Introduction

The world is ever-changing and more so, the world of technology. In the realm of accounting and auditing, we can say that the first wave of transformation happened with the introduction of computers with software that required some level of coding knowledge. The next wave came with the introduction of simple accounting software that does not require coding knowledge but is largely decentralized requiring periodical manual consolidation for making sense of the performance of the business. Different applications were used for different functions; these were operating in silos and sometimes enabled data export or import for use in other software. Then with the advent of internet and advanced networking capabilities giving rise to the possibility of centralization of data and applications, a radical transformation, rather re-engineering, happened with the introduction of enterprise resource planning (ERP) software and in the case of banking businesses, implementation of core banking solution (CBS). Now another wave of transformation is happening with the advent of technologies like big data, artificial intelligence (AI), smart contracts, radio frequency identification (RFID), Internet of Things (IoT), cloud computing, robotic process automation (RPA) and blockchain technology. Such technology comes with its own possibilities and challenges, which were hitherto unforeseen by the lawmakers. The regulators themselves are experimenting with such technology and some have already introduced them at least in the back end.

Now as the world treads an untrodden path, the professionals– especially the accounting and auditing professionals are expected to be the guiding force. This article is an attempt to discuss the basic elements of AI and the various implications of AI and related technology in the areas of accounting and auditing.

Decoding Artificial Intelligence

i. Necessity is the Mother of Invention - Going beyond Automation

As Billy Ocean, a famous English Singer sung in 1985 “When the going gets tough, the tough get going”, tough times call for tough decisions. During the pandemic, many businesses realized the need for infusing technology in their businesses in a bid to optimise utilisation of resources both in terms of money and manhours. One such technology which has been growing in leaps and bounds and found increasing adoption since the pandemic is Artificial Intelligence (AI). Most of us are already acquainted with some general applications of AI like natural speech recognition, advanced web search, generative tools, self-driven cars and creative tools.

Towards Better Governance and Ease of Doing Business

Regulators too have been zealous in adopting AI tools to achieve better governance and regulation of entities. For example, the Ministry of Corporate Affairs has deployed AI in the V3 version of its MCA21 portal. As the quality of data that is collected also improves on the one hand through deployment of technology like XBRL, deploying AI capabilities enables regulators to spot red flags earlier. This could also double up as an exercise towards ease of doing business the data could be pre-filled or cross-verified from earlier filings. SEBI also envisages to use it for applications like surveillance.¹ In the future, regulators may establish a common database or at least inter-connectivity among the databases in such a way that cross-verification of data filed with different regulators is possible and any discrepancy could be further investigated.

ii. Matters of Concern in Usage of AI

Though use of AI results in a great deal of automation, AI cannot be regarded as mere automation. Automation runs on a fixed algorithm wherein the program logic is pre-defined, and when compared with AI, we can say it is almost hard-coded. However, AI, although based on algorithms and human inputs, is designed to continuously learn and improvise. It aims to mimic human thought processes and cognitive abilities. Implementation of technology, especially a technology that can think for itself or at least learn to think for itself, has its own benefits, but there are some matters of concern:

iii. Enforcing the Stakeholders’ Right to Explanation

“An important factor to consider before deploying an AI tool especially in decision-making settings is understanding and trust.”

Explainable AI (XAI) is an attempt at enhancing the trust factor by helping us understand how a decision has been arrived at – a white-box approach instead of a black-box approach.² This approach to AI would be better for accounting and decision-making systems as the public as well as the regulators have the right to understand. In this context, the right to explanation has been recognised by the European Union in the General Data Protection Right in the recital clause.³ Other jurisdictions like France and the US have also alluded to and recognised this right in some circumstances. However, whether enforcing this right through legislation is beneficial or possible is debated, as simpler AI systems could be amenable to this requirement, whereas AI tools that operate on much-higher level and layered-algorithms may not be able to be subject to this just as the reason why a human being takes a particular decision may not always be easily explained. Further, requiring explainability may stifle the very evolution of AI technology. However, in a larger context and in public interest, the right to explanation is an important one.

An examination and review of the rightness of the decisions made by the AI systems by an information systems auditor instead of seeking an explanation is also proposed as an alternative. Under the Consumer Protection Act, 2019, Consumer Protection (E-Commerce) Rules, 2020 have been issued to address the issues arising in e-commerce.⁴ These Rules require an explanation of the main parameters based on which rating of sellers is made, in plain language. If a platform uses AI to rank goods or sellers, the requirements under these Rules must be factored in. It must also be understood that explainability is crucial for the developers and businesses to ensure that the AI system is working as expected, not just in terms of the decision taken but in terms of the way in which the decision is arrived at, which is necessary to build the required level of trust to deploy it for the intended purposes.

iv. Ethical Concerns and Regulatory Measures

One of the ethical concerns in the use of AI is regarding data protection and privacy. With the deployment of AI and Big Data analytics, an entity may unintentionally or intentionally process sensitive data in an unauthorised way and that may intrude on privacy interests. The lawmakers and regulators, the world over, are still grappling with the implications of AI and the security and privacy concerns. At present, under section 43A of the Information Technology Act, 2000, which deals with compensation for failure to protect data, “Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011” have been issued. These Rules provide for procedures to handle sensitive personal data or information.⁵ Under the proposed Digital Personal Data Protection Bill, 2022, unauthorised use of data may constitute a “personal data breach”.⁶ Under the proposed Digital India Act, 2023, measures to regulate as well as to foster innovation in AI and other emerging technologies are being proposed.⁷ NASSCOM has also come up with Guidelines on Generative AI.⁸ On 14th June, 2023, the European Parliament approved its position on the world’s first AI Act under which AI systems are classified based on the risks they pose: from unacceptable risk, high risk, generative AI and limited risk, based on which obligations for providers will be imposed under the rules.⁹ It, inter alia, seeks to ban using of AI for purposes like biometric surveillance and recognition of emotions, and requires generative AI to disclose that the content is AI-generated.¹⁰

While all these concerns still remain and are addressed to some extent with evolving laws, businesses have already started exploring the possibilities that could open a floodgate of opportunities for them by adopting AI relevant to the business context.

Applications of AI in Accounting

Having discussed some basic aspects of AI, now let us look at some specific use cases of AI in accounting and compliance for businesses:

i. Reconciliation Process

A significant use case of AI in accounting is reconciliation – be it bank reconciliation or inter-company reconciliation for group entities or for creditors and debtors balance confirmation processes. If done manually as it is done at present in many businesses, it is time consuming and laborious as one witnesses the problems of duplicate entries, mismatched entries, partially-entered invoices, tax aspects, accounting errors and other inconsistencies. This can be overcome with machine learning (ML) technology that uses predefined matching rules and which learns based on the results of the datasets. This will enable more reliable and timely disclosures of related party transactions.¹¹ Such features are now available in ERP software as well as in the form of applications that can be deployed on existing software or popular cloud-based applications.

ii. Managing Related Party Transactions

Another potential application could be in the very process of identifying and understanding complex group structures of large conglomerates. Larger businesses usually arrange their ownership and control structure, business models and transactions in the form of a complex web of group entities spread across geographies, often in layers of entities, and sometimes, wherever permitted, with cross-holdings or cross-control, formal and informal. The group structures may or may not fall strictly under the definition of related party as per the applicable laws.

Hence, the regulators world over are requiring increasingly comprehensive compliance and disclosure in respect of related party transactions, as they are a significant indicator of the level of good corporate governance. In India, for instance, for listed companies, the definition of ‘related party’ and ‘related party transactions’ has been widened to a great extent under the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, so much so that even transactions with third parties “the effect of which is to benefit a related party”, or transactions of the listed company or its subsidiaries on the one hand with the related parties of either on the other hand are covered.¹²

This necessitates technological intervention both by the conglomerates for making continued sense of the strategy as well as for better risk monitoring by the various stakeholder groups of these entities, especially the lenders. For the businesses, AI tools could help in better compliance and in making complete and timely disclosures of related party transactions under the applicable laws.

As far as stakeholders like the lenders are concerned, they need to be able to have the big picture of the entire group to follow the money trail and understand whether the funds have been deployed for the stated purposes or whether they are being siphoned off to benefit certain members of the promoter group. Here AI could help banks and financial institutions in understanding the overall control structure, business model and the consolidated financial strength of the borrowers with complex group structures. This will be a crucial information while evaluating funding proposals and arrangements – both initial and ongoing.

iii. Screening Profiles to Manage Risks

“AI tools can potentially be used for fraud risk mitigation, inter alia, by screening vendor and customer profiles from various sources and assess counter-party default risks.”

AI tools can potentially be used for fraud risk mitigation, inter alia, by screening vendor and customer profiles from various sources and assess counter-party default risks. This could also ease complexities involved in some disclosure requirements under the Schedule III to the Companies Act, 2013 like tracing of transactions with defunct companies or disqualification status of directors at least to the extent of disqualification arising out of a defaulting company under sub-section (2) of section 164 of the Companies Act, 2013 by comparing them with the database of Ministry of Corporate Affairs.

For financial sector entities, the efforts towards understanding the group structures and activities through AI as described in the previous para could double up towards strengthening fraud risk management and anti-money laundering measures. It could help in setting up better Early Warning Signals as required under the Reserve Bank of India’s (RBI) Master Direction on Frauds, and in better reporting of transactions required under the provisions of the Prevention of Money Laundering Act, 2002.

iv. Inventory Management

When it comes to inventory management, a combination of AI together with RFID could help track, manage and account for inventory on an almost real-time basis, thereby enhancing the reliability of accounting records. Use of RFID combined with smart contracts and AI can help establish a seamless trust-based supply chain management system. This will again go towards better accounting and reporting.

v. Timely Reporting

AI can also optimize Record-to-Report (R2R) process leading to more reliable and timely preparation of financial statements. Often delay in obtaining data at the grassroot level leads to delay in reporting. This can be overcome by introducing technologies like RFID, big data and AI, to automate and expedite recording of transactions at the point of origin of the transactions.

vi. Management Accounting

AI has applications not only in financial accounting but also in cost and management accounting. When it comes to better internal reporting systems and decision-making systems, AI, IoT, RFID and Big Data analytics could play a great role in culling out hidden cost behaviours, demand patterns and in making more realistic forecasts. The possibility of using the entire population for the analyses instead of only a sample is also available when AI is coupled with Big Data. Entities have been able to gather data from various sources but if they are unable to make sense of the data or they are unable to focus on the information needs, they end up in a state of being Data-Rich-Information-Poor (DRIP). Introduction of AI here will help an entity to make sense from the raw data and focus on obtaining relevant information, which can become actionable inputs to the management. Right from automating repetitive decision-making to risk mitigation, AI can be used. However, it should be remembered that periodic human intervention is necessary to evaluate and judge the reliability of such AI-based decision-making systems.

Role of AI in Audit Process

As eloquently described in “SA 200: Overall Objectives of the Independent Auditor and the Conduct of an Audit in Accordance with Standards on Auditing”, the overall objective of an audit of financial statements is to give an opinion on whether the reporting requirements as per the applicable financial reporting framework have been met. Under the provisions of the Companies Act, 2013, the duty of the auditor here is to express an opinion on whether the financial statements present a true and fair view of the affairs of the company. The auditor while arriving at this opinion by obtaining reasonable assurance on whether the financial statements are free from material misstatements, whether due to fraud or error, is required to evaluate whether the audit evidence obtained is sufficient and appropriate. In this process of collecting and evaluating sufficient appropriate audit evidence, an auditor must be mindful of the impact of AI. Let us look at the impact of AI on auditing from two angles:

1. Understanding an environment that uses AI and automation
2. AI as a tool in the audit process

1. Understanding an environment that uses AI

An audit of an entity involves performing risk assessment procedures to have a clear understanding of the entity and its environment, including the adequacy and effectiveness of the entity’s internal controls in place. “SA 315 – Identifying and Assessing the Risk of Material Misstatement through Understanding the Entity and its Environment” provides guidance in this regard. Further, a “Report on the Internal Financial Controls over Financial Reporting” is mandated under sub-section (3) of section 143 of the Companies Act, 2013 for prescribed classes of entities.

In case of an entity using an ERP software embedded with AI/ML capabilities, it is likely that the internal control processes could involve AI components. Here it becomes imperative to understand how AI is used to enforce controls, preferably in a white-box manner, or at least an evaluation of the logic with test cases. The auditor should not only check the initial set of predefined rules, but also the logic with which the AI tool learns. Hence, the auditor must be careful here if any attempts at overriding the internal controls had been made and understand the response of the system to such attempts. The auditor must also be very much aware of who has the super-user or administrator rights in respect of such internal controls, just as he needs to be aware of it for the purpose of checking any tampering of edit log too. AI deployment in Internal Controls could be in the form of input controls, enhanced user-based access controls, processing controls and logic, and output controls. The consistency of the logic throughout the reporting period shall also be checked. It may also be relevant to insist on an audit of the AI tools and the environment from an Information Systems Auditor.

After performing a test of controls to evaluate whether internal controls are operating effectively to prevent or detect material misstatements, an auditor may plan his substantive procedures – a test of details and substantive analytical procedures.

For example, in the R2R process – the auditor must understand how AI processes information as part of the test of controls, and thereafter select a suitable sample and test aspects like whether the correct General Ledger (GL) Account is selected, whether taxation aspects like TDS and GST have been correctly captured, whether grouping of GL Accounts is appropriately made, and whether the schedules and disclosures generated by the AI are comprehensive and reliable. While assessing the controls in the inventory management environment that uses RFID and AI, the auditor may check how the data from RFID scanners interacts with the AI logic and how it is implemented in the ERP system. The entire audit team needs to have hands-on knowledge of AI tools which are deployed in the client entities and evaluating those in the process of audit execution.

2. AI as a tool in the audit process

a. AI in Statutory Audit engagements

“AI can help analyse the financial information of the clients and assess the areas where the potential risk of material misstatements is the highest.”

An auditor can himself / herself use AI tools in the audit process. While an audit is neither an investigation nor is it an exercise towards giving an absolute assurance, deployment of AI in auditing could help provide an even higher level of assurance than may otherwise be possible. At the elementary level, generative AI can help arrive at some useful basic checklists which can be improved to greater detailing based on the requirements of the assurance levels required.

AI can help analyse the financial information of the clients and assess the areas where the potential risk of material misstatements is the highest. While the auditor may himself be subject to at least some degree of familiarity bias, the AI tool, is more likely to be free from such bias. The auditor may then apply more substantive procedures in the areas so identified.

AI may also help in determining materiality and in the assessment of whether an identified misstatement is material in the context of the entity. The auditor can then come with an optimized audit strategy and plan and perform the audit in a better way. AI may also help with sampling of test cases for audit by choosing a sample free from bias thereby reducing sampling risk.

AI may also help with analysing whether the evidence might be sufficient for assessing the risk of material misstatements at the assertion level by helping establish a correlation between the evidence and the assertion. It can also help assess whether an audit observation based on a sample will be true for the entire set of data.

When it comes to substantive analytical procedures, AI tools combined with big data can help identify hidden patterns of behaviour of various variables and unearth and establish relationships among financial and non-financial information in a more comprehensive manner. Use of AI in analytical procedures might help identify red flags much earlier than they would otherwise be and help establish an early warning system for the use of the auditor.

AI can also help the auditor and his team perform an engagement quality control review as required under “SQC 1 – Quality Control for Firms that Perform Audits and Reviews of Historical Financial Information, and Other Assurance and Related Services Engagements”, by assessing the appropriateness of the opinion arrived at based on the audit evidence collected.

Specifically, the auditor will be in a better position to give his / her opinion on the various matters covered under the Companies Auditors’ Report Order, 2020, especially in respect of related party transactions, material uncertainty in respect of meeting the liabilities, and also with respect to whether the terms of the loans and guarantees provided by the company are prejudicial to the interests of the company.

b. AI as a tool in other audit engagements

AI could help not only in statutory audit engagements but also has applications in internal audit, tax audit, forensic audit, etc.

In tax audits, when it comes to verifying the matters of disallowances, depreciation, TDS, TCS, reconciliation, deductions, and more importantly, in determining the arm’s length nature of transactions in the Report on Transfer Pricing as required under section 92E of the Income Tax Act, 1961, use of AI as a tool comes in handy.

With big data, AI analytics can greatly help the internal auditor in measuring the effectiveness of the internal controls in a comprehensive manner, although adequacy may be something that will be best left to the judgment of the internal auditor based on the results of the analysis thrown by the AI. Areas of internal control weaknesses can be identified in a much better manner.

As far as forensic audit and investigations are concerned, samples could be chosen on a more scientific basis with the help of AI. Better samples would lead to better information for arriving at conclusions. In case of audit of specific transactions, AI tools can help arrive at the degree of correlation between the factors involved.

c. Challenges in implementing AI and results of AI in auditing

The biggest challenge in implementing AI is understanding how the AI tool arrives at the output, so to say, how it “thinks”. Although some experts are of the view that using anthropomorphic words like “think” further reduces our understanding of the processing behind AI, it is necessary to understand how the output is arrived at. Here is where XAI as discussed earlier becomes important. No matter what human-like terms we use, AI is still not human. It does not experience emotions and thoughts like we do. It does not have a gut feeling. Hence, while AI can supplement and support an auditor, it can never substitute or supplant the auditor in the human process of forming an opinion which will always remain the dominion of the auditor.

The next challenge could be empowering the employees of the enterprises and the audit team with knowledge and understanding of the potential uses and challenges involved in AI. This requires an open mind to be able to appreciate the concept of AI. The other operational challenge will be how to integrate AI tools and capabilities with existing software and hardware. These are usually mitigated by using cloud-based AI compatible with existing applications.

Concluding Thoughts – Converting Challenges into Opportunities

“The CAs are increasingly being looked upon to drive the process of professionalism within their domain, which ultimately leads the way towards ease of doing business.”

In order to face the new world order that may be established or that already may have been established with AI, accounting and auditing professionals need to re-orient themselves away from routine areas of work that may be replaced with AI tools and equip themselves with the knowledge and skill required to work with AI and even to work on AI to stay relevant in the vastly dynamic professional world. In this process, they may need to unlearn things to transcend the clutches of routine work and learn new things to achieve mastery over AI tools. Then instead of looking at AI as a threat to their existence, the Chartered Accountants (CAs) may even take up opportunities in implementing AI for their clients or auditing the AI environment or the AI controls, or even in designing AI tools that can lead to better reporting and governance.

As a fallout of AI implementation, several changes need to be made to various statutes in respect of various sectors of the economy, some of which are already in the pipeline as detailed in one of the earlier paragraphs on regulatory measures. Following this, the regulators like the RBI and SEBI also need to come out with detailed guidelines on AI-related impact on their respective sectors. The Institute of Chartered Accountants of India (ICAI) may like to come up with Guidance Notes and/or suitable updates to the Accounting and Auditing Standards, in order to guide the Members through the phase of transition to AI environment. To further pave the way for easing the future generation of CAs into this dynamic new business and professional world running and operating in the AI environment, the ICAI may consider to upgrade the curriculum itself by including therein the subjects relating to accounting and auditing in an environment enriched with AI.

The CAs are increasingly being looked upon to drive the process of professionalism within their domain, which ultimately leads the way towards ease of doing business. In this context, the judicious use of AI comes in handy and CAs have a major role here. CAs must realise that the scope of application of their skills and experience goes beyond the traditional lines of audit, accounting and taxation, and it very well extends to strategic areas like implementing AI-driven business process re-engineering and supporting the top management of businesses in this transition. While section 144 of the Companies Act, 2013 prevents an auditor from rendering these services to the entities where they perform statutory audit, nothing prevents a CA from taking up those assignments in respect of other unrelated entities. A CA should boldly step into the realm of technology.

Every change is borne of a storm. It requires the eyes of someone who can soar high above the storm clouds to make sense of the change. A CA, like the Eagle that represents him/her, has the foresight and the capability to soar above the clouds and guide the businesses that are caught in this storm of technological upheaval. However, to fully realise the potential, a lot more needs to be done by the CAs in terms of learning, re-learning and developing new skills as well as quickly unlearning the irrelevant skill components. The ICAI along with the regulators will need to enable this transition by providing the right framework.

---

Footnotes & References

1. SEBI Annual Report 2020-21: https://www.sebi.gov.in/reports-and-statistics/publications/aug-2021/annual-report-2020-21_51610.html
2. Explainable Artificial Intelligence: https://en.wikipedia.org/wiki/Explainable_artificial_intelligence
3. Right to explanation: https://en.wikipedia.org/wiki/Right_to_explanation
4. Consumer Protection (E-Commerce) Rules, 2020: https://consumeraffairs.nic.in/sites/default/files/E%20commerce%20rules.pdf
5. Information Technology Rules, 2011: https://www.meity.gov.in/writereaddata/files/GSR313E_10511(1)_0.pdf
6. Digital Personal Data Protection Bill, 2022: https://www.meity.gov.in/writereaddata/files/The%20Digital%20Personal%20Data%20Potection%20Bill%2C%202022_0.pdf
7. Digital India Act Presentation: https://www.meity.gov.in/writereaddata/files/DIA_Presentation%2009.03.2023%20Final.pdf
8. NASSCOM GenAI Guidelines: https://nasscom.in/ai/responsibleai/images/GenAI-Guidelines-June2023.pdf
9. EU AI Act First Regulation: https://www.europarl.europa.eu/news/en/headlines/society/20230601STO93804/eu-ai-act-first-regulation-on-artificial-intelligence
10. EU Parliament Negotiation on AI: https://www.europarl.europa.eu/news/en/press-room/20230609IPR96212/meps-ready-to-negotiate-first-ever-rules-for-safe-and-transparent-ai"
11. Machine Learning in SAP Reconciliation: https://www.groupsoftus.com/insights/using-machine-learning-ml-in-sap-for-reconciliation/
12. SEBI LODR Regulations, 2015: https://www.sebi.gov.in/legal/regulations/feb-2023/securities-and-exchange-board-of-india-listing-obligations-and-disclosure-requirements-regulations-2015-last-amended-on-february-07-2023-_69224.html

---

Authors may be reached at: cs.ushaganapathy@gmail.com, a.sekar.cs@gmail.com, ranjithk.iyer@gmail.com and eboard@icai.in