or drawn from a large amount of data. Just as has always been the case, auditors will still need to consider the source of information, evaluate the reliability of the model, assess it for potential bias, and determine if outputs and results can be reproduced.

The second category relates to how auditors use their own AI in performing the audit. For example, the supervision of audits conducted under PCAOB standards is governed by AS 1201, Supervision of the Audit Engagement. When the Board adopted this standard in 2010, the Board did not contemplate that AI agents would be performing audit procedures, let alone that agents would be able to review the work performed by other agents. In this new environment, how do auditors ensure that the humans are playing a large enough role, and the right role? It is not hard for me to imagine that, as we observe the use of AI in practice, through our inspections, we might identify reasons to provide guidance about what does and does not constitute compliance with AS 1201 when AI is involved. 

More broadly, how does the auditor balance the use of AI tools with the responsibilities for critical thinking, professional skepticism, due care, and accountability? A machine may search. It may calculate. It may compare. It may draft. It may find patterns no auditor could find alone. But it does not hold a professional license. It does not owe a duty to investors. It does not sign the audit report. And it does not bear responsibility if the audit fails.

Conclusion

As I close, I want to go back to what brought us here today. For 75 symposia, the World Continuous Auditing & Reporting Symposium has challenged accountants and auditors to think differently about time, evidence, systems, and assurance. Professor Vasarhelyi and his colleagues understood early that a world of continuously generated information would ultimately require more timely and technologically capable forms of monitoring and assurance.

Today, AI can help auditors analyze more information, analyze it faster, identify unusual activity, automate repetitive procedures, and strengthen risk assessment. Even so, I fully expect that investors’ trust in audited financial statements will continue to depend on their having confidence that humans stand behind all of those agents’ activity, and that those humans have executed their work with professional skepticism, integrity, rigor, and sound judgment. 

As we move further into what Professor Mollick calls the age of co-existence, the ultimate objective, and the realistic goal, is an audit in which the human is better informed, better directed, and more capable of protecting investors. That is the opportunity before us.

Thank you. I look forward to the panel discussion and welcome your questions and comments.