If your auditor doesn’t understand your ERP, APIs and AI controls, can they really understand your financial reporting risk?
NFRA’s new Advisory Committee on Audit Quality, Assurance and Technology may be signalling where the audit profession is heading.
Its mandate specifically covers AI/ML in audits, cybersecurity, cloud, ERP systems, automated controls, APIs, system logs, digital payments and blockchain. That list is revealing.
Because financial reporting risk increasingly sits inside systems that produce the numbers. An automated control can fail. An API can transmit incorrect data. A system configuration can alter how a transaction is classified.
An AI model can influence a decision without leaving the kind of audit trail people are used to reviewing. And an ERP can process thousands of transactions correctly until one configuration change makes thousands of them wrong.
So the audit question is changing. It is no longer enough to ask: “Is the balance correct?”
We also need to ask: “What technology produced this balance, what controls sit around it, and can we trust that process?”
That requires auditors to understand more than accounting standards. They need to understand how the client’s technology environment affects the financial statements.
NFRA’s committee includes technology, CFO, assurance, independent-director and former regulatory expertise – another indication of how interconnected these risks have become.
The future of audit may be less about auditing numbers after they are produced. And more about understanding how the numbers came to exist.
