AI Can Test Every Transaction. Can Your Auditor Prove It Made the Audit Better?

What a UK Review of the Six Largest Audit Firms Revealed About Technology Governance — and Five Questions Every Nigerian Audit Committee Should Ask

By Joe Adinma, FCA, FCTI — Managing Partner, Joe Adinma & Co. (Chartered Accountants)

Last updated: 11 October 2026

Picture a conference room overlooking the Port Harcourt waterfront. A team of junior auditors is watching a screen instead of a ledger. Software has just scored every transaction in a client's general ledger — not a sample of two hundred, all of it — and flagged a handful as unusual. A week of sampling work, condensed into an afternoon.

It is a composite scene, not a specific file. But the capability is real. Full-population analysis, increasingly AI-assisted, is built into the global audit platforms the largest networks run, and at least two of their Nigerian member firms publicly describe those platforms as part of their audit offering. How far that capability is used on any particular Nigerian engagement is a separate question, and one published material cannot answer.

The real question for the room is what happens next: whether anyone asks if the flagged handful are the right ones, and whether the firm can show that the tool made the audit better, not merely faster.

That second question is close to what the UK's Financial Reporting Council (FRC) found unanswered when it reviewed technology governance at the UK's six largest audit firms, in a report published in June 2025. It is also the question Nigeria's own FRC put on the table — without, so far as any published report shows, answering it with an inspection — at its Audit and Assurance Leadership Summit in Lagos on 13 August 2026, themed "Audit Integrity in the AI Era: Independence, Accountability and Reliable Financial Reporting."

A Summit, Not a Rulebook

As at October 2026, we have not identified any published FRC Nigeria thematic review of AI-enabled audit tools. That is not proof that no assessment has happened: ICAN and ANAN have long run quality-assurance reviews of their members' practices, and a regulator's internal work is not always published. But nothing public yet measures what these tools are doing to Nigerian audit quality.

What the FRC has done is convene a conference: a one-day hybrid gathering at the Lagos Marriott Hotel, Ikeja, with a guest list that signals the subject is being taken seriously. Dr. Rabiu Olowo, the FRC's Executive Secretary/CEO, gave the welcome address. Dr. Chris Osa Isokpunwu, Permanent Secretary at the Federal Ministry of Industry, Trade and Investment, declared the summit open on behalf of the Minister.

The panel that gave the summit its edge, "AI and the Future of Audit Quality," included PwC's Chief AI Officer and Deloitte's AI & Data Senior Manager, debating the subject in front of their own regulator.

Dr. Olowo's message was clear, if not yet backed by any specific rule: AI's adoption in audit, he said, "must be guided by robust governance frameworks, accountability mechanisms, and the highest standards of professional ethics." The panel's reported conclusion ran the same way. AI tools can strengthen audit effectiveness, but auditors remain answerable for the judgments behind their opinions.

No new guidance came out of that room, and no published Nigeria-specific inspection has followed it. For now, the regulator has named the question and left the market to answer it. What the UK found when it looked at its own largest firms is the closest thing Nigeria has to a preview.

The stakes are not abstract. An audit opinion is the document a bank reads before extending a facility, and the document a foreign investor reads before wiring capital into a Nigerian subsidiary. Who may sign it is now governed by the FRC's National Audit and Assurance Firms Register; our earlier piece, Is Your Auditor Even Allowed to Sign Your Accounts?, covers that in detail. If the tool that helped produce the opinion was adopted faster than anyone measured whether it improved the work, the opinion still carries the same weight on the page. That is precisely the problem.

What the UK Found When It Looked

On 26 June 2025, the FRC published two separate documents. The first was guidance on documenting AI-assisted audit procedures, built around an illustrative example of AI applied to journal-entry testing. The second was a standalone inspection, "Thematic Review: Certification of Automated Tools and Techniques," of how the UK's six largest audit firms — BDO, Deloitte, EY, Forvis Mazars, KPMG and PwC — governed the technology they had already deployed.

"Automated Tools and Techniques," or ATTs, is the FRC's broader category. Not every ATT uses AI, but the review is the closest real-world evidence of how large firms govern this kind of technology. Nor was it the FRC's first look at audit technology: it follows a 2017 review of data analytics and a 2020 review of technology in the audit.

The finding was more precise than a blanket "firms weren't checking." Most of the six had well-established processes for certifying a tool before deploying it — testing that it did what it was supposed to do. The gap sat further down the chain. In the review's words: "There was no formal monitoring performed by the firms to quantify the audit quality impact of using ATTs." One firm did report against usage targets for certain key tools. But usage tells you how often a tool runs, not what it does to audit quality, and on that question the gap applied to all six.

That distinction is the heart of the matter. Certifying that a tool works and demonstrating that using it improves audit quality are different exercises. The UK's largest firms, with the most resources to invest in this technology, had largely built the first without the second.

Nine months later, on 30 March 2026, the FRC issued its separate "Generative and Agentic AI Guidance," aimed at newer generative and agentic tools. It does not treat human review as the sole control. It sets out four categories of mitigation — system design and development, certification, staff education and governance, and human-in-the-loop review and oversight — and says that "the nature and extent of mitigating activities performed from each category is a matter of professional judgement."

Human oversight still matters. "Professional scepticism and an understanding of automation bias are important elements of appropriate oversight," the guidance says — automation bias being the tendency to trust an output simply because a system produced it. But in one of the guidance's own examples, there is by default no item-by-item human review of the tool's output; confidence comes from the other three categories instead. Human review is one layer of a control system, not a substitute for one.

AI Is Already in the Platforms Nigerian Firms Use

KPMG Nigeria's 2025 Transparency Report describes "AI integration into KPMG Clara, our global smart audit and assurance platform," including transaction scoring that lets auditors "risk-score complete populations" of transactions rather than a sample, alongside an emerging capability the report labels "human-guided agentic AI."

Deloitte Nigeria's website names and describes Deloitte Omnia, the firm's global audit platform, as part of its Nigerian audit-assurance offering. Globally, Deloitte went further in mid-2026: on 24 June, it announced "Connected Agentic Intelligence" within Omnia — AI agents that can execute preliminary procedures, including data extraction and evidence analysis, draft documentation, and develop preliminary conclusions for a human professional to review.

Those disclosures show that AI-enabled tools are built into the platforms available to these firms' Nigerian practitioners. They do not show how far those capabilities are used on any individual Nigerian engagement, or what that use has done to audit quality. And public description of a capability is not independently verified governance of it — the very distinction the UK review drew.

The useful question for a Nigerian audit committee is therefore not "does our auditor use AI?" but "can the firm show us how it is governed on our engagement?"

Efficiency Is Measurable. Audit Quality Is Harder.

It helps to be concrete about why that question is hard to answer, because "the AI checked everything" sounds like an upgrade and is not automatically one.

Take an illustrative case. An AI tool examines 100,000 journal entries and flags 35 as unusual, where a traditional sample would have tested 250 by hand. Has the audit improved? It depends — and not on the 100,000 figure.

It depends on whether the underlying data was complete: reviewing every recorded transaction says nothing about transactions that were never recorded. It depends on whether the 35 flags were properly investigated, not just generated. And it depends on what the tool missed. A system can review every line and still miss a misstatement that doesn't look like an outlier, just as a human sample always could.

Answering that properly means tracking several things, not one:

One line in that table is harder than it looks. "Known misstatements missed" assumes someone knows what was missed — but in a live audit, an undetected misstatement is precisely what nobody has flagged. Measuring it honestly needs a check from outside the tool's own output: running the tool against data with known misstatements planted in it, comparing its results with an independently performed alternative procedure, or periodically re-testing a sample the tool cleared using a different method.

None of these is free, and none is perfect. Strong results on planted test data show what a tool can detect, not how it performs on a live client's messier records. But without some such check, "the AI found more exceptions" is a claim about volume, not about whether the opinion rests on more reliable evidence.

It also helps to separate three things a firm might claim, because each needs different evidence:

Proving the first does not prove the third. The measures in the first table, tracked consistently, are the beginning of the formal quality-impact monitoring the UK's FRC found absent across all six firms it reviewed: a starting point, not a finished answer.

The Real Risk Is Not the Software

One of the clearest warnings on this subject came from George Botic, the acting Chair of the US Public Company Accounting Oversight Board (PCAOB), speaking at the AICPA's December 2025 conference. His caution was specific: "a growing dependence on AI has the potential to erode qualities" central to being an effective auditor, and AI "may also threaten auditors' professional skepticism and judgment." He cited an MIT study suggesting heavy reliance on AI tools can carry a real cost to critical thinking.

A similar warning has since been voiced in Lagos. Speaking at an audit committee conference in July 2026, a senior audit partner at one of Nigeria's largest audit firms called AI "fantastic" for efficiency, then cautioned: "AI can make mistakes. AI can hallucinate." The partner's instruction to auditors was blunt: "Whatever AI comes out with, you must review it thoroughly and ensure you can own it."

That is the right standard for an individual auditor. The harder question is whether the firm can show across its engagements that the review is actually happening, and that it is making the audit better.

Speed raises a related question: where do the savings go? Hours a tool frees up can be reinvested in deeper investigation of what it flagged, or used to take on more engagements at the same staffing level. Both are legitimate business choices. They are not the same choice for audit quality, and a firm should be able to say, with its own numbers, which one it has made.

The training pipeline is a live Nigerian pressure point too. In July 2026, ICAN's President, Hajiya Queensley Sofuratu Seghosime, said that "the new syllabus these days at ICAN is encouraging us to use embedded AI tools, looking at analytics and cyber security." That is a sensible response to where the profession is heading. But it sharpens the concern about eroding scepticism rather than settling it. If the tools arrive in training just as juniors are asked to lean on them in live engagements, who makes sure the underlying scepticism — the instinct to doubt a number before accepting it — is built first, not skipped?

This is where governance reaches past the tool. A firm can run a highly reliable AI tool and still deliver a poor audit if the engagement team misreads its output. Technology changes how audit evidence is produced, so it should change how engagements are supervised and reviewed, how juniors are trained to challenge what a screen tells them, and how partners judge whether the evidence is sufficient. A firm that has adopted the tool without adjusting them has certified the software, not the audit.

The Rules Already Exist. The Evidence of Compliance Is the Question.

None of this is happening in a regulatory vacuum, even though no AI-specific Nigerian standard exists yet. The International Ethics Standards Board for Accountants (IESBA) has already revised its Code of Ethics for this environment, with technology-related provisions on professional competence and due care, confidentiality, and the complexity technology introduces into an engagement, effective from December 2024. IESBA staff followed up in July 2026 with a further publication on emerging technologies.

Nigerian firms are also already operating under standards written broadly enough to cover AI, even though none of them mentions it by name:

Our earlier piece, Your Auditor Is Registered. But Is the Firm Meeting ISQM 1?, traced the first row of that table to a specific domestic requirement: Regulation 23 of the FRC Audit Regulations 2020, which requires auditors and audit firms to implement a quality-management system compliant with ISQM. ISQM 1, in turn, treats technological resources as part of that system: a firm must obtain or develop, implement, maintain and use them appropriately.

The consequence is significant. AI governance in a Nigerian audit firm is not waiting on a dedicated AI regulation. It already sits inside the quality-management system Regulation 23 requires. The standard-setter appears to see it the same way: the IAASB, which issues the ISAs and ISQM 1, is writing a non-authoritative guide series on applying its quality-management standards to AI-enabled tools, with the first guide anticipated in November 2026, subject to Board approval.

The practical question, then, is not whether AI is unregulated. It is whether a firm's quality-management system actually addresses the specific risks AI introduces, and whether the firm can show that it does.

Who Owns the Data After the Auditor Uploads It?

There is a second question boards can easily overlook, and it has nothing to do with whether the AI is right. It has two parts.

The first is confidentiality. A generative AI tool summarising a client's financial records is being shown commercially sensitive information — pricing, margins, supplier terms — whether or not any named individual's data appears in it. That is a duty a firm owes its client regardless of what any statute requires.

The second is data protection. Where the records do contain identifiable individuals' personal data, the Nigeria Data Protection Act 2023 governs how that information may be processed and transferred.

Both lead to the same practical questions. Where is the information processed? Could it be retained, or used to train a model, beyond the engagement it was uploaded for? What contractual and technical safeguards sit between the client's data and the platform?

None of this means every cloud-based audit platform is doing something unlawful. The answer turns on the specific data, the processing arrangement and the safeguards in place, which a firm should be able to explain rather than wave away. A board is entitled to ask, even where it cannot assess the technical answer itself.

Five Questions Your Audit Committee Should Ask

None of the five questions below requires a board member to understand the technology. They require the firm to demonstrate that somebody inside it does, and that its oversight has kept pace with what it has adopted.

1. Where in our audit is AI actually used — risk assessment, substantive testing, documentation — and what are its known limitations there? A firm that cannot answer this plainly has not yet mapped its own technology.

2. How did the firm establish that the tool is reliable for that purpose, including how it assessed the completeness and accuracy of the data the tool worked from?

3. How are the tool's exceptions and conclusions independently challenged and supervised? Who reviews that work, what happens when the firm suspects the tool missed something rather than flagged something, and has supervision changed since the tool arrived?

4. What safeguards protect our information, and who is accountable for the opinion if the tool is wrong? It is never the software. Responsibility for the opinion sits with the engagement partner and the firm, under their respective professional and legal obligations, exactly as it did before any tool existed.

5. What evidence shows the tool improved audit quality, rather than just audit speed? Time saved is not, by itself, an answer.

One caution runs the other way: an audit committee is entitled to meaningful answers and appropriate assurance, not to inspect a firm's proprietary algorithms or another client's confidential working papers. The goal is governance, not a technical audit of the vendor.

Closing

Back in that Port Harcourt conference room, the flagged transactions on the screen are not, by themselves, the risk. Full-population testing that catches anomalies a sample of two hundred would have missed is exactly the improvement AI promises, and the platforms Nigerian firms publicly describe are built to deliver it. The risk is a room that stops asking whether the flags are the right ones, at a firm that cannot yet show anyone, including itself, whether the tool made the audit better. Neither a regulator's summit nor a vendor's press release closes that gap. For now, it is the audit committee's question to ask.

How Joe Adinma & Co. Can Help

Joe Adinma & Co. helps boards and audit committees understand audit-quality requirements, the standards summarised above, and what to ask their own auditor about how technology is governed on their engagement. We do not have access to another firm's systems or working papers; this article is a starting point for that conversation, not a substitute for it.

This article is provided for general information only and does not constitute professional advice. Every engagement is different, and readers should seek specific advice before acting on anything summarised here.

How We Sourced This

• The UK findings are quoted from the FRC's standalone June 2025 thematic review, read directly. That review followed earlier FRC work on data analytics (2017) and technology in the audit (2020); it is not the regulator's first look at audit technology.

• The FRC's June 2025 documentation guidance and its 30 March 2026 Generative and Agentic AI Guidance are separate documents; what is attributed to each here was checked against that document's own text.

• George Botic's remarks were checked against the PCAOB's published transcript. A separate passage in the same speech, on private-equity investment in accounting firms, is not about AI and is not used here.

• Summit details are from FRC Nigeria's own pre-event and post-event pages.

• The Nigerian audit partner's remarks were reported independently by New Telegraph and the News Agency of Nigeria from the same July 2026 conference; quoted wording is from New Telegraph's report. The speaker is not named here, but both reports are listed below.

• Statements about Nigerian regulatory activity reflect published material as at October 2026. Not having identified a published FRC Nigeria review of AI-enabled audit tools is not evidence that no internal assessment exists.

• The Nigeria Data Protection Act 2023 is referenced in general terms only; its application to any specific platform depends on facts this article does not have.

Sources

• Joe Adinma & Co. — Is Your Auditor Even Allowed to Sign Your Accounts?

• Joe Adinma & Co. — Your Auditor Is Registered. But Is the Firm Meeting ISQM 1?

• FRC — Thematic Review: Certification of Automated Tools and Techniques, 26 June 2025

• FRC — AI in Audit: Illustrative Example and Documentation Guidance, 26 June 2025

• FRC — Generative and Agentic AI Guidance, 30 March 2026

• FRC — The Use of Data Analytics in the Audit of Financial Statements, January 2017

• FRC — AQR Thematic Review: The Use of Technology in the Audit of Financial Statements, March 2020

• PCAOB — "Like a Sentinel Standing Watch, the Financial Statement Auditor Is Indispensable to the Capital Markets," George R. Botic, 9 December 2025

• FRC Nigeria — 2026 Audit and Assurance Leadership Summit announcement

• FRC Nigeria — Summit report, 15 August 2026

• KPMG Nigeria — 2025 Transparency Report

• KPMG Nigeria — AI Resource Hub: KPMG Clara

• Deloitte Nigeria — IT & Data Analytics (Deloitte Omnia)

• Deloitte — Connected Agentic Intelligence within Omnia, 24 June 2026

• IESBA — Technology-Related Revisions to the Code

• IESBA staff — Emerging Technologies: A Characteristics-Based Approach to Ethical Considerations for Professional Accountants, 15 July 2026

• IAASB — October 2026 eNews (AI-enabled tools guide series)

• NAN News — ICAN President on AI in the syllabus, 12 July 2026

• New Telegraph — 2026 Audit Committee Conference coverage, 1 July 2026

• NAN News — 2026 Audit Committee Conference coverage, 2 July 2026