In a move to set guardrails for auditors using artificial intelligence (AI), the National Financial Reporting Authority (NFRA) has issued its first technology guidance on the use of generative AI, agentic AI and other technologies in statutory audits. Through a note on Friday, the regulator has made it clear that even though tech can be used to improve audit quality and efficiency, it cannot dilute auditors’ professional responsibility and accountability.
The audit watchdog said that the responsibility of auditors remains “non-delegable” and warned them against attributing flawed conclusions to AI tools. “The responsibility for the audit opinion remains with the auditor, irrespective of the sophistication of the tools used. Technology may inform and accelerate professional judgement; however, it cannot be a substitute for it and cannot be invoked to explain away an inappropriate conclusion,” the note said.
The guidance comes at a time when large audit firms, including Big Four firms like PwC, KPMG, Deloitte and EY, are rapidly deploying AI across audit processes, including areas like risk assessment, data analytics, document review and audit testing.
Vendor Vetting
NFRA also said that firms should not rely solely on claims made by AI vendors. The regulator specifically advised auditors not to “rely on vendor claims about a tool’s accuracy or reliability without independent evaluation by the firm.” Further, the guidance places the onus of data protection squarely on audit firms. It said client and personal data processed through technology tools must be protected in accordance with the DPDP Act, the IT Act and other applicable regulations, adding that “a firm cannot rely on a vendor’s terms of service (without validation) or on the convenience of a tool, as a substitute for its own responsibility to protect client and personal information.” The regulator also called for particular attention to cross-border data transfers where AI models are hosted outside India.
Guarding Against Automation Bias
NFRA warned auditors against “automation bias” which is a defined by a tendency to accept machine-generated results without sufficient challenge because they appear credible. “Technology cannot be expected to exercise professional scepticism on the auditor’s behalf; it must be exercised by the person relying on the output,” the note said. NFRA added that indiscriminate or excessive reliance on machine-generated outputs may amount to a failure to exercise the fundamental principles of professional competence, judgment and due care.
Jaspreet Bedi, senior partner (audit & assurance) at Nangia & Co LLP, said that AI and advanced analytics can significantly enhance audit quality and efficiency but NFRA makes it absolutely clear that technology can never replace auditor responsibility, professional judgment or scepticism. “NFRA has ensured that accountability remains human. More importantly, it sends a clear signal that AI is not a convenient alibi for weak judgments or deficient audits. Auditors can leverage technology to work smarter, but they cannot outsource their judgment or accountability,” Bedi said.
On the use of agentic AI, NFRA said governance requirements should depend on the risks posed by the technology. For instance, a simple translation tool does not require the same level of scrutiny as an agentic AI tool that selects and tests audit samples. Applying identical checks to all AI tools could lead to unnecessary compliance for low-risk applications while failing to adequately assess high-risk ones.