A conversation withMelanie Sack, IDW

Auditors demand legal certainty in dealing with AI

Melanie Sack, Head of the Institute of Public Auditors in Germany, explains the role of the profession in ESG regulation and digitalisation – and what is changing in day-to-day business.

Auditors demand legal certainty in dealing with AI

The profound transformation of the economy is a central theme for the work of auditors. The industry itself is affected by rapid changes concerning sustainability and digitization, while simultaneously accompanying the processes of change across all sectors as consultants. In this regard, the Institute of Public Auditors (IDW) holds a central position as the representative body of the profession.

One of the challenging issues currently is the implementation of ESG regulation, explained Melanie Sack, spokesperson of the IDW's board. Companies affected by sustainability reporting currently face a Herculean task to timely establish new systems for ESG reporting. The effort for all involved is significant, but implementation is unavoidable.

Regulation in moderation

Sack warns against overstepping the mark. „For me personally, sustainability is a matter of the heart. However, we must ensure that reporting is based on sensible and moderate regulation, without overburdening companies. Ultimately, more is achieved by formulating ambitious but not unrealistic requirements", she cautions.

The implementation of the Corporate Sustainability Reporting Directive (CSRD) directive into German law plays an important role for the auditors' business. From the IDW's perspective, the recently presented draft legislation for the implementation of the CSRD in Berlin is moving in the right direction.

Continuity in auditing

Previously, unrest in the profession had arisen because the EU granted member states the option to mandate third parties for the audit of sustainability reports, such as TÜV (Association for Technical Inspection) or an environmental service provider. But the draft legislation of the German implementation law stipulates that the auditor or another public auditor will be commissioned. „The profession is ready to take on this task and is currently preparing intensively for it", says Sack. This guarantees continuity in the auditing process for companies.

The IDW is advancing qualification in the ESG field for the profession. Various formats have been developed, including free information and training events. The IDW Academy offers the Sustainability Auditor as a certified course, aiming to provide auditors with broad knowledge of sustainability. „The demand is high; the courses are fully booked within a short period,“ Sack notes. These trainings are supplemented by accessible offerings, such as a current podcast series „Fit for Sustainability“.

Clear responsibilities

Nonetheless, the IDW still sees risks for the profession arising from regulation. There are concerns that policymakers will hold auditors responsible for deficiencies in reporting requirements.

„It is not the task of the profession to mitigate the consequences of possibly excessive reporting requirements", Sack emphasizes. Companies are „very ambitious, but also burdened“ in implementing the new standards. Auditors cannot turn a blind eye to the reporting of companies on ESG matters. „The profession will not break laws. If companies are to grow into the new reporting requirements, policymakers must enable this, for example, by allowing for staggered application areas,“ says Sack.

Regarding another central issue, the digital transformation, it is not yet clear where the journey in the auditor market is heading. „AI can become a game-changer with disruptive force for auditing. It will significantly change the profession, although we do not yet know exactly how", says Sack. However, it is clear that the use of artificial intelligence in auditing facilitates handling large amounts of data. „The technology can contribute to quality improvement and can be a way to respond to a shortage of skilled workers. Though, I do not see a fundamental threat from AI to the profession", Sack reassures.

First auditing standard

The IDW has already developed an auditing standard for the voluntary auditing of AI systems in companies. This is intended to ensure that a company has ethical and legal requirements for AI, that AI operates in a secure IT environment, and that it provides comprehensible results that correspond to the requirements defined by the company. But the standard does not specify how the auditor should deal with AI in the financial statement audit.

The consequences of companies using AI in preparing the financial statements are not yet clear. The IDW demands legal certainty for the profession in dealing with AI in the context of the financial statement audit: „If AI is used, the results from this application are not always clearly reproducible", explains Sack. The auditor can document the result of the audit and explain the steps taken to arrive at the result. However, with the same parameters, the auditor may come to different results at a later time because AI is constantly changing and learning. „If the conclusions are the right ones at that specific time, the use of AI is a sensible support, but it must also be audit-proof", Sack urges.

New platform

Regarding AI applications, the IDW offers a platform to enable the profession to access technologies broadly and share knowledge. SolonX provides an overview and access to several technology-based tools and services from various providers that may be of interest to the profession.

The abusive use of AI also concerns the IDW. Auditors are „trust service providers who provide reliability in information so that informed decisions can be made based on it“. Therefore, the IDW will intensively address fraud and also deal with topics such as deepfakes and fake news.

In the financial statement audit, the auditor is required to gain an understanding of the company's significant risks. Cybercrime can also play a role in this regard. The company must report on significant risks in the management report. This way, the topic enters the financial statement audit. „And if an attack has occurred, this may also have consequences, both for data security itself and for the risk situation. Nevertheless, it is not the task of the auditor to certify cyber defence“, Sack clarifies the IDW's position.