Audit software and AI as quality resources
How a firm evaluates the audit software and AI tools it relies on as resources within its ISQM 1 system of quality management, and what to document.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
A few years ago, a firm's audit software was mostly a filing cabinet with a tick-box layer on top. Today it proposes samples, suggests mappings, flags journal entries, drafts working-paper conclusions and, increasingly, puts AI between the team and the evidence. A tool that does that much shapes the audit, whether or not anyone decided it should.
That is why the question "do we trust our software?" belongs in the firm's system of quality management, not just in the IT budget. A firm that relies on a tool's output without having evaluated it has a gap in its system, however good the tool is.
Software as part of the firm's resources
ACCA explains that a system of quality management under ISQM 1 must address eight components: the firm's risk assessment process; governance and leadership; relevant ethical requirements; acceptance and continuance; engagement performance; resources; information and communication; and monitoring and remediation. The risk assessment process sets quality objectives and identifies risks, and ACCA stresses that it is ongoing rather than a one-off.
Software the firm uses to perform engagements is among the resources the firm relies on. ACCA notes that ISQM 1 requires a system tailored to the firm and its client base, and the IAASB's ISQM 1 page describes the standard as encouraging firms to design their system around the nature and circumstances of the firm and its engagements. ACCA adds that it is designed to scale from small firms to large networks. A small firm does not need an elaborate evaluation, but it does need to have thought about the tools it uses and recorded what it concluded.
What to check before relying on a tool's output
For each tool the team relies on, the firm should be able to answer:
- What does it actually do? Not what the menu says, but what calculation, rule or model produces the output.
- What are its inputs? Where the data comes from, and what happens if the data is incomplete.
- Can its output be reproduced? If the same input is run again, does it give the same result?
- Who can change it? Templates, rules, thresholds and settings: who controls them, and is there a record?
- What does it not do? Limits matter as much as features.
- How will the team know if it goes wrong? A tool that fails silently is the hardest kind to rely on.
The answers belong in the firm's quality records, reviewed when the tool changes significantly.
Labels are not evidence
Software often carries labels that look like assurance: a standard number on a screen title, a badge, a pack name. Treat them with care.
Achekam is candid about this in its own product. Its Engagement Control Tower, Controls & Walkthrough Studio, Inventory Observation and TCWG & Governance Pack Centre save their work on the server for the chosen engagement, but the ISA numbers on their badges are labels, not evidence of compliance. Its working-paper template packs, written in Achekam's own words and covering audit areas, reviews, compilations, ISAE 3000, internal audit, forensic work and Nigerian and Kenyan statutory and tax work, are marked unapproved platform content until the firm adopts them. Whether the catalogue has installed in a given workspace should be checked, not assumed.
The point applies to any vendor. The firm decides whether a methodology or template meets the standards, and records that decision when it adopts it. Adopting template packs covers that step.
Where Achekam draws the line on AI and sign-off
For AI, the evaluation question is simple to state: what can it do without a person? In Achekam, the AI engine refuses any task whose type is giving an opinion, reaching a conclusion, approving or signing. By default it also removes South African ID numbers before text is sent to an AI vendor; that removal can be switched off in AI settings, which is itself a setting the firm should decide on deliberately.
Sign-off sits with people. Each working paper moves through preparation, manager review, partner review, an optional engagement quality review, completion and lock. The preparer cannot also review it, and Achekam refuses any sign-off made by an AI. A locked paper cannot be changed, and sending back, reopening or locking needs a written reason.
That design helps a firm's evaluation, because it narrows the question. AI may draft or suggest; the firm's own people review, conclude and sign. The firm's policy should say the same thing in its own words. A firm's AI use policy sets out what such a policy can cover.
Documenting tool output so the file stands alone
ACCA warns that audit evidence may be insufficient where data analytics procedures and inputs are not fully documented. It gives the example of a screenshot of a tool's results, which may not record the input conditions and the detail of the testing.
The practical rule: an experienced auditor reading the file later, without access to the tool, should be able to understand what was done. For each tool-based procedure, record:
- the data used, its source, period and completeness check;
- the settings, parameters or rules applied;
- the output, in a form that can be read without the tool;
- what the team did with the output, including items followed up;
- who reviewed it.
A short evaluation checklist
- List every tool the firm relies on for engagements, including AI features inside them.
- For each, record what it does, its limits and who controls its settings.
- Check that sign-off and conclusions remain with people.
- Decide which templates and packs the firm has adopted, and when.
- Test reproducibility on a sample engagement.
- Revisit the evaluation when the tool changes or a monitoring review finds a problem.
Pick the tool your teams rely on most, run it through this checklist, and file the result in the firm's quality records.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
