.png)
A few weeks ago, we sat down with fifteen retired Big Four partners.
Between them, they had spent the better part of a century building audit teams, reviewing workpapers, and signing opinions for public companies. They had watched every technology wave crest and break: client-server, the cloud, RPA, analytics, and the entire GRC platform industry. They had learned, the hard way, that most "revolutions" in audit turn out to be slightly faster ways of doing the same types of manual work.
So when we told them AI was about to change how audit actually gets done, they did what good auditors do. They asked for evidence.
We gave them some.
We uploaded a control narrative, the prior year's workpapers, and the supporting evidence into Complify AI. The control being tested was deliberately unremarkable — a standard user access review, the kind tens of thousands of auditors test every year without a second thought.
Then we let the agent work. It parsed the control attributes, determined what evidence was required, pulled and reviewed the supporting screenshots, validated the user population, selected the sample, tested each item in the sample, flagged the exceptions, applied tickmarks, and created the workpaper. The output was the documentation a staff or senior auditor would normally spend the better part of an afternoon producing.
Then we handed it a second control. Then a third.
The reaction in that room was one we have now seen dozens of times:
"Wait. It can do all of that?"
The surprise is never that AI is improving — everyone knows that. The surprise is the category of work that has crossed the line. It is one thing for a model to draft an email or summarize a meeting. It is another for it to execute a complete professional workflow, beginning-to-end, with the evidence trail to back it up.
And audit follows a structured workflow that's perfectly suited for AI adoption. This re-focuses the auditor's attention to understanding the root cause of testing exceptions and why controls failed.
The Last Twenty+ of SOX Auditing
For decades, the profession has run on one stubborn model:
Humans gather evidence. Humans review screenshots. Humans select samples. Humans compare populations. Humans document conclusions. Humans prepare workpapers.
Technology improved the edges. Spreadsheets moved to the cloud. Shared drives became GRC platforms. Manual evidence requests became automated reminders. But the load-bearing work never changed. A staff auditor in 2026 spent their day on essentially the same activities as a staff auditor in 2002 — collecting evidence, validating screenshots, reconciling reports, and updating workpapers.
The bottleneck was always labor. As clients grew more complex, firms responded the only way the model allowed: they hired. More controls meant more systems meant more screenshots meant more auditors. The entire profession was architected around the assumption that human throughput was the binding constraint.
That assumption is now failing in public.SOX testing is burdensome, costly, and has taken the "joy" out of auditing. The rote nature of the testing, and the unspoken pressure to "pass", has left auditors, particularly those just entering the profession, wondering whether they chose the right profession and counting the days until they can leave SOX to do something more interesting and challenging either with their employer or elsewhere.
From Assistants to Agents
For the first few years of the generative AI era, the model was an assistant. You asked; it answered. You assigned a sliver of a task; it completed that sliver. A human stayed in the loop for every handoff, responsible for stitching the steps together.
That architecture has changed. Modern agents don't answer questions — they execute workflows. Given the right context, tools, and guardrails, an audit agent can read a control narrative, identify test attributes, determine and request the required evidence, review screenshots, validate populations, select samples, perform the testing, document exceptions, generate the workpaper, draft review notes, and escalate the genuine judgment calls to a human.
The decisive difference is that it does not stop and wait for a person after every step. This is not faster productivity software. It is a different operating model.
This is not a vendor's daydream. Through 2025, every Big Four firm moved past traditional automation into what the industry now calls agentic AI. EY equipped 80,000 of its tax professionals with access to 150 AI agents through its EY.ai Agentic Platform, and reports the platform processes millions of compliance cases annually. EY has advanced 1,000 AI agents into development or production, plans to scale to 100,000 by 2028, and is investing more than $1 billion annually in AI platforms. PwC introduced its agentic platform, Agent OS, in March 2025 and has since deployed 25,000 intelligent agents across client operations. KPMG launched Workbench in June 2025, a multi-agent environment that mirrors a human audit team, where agents hand tasks to one another and built-in logs document every decision. Deloitte rolled out Zora AI, an agentic platform built with Nvidia offering "intelligent digital workers," and in October agreed to deploy Anthropic's Claude to its 470,000 employees worldwide.
The most telling signal comes from the assurance side, not the marketing side. PwC's U.S. assurance transformation leader said in late 2025 that end-to-end, AI-driven audit automation should be expected sometime within calendar year 2026, with a tool for every step from planning to risk assessment to walkthrough to evidence collection to testing to financial statement review. The plumbing already exists in pieces: PwC's Evidence Match is an agent-led module that automatically extracts and validates evidence against documents, supporting high-volume areas such as cash, accounts receivable, and accounts payable, with a clear evidence trail for each match.
Why Audit Is Uniquely Exposed to the AI Revolution
Software engineering fell first because code already lives in a machine-readable world — version-controlled, testable, structured. Audit is more similar than auditors like to admit.
Controls are documented. Evidence is digital. Testing procedures are standardized. Outputs follow repeatable formats. Workpapers are structured. Review processes are defined. The profession spent decades manufacturing consistency in the name of quality — and that very consistency is what makes agentic execution tractable. The more structured the process, the easier it is to automate. Few processes are more structured than an audit.
There is an irony here worth sitting with: the standards built to make audit more rigorous are the same standards now lowering the cost of doing it without a human in the chair.
Skills Moving from Doer to Thinker
When we watch how teams actually use Complify AI, the constraint moves. Fieldwork stops being the bottleneck. Judgment becomes the bottleneck.
Once evidence gathering, sample testing, documentation, and workpaper prep are largely automated, organizations don't suddenly need fewer decisions — they need more, and faster. Someone still has to ask whether the control is even designed appropriately.
Whether the exception is material or whether compensating controls exist. Whether a single finding is a symptom of a wider failure. What remediation is warranted. What residual risk is acceptable. Those questions don't delegate cleanly to a model, and as throughput rises, the volume of them rises with it.
So the center of gravity shifts. The future auditor spends less time documenting and more time evaluating risk. The future compliance leader spends less time chasing evidence and more time strengthening controls. The future partner spends less time policing formatting and more time advising. The profession doesn't vanish. Its weight shifts.
What Happens to the Firm
Professional services were built on leverage. Partners oversee managers, managers oversee seniors, seniors oversee staff. The pyramid exists because expertise is scarce and junior labor is cheap — and you bill the spread.
Agents put pressure on the base of that pyramid, and the data already shows the strain. The Big Four posted more job adverts for AI specialists than for auditors in 2025; AI roles made up almost 7 percent of postings in English-speaking countries, more than triple the 2022 figure, while audit roles accounted for just under 3 percent. PwC confirmed it is decreasing campus hiring, citing technological change, and aims to cut entry-level hiring by roughly one-third over three years. In the UK, graduate accounting job listings fell 44 percent year-on-year, and EY delayed graduate start dates for a third consecutive year.
If one experienced auditor can supervise the output of what used to be several teams, firms have to rethink staffing, pricing, training, career progression, and client delivery all at once — because the traditional answer of "hire and bill more juniors" is the exact thing being automated away.
This cuts deeper than headcount. When the people performing substantive assurance procedures are increasingly technologists rather than chartered accountants and CPAs, audit-quality regulation has to evolve to inspect technology, model behavior, and tool validation — not just sample testing and partner sign-off. And the technology is not infallible: in October 2025, Deloitte agreed to partially refund the Australian government after errors were found in a report created in part using AI. That failure is not an argument against the model — it is the clearest possible argument for where the humans now belong: on review, validation, and judgment, not on data entry.
Firms that adapt become dramatically more scalable. Firms that don't will find themselves competing — on cost, speed, and assurance — against organizations that have already made the shift. The transition won't happen overnight. The direction is getting hard to argue with.
The Bigger Shift: Continuous Compliance
The largest change may not happen inside the audit at all. It may happen between audits.
Controls were historically tested periodically because testing was expensive. A sample of twenty-five transactions was a practical truce between cost and assurance — never a statement that twenty-five was the right number, only that it was the affordable one.
Agents dissolve that truce. When testing becomes software, the marginal cost of testing one more item trends toward zero, and the old compromise stops making sense. Organizations can move from periodic validation to continuous monitoring: testing entire populations rather than samples, catching exceptions in real time rather than discovering them months later in fieldwork. Audit stops being a snapshot and becomes a live system.
That is where the real leverage lives. Not in making the annual audit faster. Rather, in making compliance continuous.
Who Wins
Every technology wave changes who creates value. The cloud rewarded organizations that could move faster. Mobile rewarded those that built better experiences. AI rewards organizations that can coordinate intelligence — that know how to govern, review, and apply machine-generated work effectively.
The defining question of the last twenty years was "How many people can we hire?" The defining question of the next twenty is "How much judgment can we apply?"
That distinction is the whole game. Intelligence is becoming abundant. Judgment remains scarce — and scarcity is where value accrues.
Audit Is Next
The future of audit is not fewer auditors. It is better ones — spending less time collecting evidence and more time understanding risk. Compliance teams managing fewer requests and improving more controls. Organizations spending less time preparing for audits and more time operating well enough that the audit is almost an afterthought.
The firms and companies that lean into this will move faster, reach higher assurance, and shed an enormous amount of manual work. The ones that wait will eventually learn what software engineers learned first:
The work didn't disappear.
The operating model did.
And audit is next.