When things get real, accountants talk about internal controls. AI is bigger and faster than any one of us, so we put a COSO board member, all four audit firms, the vendors, the consultants, and 200 p
Oh man, I've got some digesting to do with this article! We are using AI a lot in our audit practice to assist with testing, and the points about reliance are pretty much the convos being had by my audit team back in January of this year.
We ended up opting to test the outputs (much like how we conduct other testing), with special weight for the more "material" outputs. Glad to see this line of thinking is being used by some other smart people out there!
Thanks for sharing this Baron! It always feels good to know you're on the only ones thinking like this and I'm glad we're all getting to a similar place. Would love to know how this evolves for you. The technology is changing so fast I feel like we are using all of our old existing skills and developing new ones daily.
Thanks for the reply, Angela. Maybe us accountants will survive this AI adoption after all!
I would not be surprised as these technologies progress, if CPAs/Auditors enter into a special role providing attestation services for AI tool outputs. Sort of like a SOC in a way, is what I'm thinking.
The sorting exercise at the end is the part I am going to actually do, and I want to name why it is harder than it looks from our side of the desk.
We run outsourced accounting operations for twenty-nine clients in Japan. On paper we were solidly in non-reliance: a person approved every entry our extraction tool produced. Preparer and reviewer split intact, control documented, tickmark applied. The entries were wrong for a subset of clients for months. Nothing about the classification was false on the day it was written. It stopped being true quietly, because a systematic misconfiguration produces plausible output - wrong account, right magnitude, consistent month over month - and consistency is what defeats a reviewer.
So what I would add to shadow reliance is that it is rarely a misclassification. It is a correct classification that decays. The sort is point-in-time. The reliance is not.
Which is why the independence caution you raise about multi-model consensus lands somewhere else too. HITL Intent 2 - sample the population, find nothing, presume the rest - is borrowed from audit sampling, and sampling assumes errors are independent draws. A model's errors are not draws. They are one rule applied N times. So sample size stops doing any work: five items and fifty items both tell you the rule fired, or both miss it entirely. A clean sample licenses the rest of the population only if that population was processed by something capable of being wrong in uncorrelated ways.
Our answer to your last instruction, since I am proposing it: we record correction rates only partially. So I cannot tell you what fraction of our reviews change anything, which means I cannot tell you whether we are in non-reliance or in shadow reliance. That is the honest state of it, and it is the measurement going in next month.
Oh man, I've got some digesting to do with this article! We are using AI a lot in our audit practice to assist with testing, and the points about reliance are pretty much the convos being had by my audit team back in January of this year.
We ended up opting to test the outputs (much like how we conduct other testing), with special weight for the more "material" outputs. Glad to see this line of thinking is being used by some other smart people out there!
Thanks for sharing this Baron! It always feels good to know you're on the only ones thinking like this and I'm glad we're all getting to a similar place. Would love to know how this evolves for you. The technology is changing so fast I feel like we are using all of our old existing skills and developing new ones daily.
Thanks for the reply, Angela. Maybe us accountants will survive this AI adoption after all!
I would not be surprised as these technologies progress, if CPAs/Auditors enter into a special role providing attestation services for AI tool outputs. Sort of like a SOC in a way, is what I'm thinking.
The sorting exercise at the end is the part I am going to actually do, and I want to name why it is harder than it looks from our side of the desk.
We run outsourced accounting operations for twenty-nine clients in Japan. On paper we were solidly in non-reliance: a person approved every entry our extraction tool produced. Preparer and reviewer split intact, control documented, tickmark applied. The entries were wrong for a subset of clients for months. Nothing about the classification was false on the day it was written. It stopped being true quietly, because a systematic misconfiguration produces plausible output - wrong account, right magnitude, consistent month over month - and consistency is what defeats a reviewer.
So what I would add to shadow reliance is that it is rarely a misclassification. It is a correct classification that decays. The sort is point-in-time. The reliance is not.
Which is why the independence caution you raise about multi-model consensus lands somewhere else too. HITL Intent 2 - sample the population, find nothing, presume the rest - is borrowed from audit sampling, and sampling assumes errors are independent draws. A model's errors are not draws. They are one rule applied N times. So sample size stops doing any work: five items and fifty items both tell you the rule fired, or both miss it entirely. A clean sample licenses the rest of the population only if that population was processed by something capable of being wrong in uncorrelated ways.
Our answer to your last instruction, since I am proposing it: we record correction rates only partially. So I cannot tell you what fraction of our reviews change anything, which means I cannot tell you whether we are in non-reliance or in shadow reliance. That is the honest state of it, and it is the measurement going in next month.
Great article!