Your AI Is Now An Internal Control. Your Auditor Will Test It Like One

Jacqueline DeStefano-Tangorra is the President and CTO of DataOps.

​The first thing I learned as an auditor when I worked in Big 4 had nothing to do with whether a number was right. It was a question I asked hundreds of times over six years: Where did this report come from, and how do you know it’s complete?​

That question is about to land on a new target. Finance teams spent 2026 putting AI into the close. Agents now match reconciliations, draft journal entries, suggest accrual estimates and write the variance commentary that goes to the audit committee. For many public companies, this year-end will be the first time an external auditor walks into a close process where software, and not only people, is making judgment calls.​

Most of the finance leaders I talk to want to know whether a new AI audit rule is coming. The less comfortable answer is that auditors don’t need one.​​

The PCAOB does not currently have an auditing standard written specifically for AI. Its work on AI remains focused primarily on research and potential staff guidance on how companies’ and auditors’ use of AI affects audits. Existing standards such as AS 2201, which governs audits of internal control over financial reporting, are not AI-specific and already require auditors to consider IT involvement and automated controls when evaluating financial-reporting processes.

Two dates raise the stakes this cycle. The PCAOB’s amendments addressing auditors’ use of technology-assisted analysis apply to audits of financial statements for fiscal years beginning on or after December 15, 2025. For calendar-year companies, that means the 2026 audit is the first audit subject to those amendments.

Then, on December 15, 2026, the PCAOB’s new quality control standard, QC 1000, takes effect and puts audit firms’ own use of technology under a brighter light. Firms that are tightening how they govern their own tools are unlikely to relax their expectations of yours.​​