Who Is Actually in Control? Audit Leaders Debate AI Autonomy Vs. Human Judgment

Mandatory KPIs or cultural pull. Human in the loop as a quality lever or a liability shield. The main question on audit and finance professionals’ minds: how much control does AI vs. human judgement?

The closing panel at Connect '26 London tackled AI and auditing head-on, and did not shy away from the answers of this question.

Four firms, four geographies, and four genuinely different answers on everything from AI risk and ROI to what the profession owes its next generation of auditors. Here are the takeaways that came from this debate.

Panel debate at Connect '26 London.

Figure out if your firm has a real AI audit strategy or just a good story

"We've got a story. That's for sure. And it's good," Toon said. Most audit firms are somewhere between the two: a real AI strategy and a good story to paint. A small number of firms are doing genuinely sophisticated work, a larger number handed a tool to their junior staff and watched it go nowhere, and a significant portion still have not made a basic decision about which model to use.

The middle ground, structured pilots with clear use cases and real training behind them, is where almost no one is.

Part of the reason is that audit firms have spent decades selling solutions by technology vendors. Large language models do not come with solutions attached. For the first time, firms must generate their own answers, and most were not built for that.

What separates the firms making progress with AI

It’s the internal structure around it. Two approaches from the panel illustrate the range.

MHA tied AI adoption to partner KPIs, with accountability built into remuneration. The immediate reaction was resistance. That shifted. Partners who were pushed into using the tools found them effective and started asking for more. The cultural question moved from whether to use AI to how to use it better. The distinction between efficiency and effectiveness is worth sitting with here: efficiency is time saved, effectiveness is whether the quality of work improved. Measuring the latter is harder, but it is the right thing to measure.

Stop building the ROI case the same way you always have

The deeper issue is that firms do not run ROI calculations when they hire a person. Agents are doing work that human capital used to do. Holding that investment to a different standard of justification, one that the humans performing the same tasks were never held to, is not rigorous analysis. It is a comfort exercise. "We don't undertake ROI calcs when we employ someone, so why should we undertake an ROI calc on an agent?" Toon said.

That does not mean measurement does not matter. It means the measurement needs to be honest about what it is capturing. Feedback loops on actual time savings, on specific working papers, on real engagements, are worth far more than a firm-wide ROI model built on assumptions.

Take the human in the loop question seriously, not just literally

The regulatory floor is clear: no regulator is going to allow a machine to sign an audit report yet. What it does not settle is what the human is actually doing when they are in that loop.

The AI failures that have caused embarrassment for audit firms over the past 18 months have a common thread: a human was technically in the loop but did not check the output properly. The accountability sits with the partner who signed the report regardless of how the work was produced. That will not change. "Ultimately, people want human things, and we want to hold someone accountable for the work that's been done," de Abreu said.

The uncomfortable comparison most firms avoid

AI and auditing invite an uncomfortable comparison: most firms do not measure the accuracy of their auditors. Nobody tracks how often a junior ticks off an invoice they did not fully verify, or how many review points a manager misses under deadline pressure. That work passes through the process, gets signed off, and moves on. When an AI tool produces a result that is 90% accurate, the room wants to know about the other 10%.

Toon put it plainly: "90% accurate is materially pretty good. The regulators should be pretty happy with that." The point behind it is sharper than the line. If firms applied the same scrutiny to their people that they apply to their tools, the comparison would not favor the humans as clearly as most partnership meetings assume.

The more useful frame is not whether a human is present in the process, but whether the human who is present understands what they are reviewing. Using AI is like relying on an expert for a pension calculation. You must know what it is doing. A partner who cannot explain the tool to a regulator has a problem that no policy document solves.

Build governance into the tool, not just the policy document 

Most audit firms wrote their AI policy six months after ChatGPT launched. In the gap, staff were using whatever tools they could access, including putting client data into models with no guardrails. That is not a failure of technology. It is a governance failure, and it is still playing out in firms that have a policy on paper but have not thought through what happens at the point of actual use.

The problem with policy-first governance is that it is always retrospective. By the time a document is written, reviewed, and approved, the technology has moved. The mismatch between how fast capabilities change and how slowly governance adapts is where the real risk lives. Toon's prescription: AI governance needs to be revisited every six to eight weeks. Most firms are not structured to do that.

Governance that works at the point of use, not after the fact

Auditing AI systems well means building the guardrails into the deployment itself. When staff are required to document how they challenged an output and how they reached their own conclusion, the policy becomes secondary. The behavior is already happening at the point of use. That is the difference between governance that watches what people do and governance that shapes what people do. The latter does not require monitoring. It is embedded in the workflow.

The firms making the most progress are not the ones that waited for governance to be perfect before rolling anything out. They are the ones that identified the right person to lead adoption: not the compliance team, not the head of audit, but someone curious, project-minded, and trusted by the teams doing the work. "Find the person that's curious, someone that's a naturally good project manager," Passmore said.

The junior AI auditor question is really a question about how judgment gets built 

The auditor’s profession had known this conversation was coming. When AI takes over entry-level work, how do junior auditors develop the judgment to review it?

Nobody has fully solved it. But the panel pushed back on the assumption that ticking and bashing is where judgment gets built in the first place. Audit failures do not happen because someone missed a bank reconciliation. They happen in going concern reviews, in post-balance sheet assessments, in the moments that require skepticism about management's estimates. The question is whether the profession can develop that experience faster, now that the years of mechanical work that preceded it are being compressed or removed.

Redefine what junior auditors are being trained for before AI does it for you

The most concrete proposal from the panel: treat junior auditors like pilots. Simulators from day one, running through failure cases and edge cases, building pattern recognition through structured exposure to what can go wrong rather than through years of routine work.

At the firms further along this journey, the shape of junior AI auditor roles is already changing:

• Entry-level staff are being trained in client communication, project management, and higher-level audit procedures earlier than previous generations were.
• Training is shifting away from how to complete a working paper and toward what happens when an output is wrong.
• The 5  anomalous items out of 100 that require judgment are where the focus is going, not the 95 that the agent handles correctly.

The hierarchy is compressing. The risk is that the profession's training infrastructure does not compress fast enough to match it.

The other risk, and the one that closed the session, is burnout. Disengagement comes from repetitive work. Burnout comes from sustained cognitive load. As firms automate the routine and replace it with more analytical work, they need to think about what that shift does for the people carrying it.

Using AI to take on more clients without reducing cognitive demand is not a productivity gain. It is a different kind of problem wearing a productivity label. That is the real work ahead for AI and auditing: building capacity without breaking the people who deliver it.

Connect '26 continues in New York.