Writing the firm's AI use policy
What an accounting or audit firm's AI use policy should cover, from drafting and data to review and monitoring, and the Achekam controls behind it.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Most firms already use AI, whether or not they have decided to. A trainee asks a chatbot to explain a lease standard. A manager pastes a client's management letter points into a tool to tidy the wording. A partner tries a drafting feature on a set of notes. Each use may be sensible. Together, without rules, they are a quality risk the firm cannot describe, let alone manage.
A written AI use policy turns scattered habits into decisions the firm has made. It tells staff what they may do, gives reviewers something to check against, and lets the firm explain itself to clients, regulators and its own quality reviewers.
This article sets out what the policy should cover, with the Achekam controls each section can rely on, and the places where the firm has to decide for itself.
Why write it down
Quality management standards expect a firm to manage the risks in how it does its work, including the technology it uses. The IAASB's page on ISQM 1 describes the requirement for audit and review firms to design, implement and operate a system of quality management tailored to the firm and its engagements. AI is now part of how many firms' engagements are performed, so it belongs in that system.
A policy also protects staff. Someone who followed the firm's written rules is in a far better position, when a draft turns out to be wrong, than someone who improvised.
Keep it short. A policy staff can read in ten minutes and remember is better than a long one nobody opens.
Section one: what AI may draft, and what people decide
Start with the dividing line. A clear policy says AI may help prepare, and people decide.
Achekam enforces part of that line. Its AI engine refuses any task whose type is giving an opinion, reaching a conclusion, approving or signing. On working papers, staff can ask AI to draft a conclusion or a procedure's response, suggest review notes or explain an automated observation, but a draft goes into the file only when a person saves it. Each working paper moves through preparation, manager review, partner review, an optional engagement quality review, completion and lock; the preparer cannot also review it, and Achekam refuses any sign-off made by an AI.
The policy should add the firm's own rules on top, for example:
- which kinds of work AI may draft, such as first drafts of conclusions, note wording or covering e-mails;
- which it may not, for instance anything the firm considers a key judgement, such as going concern conclusions;
- that the person who saves an AI draft owns it as if they had written it.
A template can forbid AI drafting on a working paper. If the firm decides certain areas are off-limits for AI, configure the relevant templates to match, so the policy and the system say the same thing.
Section two: data that must not be sent
The policy should list what staff may never send to an AI vendor, and the controls that support it.
By default, the engine removes South African ID numbers from text before it is sent, a setting an administrator can switch off. The policy should say whether the firm keeps that default, and should name the identifiers and documents staff must not paste into any AI tool, including national identifiers from Nigeria and Kenya, bank details and passwords.
It should also say which vendor and key the firm uses. Achekam's engine can use Anthropic, OpenAI, Google Gemini, DeepSeek or xAI, using the firm's own key first and the platform's key only where allowed. Record the firm's choice and the reason. Feature-by-feature detail on what is sent is in what client data leaves the firm with AI.
Finally, cover tools outside Achekam. If staff may not use public chatbots for client work, say so.
Section three: reviewing and labelling drafts
An AI draft should never reach a client or a file without a person reading it, and readers should know it started as a draft.
In financial statements, when an AI key is set up, AI writes narrative text such as the nature of business and note wording. That text is checked in code and labelled "AI draft - review before issue". The figures come from code, not from the AI. There is no separate accept step for each paragraph: the safeguard is the review stages and the partner's signature.
The policy should therefore say what reviewers must do with labelled drafts:
- Read every AI-drafted paragraph against the client's facts, not just for style.
- Check any statement of fact, standard or law against its source.
- Confirm no client detail has been invented or carried over from elsewhere.
- Remove or rewrite anything the reviewer would not have written themselves.
Section four: monitoring use
A policy that nobody monitors becomes a wish. The AI Activity Log lists every AI request with vendor, model, tokens and estimated cost, and a workspace administrator can switch AI off for the workspace.
Name who reads the log and how often, what they look for, and who may switch AI off and when. What the firm's AI use costs suggests a monthly routine.
Section five: breaches and review
Say what staff should do if they send something they should not have: report it at once, to whom, and what the firm will do next. Make clear that reporting a mistake promptly will be treated better than hiding it.
Set a date to review the policy, at least yearly and whenever the firm adds an AI feature or vendor.
Draft the five sections in a single page this month, have the quality partner approve it, and walk the whole team through it before anyone is asked to sign that they have read it.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
