The AICPA's New AI Risk Council and Audit Guidance: What Firms Should Know (Fall 2026)

By The Professions Cloud Editors Updated October 2026 · 5 sources · 3 min read

Prices and facts checked October 13, 2026. We don't accept payment for rankings.

What happened: on September 22, 2026, the AICPA and former IRS Commissioner Danny Werfel launched the Council on AI Risk in Tax (CART) to develop practical approaches to responsible AI in tax practice and administration (The Tax Adviser, Sep 23, 2026). On October 12, the AICPA released a practice aid, "Artificial Intelligence (AI) Considerations for Financial Statement Auditors" (AICPA & CIMA).

Why it matters today: the profession is building its own AI guardrails rather than waiting for regulators. These resources show what "reasonable" AI practice is starting to look like, which matters for peer review, malpractice defense and client expectations.

CART: the AI tax risk council

Sources: The Tax Adviser; Accounting Today, Oct 8, 2026.

The framework behind it

Werfel's AI Risk Framework for Tax has 20 risk areas in four categories: information integrity, fairness and legitimacy, security and data, and institutional capacity (The Tax Adviser). He plans annual updates, with a second version expected in about six months (Accounting Today).

Werfel's position: "The only way AI can be responsibly deployed is in concert with human subject matter experts that understand the domain." The AICPA's Melanie Lauridsen said fast-moving AI makes lasting standards impractical for now, so the framework isn't binding (Accounting Today).

Why it matters for small firms: the IRS has issued AI guidelines for practitioners (our explainer), and CART's framework is likely to become the reference point for what a reasonable firm AI policy covers.

The audit practice aid

The AICPA's new practice aid addresses two things (AICPA & CIMA):

1. How a client's use of AI affects financial reporting, risk assessment and the audit response. For example, AI in revenue recognition or estimates.
2. How auditors can use AI tools in procedures while still meeting professional standards.

It's nonauthoritative and available to AICPA & CIMA members. There's still no standalone AI auditing standard, so auditors apply existing standards to AI.

Why the AICPA is moving now

Its 2026 CPA Firm Top Issues Survey (629 respondents, April–May 2026) ranked managing change from technology and AI as the No. 1 issue for the next five years for firms of every size (CPA Practice Advisor, Jun 23, 2026). The AICPA's Lisa Simpson added: "Regardless of technology capabilities, accounting is still a people business."

What firms should do

1. Write or update your AI policy around the four framework categories: data integrity, fairness, security and staff capacity.
2. Auditors: add a question to planning about how the client uses AI in financial reporting, and document how you responded.
3. Tax: align your procedures with the IRS OPR guidelines and track CART's outputs.
4. Train staff: change management is the risk the profession named itself.
5. Watch the DCPA26 conference (December 6–9) for more CART and AI guidance (CPA Practice Advisor).

FAQ

Is CART issuing rules?

No. It's a working group refining a voluntary framework and producing guidance and tools.

Can non-members get the audit practice aid?

It's reserved for AICPA & CIMA members.

Do small firms need an AI risk framework?

A short written policy covering approved tools, data handling, review and training covers the essentials and matches what the IRS and AICPA are signaling.

Changelog: Oct 13, 2026: first published.