Technology can't substitute professional judgement, audit quality responsibility lies with auditor: NFRA

New Delhi: The National Financial Reporting Authority (NFRA) has issued ten “general principles” on technology adoption in audits, encouraging the deployment of latest tools but making it clear that the ultimate audit quality responsibility lies solely with the auditor.

“Technology may inform and accelerate professional judgement; however, it cannot be a substitute for it and cannot be invoked to explain away an inappropriate conclusion,” the regulator said.

The “general principles” are part of the first edition of the NFRA Staff Series on Technology in Audit. It sets out a principles-based framework, dos and don’ts and changes to audit processes and systems within which statutory auditors of public interest entities are required to evaluate, deploy and govern the use of technology.


The principles come at a time when new-age technologies--such as data analytics, automated tools and techniques and artificial intelligence--are moving from being efficiency aids to core components shaping audit processes.

The regulator said its principles are technology-neutral and outcome-based. They focus on the adequacy and appropriateness of audit evidence, the quality of risk assessment and the integrity of the audit opinion.

They neither mandate nor bar the use of any specific tool, vendor or technique. “However, the auditor cannot treat the usage of a tool as a substitute for meeting the requirements of any underlying standards,” the regulator said.

The responsibility for the audit opinion, it stressed, remains with the auditor, irrespective of the sophistication of the tools used.

Output from automated tools and techniques can be considered as audit evidence, or an input to it, only once its relevance and reliability have been evaluated by the auditor, it said.

“With this, NFRA sends a clear signal that artificial intelligence is not a convenient alibi for weak judgments or deficient audits. Auditors can leverage technology to work smarter, but they cannot outsource their judgment or accountability,” said Jaspreet Bedi, senior partner (Audit & Assurance) at Nangia & Co LLP.

Data protection, professional scepticism in audit Client and personal data processed by or through any tech tool must be protected in sync with an audit firm's confidentiality obligations under the relevant ethical principles, the Digital Personal Data Protection Act, 2023, and any other sectoral requirements, the NFRA said.

“A firm cannot rely on a vendor's terms of service (without validation) or on the convenience of a tool, as a substitute for its own responsibility to protect client and personal information,” it said.

The regulator underscores the need for auditors to exercise professional scepticism, saying technology cannot be expected to do so on their behalf. It also calls on auditors to fight automation bias in machine output.

An audit firm's quality control system should identify and address any risks associated with a technology before its deployment and not after, the regulator said.