On 2 October 2026, ACRA published Audit Practice Guidance No. 1 of 2026: Using Artificial Intelligence Responsibly. It speaks to auditors, audit firms and accounting entities, and it puts into one place the questions every firm using AI should now be able to answer. ACRA’s framing is memorable: understanding how to use AI responsibly, it says, is as important as understanding what it can do.
Our Crest.Digital News Bite walks through the guidance. Watch it below, then read on for how to turn it into a working policy.
A note on sources: this article draws on ACRA’s public announcement, not a line-by-line reading of the full guidance document, which is available from ACRA. Readers should refer to the guidance itself for exact wording and for the incident illustrations and reflective questions it contains.
Crest.Digital’s Agentic GRC builds configurable AI agents for control testing, evidence collection and remediation tracking, with human-in-the-loop review and an audit trail on every action.
Explore Agentic GRCWhat ACRA Actually Issued
According to ACRA’s announcement, the guidance addresses integrity, professional judgement, accountability, transparency, and data confidentiality and security. It is practice guidance focused on day-to-day audit work, it recognises that firms sit at very different levels of AI adoption, and it uses real-world incident illustrations and reflective questions to help auditors think through responsible use. ACRA also points readers towards its skills framework for accountancy and a Singapore professional body’s AI fluency programme.
Two features matter for how firms should read it. It is not framed as a binding rule, and the announcement sets no compliance deadline or enforcement mechanism. But regulators’ guidance has a way of becoming the yardstick in inspections and client conversations, so treating it as a baseline is the safer reading.
The Five Themes, Turned into Questions a Partner Can Answer
Principles only help if a team can test itself against them. Here is one way to turn each theme into a question for your next quality review or audit committee conversation.
The Themes and What to Ask
- Integrity: Are we honest, with ourselves and clients, about what AI did and did not do in the work?
- Professional judgement: Where does a qualified person review and own the conclusion, and can we show it?
- Accountability: Who is responsible when an AI-assisted result is wrong, and is that written down?
- Transparency: Do clients, teams and reviewers know where AI is used, and is use documented in the file?
- Confidentiality and data security: What client data can enter which tools, and under what protections?
If a partner cannot answer these in a few minutes, that is a finding in itself. The aim is not paperwork but a state in which every AI-assisted step could be explained to a regulator, a client or an audit committee.
Why This Matters Beyond Singapore
Audit regulators are converging on the same concern: AI can speed up audit work, but speed does not substitute for judgement or evidence. The UK’s Financial Reporting Council published guidance in March 2026 to support audit firm adoption of emerging AI technologies, so a firm with clients or group audits across borders should expect overlapping questions from more than one regulator.
The same logic reaches inside organisations. Finance teams and internal audit functions now use AI to summarise documents, test populations and draft reports, as we discuss in AI agents and human approval in financial reporting. For Indian CA firms the direction of travel is similar, as our piece on ICAI scrutiny and audit evidence trails shows: the profession is moving towards demonstrable evidence of how work was done.
Should Every Audit Firm Now Have an AI-Use Policy and Review Framework?
Our view: yes, proportionate to size and risk. Even where nothing is mandated, a firm that uses AI without a policy has no consistent answer to a client, an inspector or its own partners. The framework does not need to be heavy. Six steps cover it, and they work for a small practice, a large firm or an internal audit function.
Inventory AI Tools
List every AI tool used in audit and finance work, including features embedded in existing software and tools adopted informally by individuals.
Classify Use Cases by Risk
Rate each use by its influence on judgements and conclusions and by the sensitivity of the data involved, so controls scale with risk.
Define Human Review Points
Specify where a qualified person must review AI-assisted work and sign off, and make that person accountable.
Protect Confidential Data
Set clear rules on what data may be entered into which tools, with approved environments and contractual protections for client information.
Log and Retain Evidence
Keep a record of what AI was used for, what it produced and how it was reviewed, so work can be inspected and reperformed.
Review and Retrain
Revisit the policy on a schedule, learn from incidents and exceptions, and keep teams trained as tools and expectations change.
The same discipline applies to the evidence behind AI-assisted work. Our guide to agentic internal audit and evidence validation explains how to keep evidence reviewable, and why an AI policy is not an internal control until someone tests it shows how to test the framework itself.
Where Agentic AI Helps Audit, and Where Judgement Stays Human
Used well, agentic AI takes on the repetitive parts of audit and assurance: gathering evidence, testing full populations, comparing documents to requirements, tracking remediation and drafting working papers for review. That frees professionals for the parts that need scepticism and experience. What it must not do is conclude on its own work. Every agent action should be logged, every consequential output reviewed by an accountable person, and confidential data kept inside approved environments, a discipline set out in why AI agents need audit trails. For the move from sampling to broader coverage, see from sampling to continuous assurance.
There is a wider point too. If AI used by auditors needs assurance, so does AI used by the businesses they audit, a theme in independent audits of enterprise AI. Firms that build their own AI governance muscle early will be better placed to audit it for clients. For the profession’s own standards and guidance, see the Institute of Internal Auditors.
Crest.Digital’s platform and Agentic AI workflows give audit, risk and finance teams AI-assisted evidence collection and monitoring with human approval and a full activity record. See the industries we cover.
Five Moves for Audit Partners, CAEs and Finance Leaders
A Short Playbook for the Next Quarter
- Audit partners and CA firms: Adopt a short written AI-use policy, name an owner, and add AI use to engagement quality review.
- Chief audit executives: Apply the five themes to your own team’s AI use first, then add AI governance to the audit universe.
- Finance teams: Register AI tools used in close, reporting and analysis, and define who reviews their output.
- Everyone: Set data rules, allowing client or company data only in approved, protected environments.
- Leadership: Train teams on limits as well as capabilities, and review incidents openly so lessons are shared.
A closing note on proportion. ACRA’s document is guidance, not law, and every firm will implement it differently. The goal is a defensible, well-documented approach rather than a perfect one. For how organisations measure results from programmes like this, see our business impact page and the overview of end-to-end vendor risk governance.
Your Turn: Should Every Audit Firm Have a Mandatory AI-Use Policy?
- Yes, mandatory: Firms and regulators need a consistent minimum.
- Yes, but proportionate: Scale the policy and review framework to firm size and risk.
- Guidance is enough: Professional standards and judgement already cover it.
Tell us where you land, and why, in the comments when you share this article on LinkedIn.
Crest Perspective
AI governance programmes that treat AI risk as a technology problem will be underprepared for the regulatory environment taking shape in 2025–26. The EU AI Act, NIST AI RMF, and emerging FCA guidance all frame AI risk as a governance and accountability question first — the technology controls follow from having clear answers to who is responsible, what decisions the AI influences, and what the escalation path is when the system behaves unexpectedly.
Frequently Asked Questions
It is a piece of practice guidance issued on 2 October 2026 by Singapore’s Accounting and Corporate Regulatory Authority (ACRA) on using artificial intelligence responsibly in audit. According to ACRA’s announcement, it addresses integrity, professional judgement, accountability, transparency, and data confidentiality and security, and is aimed at auditors, audit firms and accounting entities. It focuses on practical considerations for day-to-day audit work, recognises that firms are at different stages of AI adoption, and includes real-world incident illustrations and reflective questions. ACRA describes it as guidance rather than a mandatory rule, and the announcement does not set a compliance deadline.
The guidance is presented as practice guidance, not a binding rule, and the announcement does not describe specific enforcement mechanisms or deadlines. In practice, guidance from a regulator often becomes the benchmark against which firms are judged in inspections and reviews, so many firms treat it as a baseline for their own policies. Firms outside Singapore are not bound by it, but it offers a useful reference point as regulators in several jurisdictions turn their attention to AI in audit.
A workable framework covers six things: an inventory of the AI tools in use, including those embedded in other software; a risk classification of each use case by its effect on audit judgements and its exposure of client data; defined human review points where a qualified person checks and takes responsibility for AI-assisted work; rules for protecting confidential client data and for what may be entered into which tools; logging and retention of what the AI did so work can be reviewed and reperformed; and periodic review and training. Scale it to the firm: a small practice needs a short, clear policy, while a large firm needs governance across engagement teams.
Treat AI output as input to judgement, never as the conclusion. That means understanding what the tool does and where it can be wrong, testing or corroborating results that matter, documenting how AI-assisted work was reviewed, and keeping the accountable professional visibly responsible for the opinion or finding. Scepticism applies to the tool as it does to management’s evidence. Reflective questions, like those ACRA includes in its guidance, are a good way to build the habit into team routines.
The themes carry over directly. Internal audit and finance teams increasingly use AI to summarise documents, test populations and draft reports, and they handle sensitive data while doing so. The same questions apply: who is accountable for the output, how was it reviewed, is the use disclosed where it should be, and is confidential data protected. Chief audit executives can adopt the five themes as a checklist for their own AI use and as a lens when auditing AI elsewhere in the organisation.