ACRA Sets Responsible AI Controls for Audit Practice

The Accounting and Corporate Regulatory Authority issued Audit Practice Guidance No. 1 of 2026 on responsible use of artificial intelligence. It addresses both auditors using AI in audit procedures and auditors evaluating information prepared or assisted by AI.

The guidance centres on integrity, professional judgement, accountability, transparency, and data confidentiality and security. It states that AI can assist but does not replace professional judgement, and that auditors remain responsible for the work performed, conclusions reached and audit opinion expressed. The document is practical guidance and its considerations are not exhaustive.

Audit evidence can appear complete while its references, assumptions or classifications are fabricated or contextually wrong. The guidance therefore shifts the control question from whether an AI tool was used to whether the engagement team can reconstruct inputs, review steps, corroboration and human ownership of the final conclusion.

Audit firms should inventory approved AI uses by engagement stage, define review thresholds for judgemental and process-driven tasks, prohibit confidential data entry into unapproved systems, and retain the source material used to test generated output. Engagement leaders should record who approved reliance on AI-assisted analysis and what independent procedures supported that decision.

ACRA cites Singapore accounting-entity AI adoption rising from 6 percent in 2023 to 11 percent in 2024. The new evidence requirement is not the percentage itself but the control record behind each use: tool identity, data boundary, prompt or instruction history where retained, validation work, reviewer and final conclusion.

In Singapore, the guidance directly informs auditors and audit firms operating under ACRA's professional and regulatory environment. ASEAN network firms may use the control concepts as a regional benchmark, but each member-state practice remains subject to local audit law, professional standards, data rules and regulator expectations. Singapore guidance is not an ASEAN-wide legal instrument.

Watch for inspection findings, disciplinary cases, revisions to audit methodology and local professional guidance that make particular controls mandatory. Evidence that firms cannot reproduce the basis of AI-assisted conclusions would falsify any claim that a high-level policy alone provides adequate governance.