FAR: start from the audit question, let data carry the conclusion

FAR has rewritten its guidance on automated tools and techniques in audit.FAR The updated position of 27 October 2026FAR treats automated tools and techniques, ATT, as covering spreadsheets, scripts and specialised data analysis as well as artificial-intelligence solutionsFAR. A simple filter can be appropriate where an advanced model adds little. The starting point is the risk or assertion to address and the evidence needed, with the intended result stated before data is fetched: understanding, risk identification or substantive evidence for a stated assertion.

Tool choice does not change the assessment basis.FAR A manual and an automated procedure are judged against the engagement standard, and the choice between ISA and ISA för LCE follows applicability conditions, not the use of an analysis toolFAR.

Data must support the conclusion. Auditors establish source, period and extraction. An exported register can lack reversed entries, units or side-system transactions, and that a file opens is no check of completeness or accuracy. Amounts and item counts are tied to the accounts, a sample is traced to the source system, and duplicates, gaps and unexpected dates are examined. Filtering, merging and recalculation effects are documented, and the cause of a duplicate is checked before deletion. Access and transfer stay proportionate through approved routes, with no more data than needed. When reliable data cannot be obtained, the procedure changes; more volume does not cure flawed delimitation.

A pattern that identifies a risk does not by itself evidence a balance or transaction. Risk-assessment analysis is kept apart from substantive analytical proceduresFAR, and each purpose's conditions are assessed separately. For substantive analytics the relationship must suit the assertion, data must be reliable and the expectation precise, with the acceptable deviation and follow-up set in advance. Analysis of the full recorded population still misses unrecorded items, and conclusions stay within the procedure's limits. Conflicting evidence is weighed together rather than by item count.

For recurring deliveries, delivery data is linked to invoicing and credit notes, with late invoices or post-year-end credits prompting cut-off and occurrence work. A deviation is an entry into the work, not a finished error assessment, and completeness testing may need to start from delivery information. For journals, timing, user, account and narrative are combined under criteria built from entity understanding and fraud risk. Selected items are traced to business substance with corroboration, and the criteria-follow-up-conclusion link is kept.

Video or drone images can support understanding of placement or following a count, but angle, timing, coverage and matching to the stock list limit their value, and an overview alone does not show ownership or value. Remote support is not an automatic substitute for attendance at counting. The assessment follows ISA 501FAR, including alternatives when attendance is impracticable and the consequences when sufficient evidence cannot be obtained.

Generative AI can structure material or summarise documents, but a well-phrased answer can still be wrong or unsupported. Facts are checked against originals. Only approved tools are usedFAR, with confidentiality and access tested before transfer; external delivery does not change responsibility. Program or model changes can require reconsidering controls.

Documentation must let an experienced auditor understand what was done and how the conclusion was reached. Purpose, data, selection and follow-up are linked, with source, extraction, tool version, parameters and processing kept as needed. For generative AI, prompts and answers are kept with the check against originals. The tool supports the work; the auditor assesses the evidence and documents the conclusion.

Legal basis is ISA, ISA 501 and ISA för LCE.FAR