Audit Evidence Is Being Rewritten: The ISA 330, 500 and 520 Consultation Closes 15 December

The IAASB has three auditing standards out for consultation at once, and the comment period closes on 15 December 2026. One of the three carries the first appendix the international standards have ever had on using technological tools to obtain audit evidence. If your firm has an opinion about how AI-assisted procedures should be evidenced, this is the window in which it counts.

This guide sets out what is actually proposed, what is not changing, and the state of the surrounding guidance — because there is a good deal of confusion about which parts of the audit-technology landscape are standards, which are guidance, and which are still only projects.

What is out for consultation

On 5 August 2026 the IAASB published exposure drafts for three revised standards as a package, under its project on audit evidence and risk response:

• Proposed ISA 330 (Revised), The Auditor's Responses to Assessed Risks
• Proposed ISA 500 (Revised), Audit Evidence
• Proposed ISA 520 (Revised), Analytical Procedures

Comments close on 15 December 2026. No proposed effective date has been published, so do not plan implementation dates from these drafts.

The two changes that matter most

First, the proposals include a revised definition of audit evidence, framed by the IAASB as reflecting today's digital environment. That is a foundational change rather than a drafting tidy-up: the definition is what every other evidence requirement hangs from.

Second, and more concretely, a new appendix to ISA 500 on considerations when using technological tools to obtain audit evidence. There is also conforming application material proposed for ISQM 1 on technological resources, including the approval of technological tools.

One framing point worth getting right, because it is widely misreported. The IAASB has deliberately kept the proposals principles-based rather than technology-specific, and the documents do not mention artificial intelligence by name. If you are expecting an "AI auditing standard", this is not it — and the IAASB's position is that it does not intend to write one.

What is not changing — three corrections

1. ISA 500 has not been revised

There is no ISA 500 (Revised) in force. An exposure draft was issued on 24 October 2022 and never finalised in that form; the work was folded into the broader audit evidence and risk response project, which produced the August 2026 drafts. Anyone citing "ISA 500 (Revised)" as current is citing a proposal, not a standard.

2. ISA 315 does not mention AI

ISA 315 (Revised 2019) is in force for audits of financial statements for periods beginning on or after 15 December 2021. It does require the auditor to understand the IT environment, to identify IT applications subject to risks arising from the use of IT, and to identify related risks and the entity's general IT controls. Information processing controls are defined to include automated controls.

What it does not do is name artificial intelligence. Saying ISA 315 covers AI-driven processes is an inference — a reasonable one, since the requirements extend to them, but it should be framed as extension rather than as something the standard says.

3. IESBA's technology work is finished, not pending

The ethics side is frequently described as an open project. It is not. The Technology-related Revisions to the Code were approved on 11 April 2023 and have been effective since 15 December 2024 — the independence provisions for audits and reviews of financial statements for periods beginning on or after that date, and the other ethics provisions as of it. IESBA's own June 2026 position is that it has deliberately chosen not to pursue additional Code revisions at present.

What continues is non-authoritative work rather than standard-setting: a standing technology working group, and staff publications — including one on 15 July 2026 analysing emerging technologies through shared characteristics such as opacity and non-determinism, stressing that accountants remain responsible for their own judgments. At its September 2026 meeting IESBA supported a plan for targeted non-authoritative material on the ethical implications of generative and agentic AI, to be considered for agreement in December 2026, and flagged alliances between accounting firms and technology providers as a priority area.

The FRC guidance, which is the UK operative document

For UK firms the more immediately applicable publication is the FRC's Generative and Agentic AI Guidance, published 30 March 2026, with a companion factsheet.

It addresses firms' own use of generative and agentic AI in engagements, and offers a framework for thinking about how appropriate confidence in the quality of AI tool outputs can be obtained. Its illustrative examples include summarising board minutes and reviewing contracts for revenue recognition testing. It situates AI use within ISQM (UK) 1. On where responsibility sits, the companion factsheet is the document to quote: the firm and engagement partner retain full responsibility for audit quality, in accordance with ISQM (UK) 1 and ISA (UK) 220 respectively. The often-repeated line that the human auditor is always accountable comes from the FRC announcement rather than the guidance itself, and the FRC attributes it to auditing standards — the words accountable and accountability do not appear in the 60-page guidance at all. That mirrors the direction of travel in audit committee oversight of technology risk, where accountability has stayed with named humans rather than moving to the tooling.

Note the scope carefully: it covers the auditor's own tools, not how to audit a client that uses AI. Those are different problems and only one of them has guidance.

Two earlier FRC items are often missed. The FRC published AI in audit illustrative example and documentation guidance on 26 June 2025, and it runs an Audit Tech and AI Sandbox for firms adopting AI in audit, whose first-round applications closed in July 2026.

A point of precision on FRC thematic reviews

The FRC has published thematic reviews touching technology — Certification of Automated Tools and Techniques on 26 June 2025, the use of technology in the audit of financial statements on 25 March 2020, and data analytics in the audit of financial statements on 30 January 2017. None is titled as being about AI.

More importantly, these are Audit Quality Review supervisory findings drawn from the firms the FRC inspects — the 2025 review covered the six largest audit firms. They are findings and good-practice observations, not requirements of general application. Describing a thematic review as applying to all firms using AI tools is wrong, and it is a common error.

For comparison, internal audit carries its competence expectations through a professional body rather than through the assurance standards, which is why the two disciplines evidence technology competence differently. ISQM (UK) 1 is the instrument that does apply broadly. It applies because of the engagements a firm performs, not because the firm uses AI — and AI tools fall within its resources and monitoring requirements. The international standard was issued on 17 December 2020, with systems required to be designed and implemented by 15 December 2022.

The genuine gap in the standards

Worth stating plainly, because it is the question audit committees ask: no standard-setter has issued a standard or guidance specifically on auditing a client's use of AI, or on AI-generated information as audit evidence. Not the IAASB, not IFAC, not IESBA, not the FRC.

The existing architecture is expected to carry the weight. ISA 315's requirements on understanding the IT environment, ISA 500's evidence evaluation requirements, and ISA 200's professional scepticism requirement — the auditor must plan and perform an audit with professional scepticism recognising that circumstances may exist that cause the financial statements to be materially misstated, maintained throughout planning and performance — the requirement at the centre of advanced audit and assurance study — all apply to AI-generated information as they apply to anything else. But there is no dedicated pronouncement, and anyone implying otherwise is overstating the position.

That is a defensible gap to name in a response to the consultation.

What else is in train

• A separate ISA 500 series project. "Modernizing the ISA 500 Series" is developing proposed ISA 501 (Revised) on inventory and ISA 505 (Revised) on external confirmations, with consultation expected to open in February 2027 subject to approval.
• IAASB technology quality management guides. Non-authoritative material approved for development in December 2025. The IAASB published roundtable outcomes on 10 February 2026, drawing on 240 or more stakeholders across six continents, concluding that ISQM 1 and ISA 220 (Revised) remain robust and principles-based while practical guidance on AI-enabled tools would help. Guide 1, a common conceptual foundation, was scheduled for approval at the 28 October 2026 meeting with publication anticipated in November 2026 — confirm whether that approval happened before relying on it. Guide 2 is targeted for December 2026 and the full series for June 2027.
• The IAASB Technology Catalog reached a third edition around July 2026, adding crypto-asset audit challenges and AI and cybersecurity assurance.
• The 2026 IAASB Handbook was released in late September 2026, including ISA 240 (Revised), ISA 570 (Revised 2024) and ISSA 5000.

What to do before 15 December

• Read proposed ISA 500 (Revised) and its new technological tools appendix first — it is the part of the package most likely to change day-to-day practice.
• Test the revised definition of audit evidence against the procedures your firm already runs with automated tools. If the definition does not accommodate something you do today, that is exactly the feedback the consultation is for.
• Check the proposed ISQM 1 conforming material on approving technological tools against your firm's current tool-approval process. Many firms have an informal process that would not survive being written down.
• Separate your response on the auditor's own use of AI from any comment on auditing client-side AI. The drafts address the first; the second is the gap.
• If you are in the UK, map your response against the FRC's March 2026 guidance so you are not arguing for something the FRC has already addressed differently.
• Do not wait for an AI standard. The IAASB has said the approach is principles-based and technology-neutral, and nothing in the current programme suggests that will change.

For audit staff, the practical consequence is that competence in this area is not going to be certified by a new standard. It will be evidenced the way everything else is — through documented judgement about tools, their limitations and the sufficiency of what they produce. The scepticism requirement in ISA 200 applies to a confident-looking AI output exactly as it applies to a confident-looking management representation, which is the discipline worth building now rather than after the standards land.