ISA 500 (Revised) Does Not Exist, and That December 2026 Date Belongs to ISA 240

There is a claim circulating that ISA 500 (Revised), on audit evidence, is effective for periods beginning on or after 15 December 2026. It is wrong twice over. ISA 500 (Revised) has not been issued and has no effective date. And 15 December 2026 is a real and important date in the auditing calendar, but it belongs to a different standard.

Where the audit evidence project actually stands

The IAASB's project is titled Audit Evidence and Risk Response, and covers proposed revisions to three standards together: ISA 330, ISA 500 and ISA 520. Its published timeline runs from a project proposal in December 2024, through an exposure draft stage, to approval expected in December 2027.

As at November 2026 the project's stage is exposure draft, out for comment. The proposals were issued for public comment in early August 2026 and the comment period closes on 15 December 2026. The IAASB supported the consultation with a user survey, a two-part webinar series held across late September and early October 2026, technical videos, a slide deck and a table mapping the key changes.

No effective date is shown, for the straightforward reason that an exposure draft does not have one. Approval is only expected in December 2027, and standards do not normally take effect in the year they are approved. An effective date before the end of the decade would be surprising.

There is a second, separate IAASB project on the ISA 500 series, covering ISA 501 and ISA 505. First full drafts were discussed in September 2026, exposure drafts are to be reviewed in December 2026, and public consultation is expected to open in February 2027. Two live projects both touching ISA 500 is part of why the position gets confused.

How the error is produced

The mechanism is worth understanding, because it is a useful warning about effective dates generally. The date 15 December 2026 is simultaneously two unrelated things.

It is the comment deadline on the audit evidence exposure draft. It is also the genuine effective date of ISA 240 (Revised), on the auditor's responsibilities relating to fraud, which was issued on 8 July 2025 and takes effect for periods beginning on or after 15 December 2026, alongside ISA 570 (Revised 2024) on going concern. Our analysis of what changes in ISA 240 (Revised) covers that standard, including the paragraph renumbering that has itself produced a crop of wrong citations.

Two unrelated facts sharing one date, and one of them gets attached to the wrong standard. A further trap: searching for ISA 500 (Revised) surfaces documents from an earlier, superseded IAASB audit evidence initiative, including a 2022 mark-up and a September 2022 agenda paper described as final and approved. Those are board agenda papers from a closed project, not standards. Citing them as evidence of a final ISA 500 (Revised) would be a serious error.

No auditing standard has been amended for AI

The same discipline produces a second, larger finding. There is no AI auditing standard. No ISA anywhere has been amended to address artificial intelligence, and there is no AI assurance standard in force.

What governs the use of an AI-enabled tool on an engagement is the existing quality management framework: ISQM 1 and ISA 220 (Revised), neither of which has been amended for AI, and in the UK their equivalents ISQM (UK) 1 and ISA (UK) 220. That is the authoritative hook on which everything the standard setters and regulators say about AI actually hangs.

Everything else the IAASB has published on technology is non-authoritative, and says so. Its support material on audit documentation when using automated tools and techniques, published in April 2020, states that it does not constitute an authoritative pronouncement and does not amend, extend or override the ISAs. Its frequently asked questions on the risk of overreliance on technology, published in March 2021, states that it does not amend or override the ISAs, whose texts alone are authoritative. The IAASB's Technology Position and accompanying guiding actions are a board position statement rather than a standard. Its Digital Technology Catalog, now in a third edition, is a catalogue.

The AI-specific material is still in development. The IAASB's technology and quality management workstream, whose guidance development phase runs from April 2026 to June 2027, is producing a non-authoritative guide series on applying the quality management standards to AI-enabled technological tools. The first guide, on a common conceptual foundation, was due for approval at a mid-quarter meeting in late October 2026 with publication anticipated in November, and the full series is targeted for June 2027. At the time of writing we found no evidence that the first guide has published; anyone citing it should check directly.

One thing we could not verify

We wanted to establish whether ISA 240 (Revised) itself refers to technology or automated tools, and we could not. Neither the IAASB's publication page for the standard nor its fraud and going concern focus-area page mentions technology, automated tools and techniques, data analytics or artificial intelligence anywhere.

That is an absence of evidence on summary pages, not evidence of absence in the standard, which runs to well over a hundred pages including application material. We are not going to assert it either way. If the point matters to your planning, download the final pronouncement from the IAASB and search the application and other explanatory material. We flag it here because an unverified claim repeated confidently is how the ISA 500 error got started.

What an auditor is obliged to do about AI today

Comply with ISQM 1 and ISA 220 (Revised), or their UK equivalents, in respect of any AI-enabled tool used on an engagement. Comply with ISA 240 (Revised) for periods beginning on or after 15 December 2026. Retain full responsibility for the audit and the opinion, which every standard setter and regulator that has addressed this says in terms.

Everything else is recommended practice. That does not make it safe to ignore, because non-mandatory regulator guidance is what a firm's professional judgement gets measured against in an inspection, as our piece on the FRC's AI in audit guidance sets out. The distinction to hold onto is between what a standard requires and what guidance recommends, which is exactly the distinction that collapses when an exposure draft gets reported as a standard. The project's status is published on the IAASB's own project page, which shows the stage, the comment period and the expected approval date, and is the citation to use.