AI for CPA Firms: Practical Uses and Review Rules

CPA firms handle audit, tax, advisory, and accounting work that carries professional accountability. AI can support the writing-intensive and research-intensive parts of that work: drafting client communications, summarizing tax authority guidance, reviewing a memo for completeness, or generating a list of questions for an engagement planning meeting. Professional judgment, sign-off, and confidentiality obligations stay with the licensed accountants.

The practical challenge for a CPA firm is not finding AI uses; it is setting clear rules about what AI may do, what requires human review, and what stays outside AI tools entirely. Tools like fenbs keep those approved rules and the project context together, so every team member and connected assistant works from the same boundaries.

Where AI fits in CPA work

Research is one of the clearest fits. When a tax practitioner needs to understand a recent IRS ruling, a Treasury regulation, or a state tax development, AI can provide an initial summary and identify the key sections worth reading directly. That summary does not replace reading the source: it identifies which source to prioritize and what questions to bring to it.

Drafting is another strong fit. Engagement letters, client-facing memos, and responses to inquiries all require clear, accurate writing. AI can produce a first draft that the CPA then reviews, revises, and signs off on. The CPA's professional knowledge and review is what makes the document appropriate for the client: AI provides a starting point, not a finished product.

Internal workpapers and documentation also benefit. AI can help structure a memo, suggest the sections that should be present for a particular type of conclusion, and draft narrative explanations of accounting positions. The numbers and the conclusions come from the CPA's work; AI helps communicate them clearly.

Confidentiality rules and data handling

AICPA standards and state licensing rules impose confidentiality obligations on CPAs. Client tax information, financial data, and engagement details are confidential. Before using any AI tool with client-specific information, a firm needs to understand how that tool handles data: whether it is stored, whether it is used for training, and what happens in the event of a data incident.

The safest approach for most firms is to use AI for tasks that do not require entering client-specific data: general research, draft templates, internal process documentation, and training materials. When client data must be involved, the firm should use tools with appropriate data processing agreements and confirm those agreements satisfy the applicable confidentiality obligations.

The AICPA↗ (opens in a new tab) publishes guidance on technology use in accounting practice. State boards of accountancy may have additional guidance on AI use. Checking both before deploying AI tools in a client-facing context is the right starting point.

Tax research and authority checking

AI handles tax research questions well at a general level: explaining what a particular IRC section covers, describing the types of transactions a regulation addresses, or summarizing the steps in a penalty abatement process. The practitioner still reads the cited authority before relying on it, especially for anything that involves judgment calls or positions that could be challenged.

AI can be wrong about specific code sections, regulation numbers, and effective dates. A hallucinated citation is one of the risks in AI-assisted tax research. Cross-checking every authority citation against the actual IRS or Treasury source is not optional: it is a professional obligation. Use AI to find the starting point, not as the final authority.

The IRS↗ (opens in a new tab) publishes its own research tools, including the Internal Revenue Bulletin, Treasury Decisions, and the Internal Revenue Manual. For any substantive tax position, those primary sources are what the conclusion rests on.

Workflow and project context

CPA engagements often span months, involve multiple team members, and accumulate a significant body of decisions and workpapers. Keeping the project context current means the next session or the next person on the engagement does not have to reconstruct what was already decided.

Documenting the decisions that governed a tax position, the research steps taken, and the review points completed is already part of professional practice. Keeping that documentation in a form that a connected AI can read before the next session makes each session more productive and less likely to revisit settled ground.

For broader advice on managing AI tools across a professional firm, the how-to-use-ai-at-work guide and the AI employees overview both cover governance and handoff practices that apply to accounting teams.

Audit support and documentation considerations

Audit and attest engagements operate under strict independence requirements and professional standards that govern how evidence is gathered, evaluated, and documented. Before introducing any AI tool into audit work, the firm needs to assess whether the tool's use creates an independence concern and whether it changes the audit documentation in a way that affects the evidentiary record. Those assessments belong to the engagement partner and the firm's quality control personnel.

Within those boundaries, AI can support the non-professional parts of audit documentation. Drafting the narrative section of a workpaper that describes a procedure and its results, generating a confirmation request letter from a standard template, and summarizing the results of analytical procedures are tasks where AI can produce a starting draft. The professional accountant reviews, revises, and signs off on every document before it enters the workpaper file.

Risk assessment and materiality decisions are professional judgments that AI does not make. AI can help the team organize and summarize the information that informs those judgments, describe the factors typically considered in a risk assessment for a given industry, and draft the workpaper documentation that records the judgment once it is made. The substance of the risk assessment remains with the engagement team and is the engagement partner's professional responsibility.

Audit standards require that every conclusion in the workpapers is supported by sufficient appropriate evidence. An AI-drafted narrative that is not reviewed and corrected by a professional does not satisfy that standard on its own. The audit partner bears responsibility for the quality of the workpapers and the basis for the opinion. AI use in audit documentation is a drafting tool, not an evidence-gathering or conclusion-forming one.

The PCAOB↗ (opens in a new tab) and the AICPA each publish standards and guidance relevant to audit quality and documentation requirements. State boards of accountancy may have additional requirements for licensed professionals in their jurisdiction. Reviewing current standards before introducing AI into any audit workflow is the right starting point, and documenting how AI was used on the engagement is increasingly relevant to audit quality inspection processes.

The firm's AI use policy is a living document, not a one-time statement. As AI tools develop, as professional standards bodies publish new guidance, and as the firm's own experience accumulates through actual use on engagements, the policy needs regular review and updating. AI can help draft policy revisions from a description of what has changed and what the revised policy should address. Firm leadership reviews and approves each revision before it takes effect, and the updated policy is communicated to the team members it affects. Keeping the current policy version in a shared location that connected assistants read before starting any client work ensures the rules are applied consistently across the whole team rather than being interpreted independently by each individual person. Annual review of the policy ensures it stays current with the evolving guidance from professional standards bodies.

How to do this with fenbs

fenbs gives a CPA team a shared place for approved procedures, engagement context, and the decisions that govern AI use. No client data belongs in it.

1. Create a free account. Set up a team board for the practice group or engagement team. Team boards let you assign roles that match your review structure.
2. Add a project for each major engagement type or practice area. Write the standard steps, applicable review requirements, and any approved AI use rules for that project type.
3. Record AI use decisions in Decisions and rules: which tasks AI may support, which require senior review, and which are off-limits. Set the person who decided each rule so the record is attributable.
4. Connect a supported AI app from Integrations. Before each work session, ask the connected assistant to read the project context and the current rules so it works within the agreed scope.
5. Track research tasks and review steps on the board. Move them through the lanes as they are completed, and add notes on what was checked and by whom.