Audit Evidence in the AI Era: Reading Proposed ISA 330, 500 and 520

By Hendrawanto, SE., Ak., CA., CLI., AseanCPA., CPA., CFI. · 13 October 2026 · Baca dalam Bahasa Indonesia

More data does not always mean stronger audit evidence

The challenge in a modern audit is no longer simply a shortage of data. Auditors can now obtain millions of transactions, system logs, digital records, external information and analytics outputs in a short time. The harder question is whether that information is relevant, reliable, free from bias and capable of addressing the purpose of the audit procedure.

On 5 August 2026, the International Auditing and Assurance Standards Board (IAASB) issued exposure drafts proposing revisions to ISA 330, ISA 500 and ISA 520. Public consultation closes on 15 December 2026. The IAASB reiterated the process in its 5 October 2026 eNews. As of this article's date, stakeholders still have approximately 63 days to study and respond to the proposals.

The three proposals address the foundations of every financial statement audit:

• ISA 330 on the auditor's responses to assessed risks;
• ISA 500 on audit evidence; and
• ISA 520 on analytical procedures.

These are more than terminology changes. If finalised, the proposals will affect how auditors connect risks, procedure objectives, information sources, evidence quality, technology use and audit conclusions.

Their status must be read correctly

The IAASB documents remain Exposure Drafts. They are not authoritative pronouncements, do not amend the ISAs currently in force and may change after consultation. The IAASB has not set a specific effective date. It proposes allowing at least 18 months for implementation after approval of the final standards.

In Indonesia, these IAASB drafts must not be described as Indonesian Standards on Auditing. In the IAPI SPAP index verified on 13 October 2026, SA 330, SA 500 and SA 520 remain listed under the 2025 Standards on Auditing. The IAASB proposals should therefore be used for horizon scanning and methodological preparation, not as a basis for claiming that the new requirements already apply in Indonesia.

Five changes that deserve the most attention

1. Evidence must be evaluated against the procedure's intended purpose. Proposed ISA 500 makes the “intended purpose of the audit procedure” an important reference point. Information does not automatically become appropriate evidence merely because it is available, comes from a system or can be analysed quickly. The auditor needs to explain the connection between the risk of material misstatement, the assertion tested, the procedure's objective, the information used and the conclusion that can be drawn. In practice, audit evidence is judged by how well it addresses the risk, not by its volume.
2. The reliability of information receives sharper evaluation. Proposed ISA 500 identifies five attributes of information reliability: accuracy, completeness, authenticity, absence of bias and credibility. They are not intended as a mechanical checklist. The auditor determines which attributes are most significant based on the source of the information, the procedure's intended purpose and the engagement circumstances. Accuracy and completeness may be particularly important for information produced by the entity; authenticity, source credibility or possible bias may matter more for external information.
3. Reliance on controls must be genuinely risk based. Proposed ISA 330 clarifies that an auditor's response may consist of substantive procedures, tests of controls or a combination of both. A controls-only response may be considered only when inherent risk is not at the upper end of the spectrum, the risk is not significant and the controls are expected to be sufficiently effective to reduce the risk of material misstatement to an acceptably low level. The relevant controls must also be tested in the current period. For significant risks, the proposal continues to require substantive procedures.
4. A substantive analytical procedure cannot be a simple comparison of numbers. Proposed ISA 520 more clearly distinguishes substantive analytical procedures from analysis used during risk assessment or at the completion stage. The auditor's expectation must be sufficiently precise and based on plausible and predictable relationships. The auditor must also establish a threshold for differences that may be accepted without further investigation and follow up differences exceeding that threshold. The IAASB notes regulatory findings where procedures labelled substantive analytical procedures were too high-level, insufficiently disaggregated or not precise enough to detect material misstatement.
5. Technology does not remove professional scepticism. The proposed standards remain principles based rather than regulating particular applications. They permit the use of data analytics and AI, but professional responsibility remains with the auditor. Proposed ISA 500 specifically highlights the risk of automation bias: an undue level of trust in information in digital form or generated by automated systems, especially when a tool is complex, uses numerous inputs or is not transparent.

The IAASB also launched an interactive version of its Technology Catalog on 8 October 2026 to track matters such as crypto-assets, cybersecurity threats and emerging assurance engagements. Technology is no longer an ancillary topic; it forms part of the audit and quality management ecosystem.

Who will be affected?

• Audit firms and auditors need to evaluate their methodology, audit programmes, documentation, training, and governance over analytics and AI tools.
• Boards and CFOs need to ensure that information supplied to auditors has a clear source, traceable reconciliation, access controls and documented data changes.
• Audit committees need to understand how the auditor uses technology, how data quality is tested and how results that conflict with management's expectations are followed up.
• IT and internal audit functions will be increasingly involved in demonstrating data integrity, the effectiveness of general IT controls and the management of system changes.

Example: analytics over the entire revenue population

Suppose an auditor uses an analytics tool to examine every sales transaction and an AI model to flag unusual transactions.

Testing 100% of the population does not automatically provide 100% assurance. The auditor still needs to assess:

• whether all data were extracted from the source system;
• whether the data can be reconciled to the general ledger;
• whether any transformation or filtering occurred during extraction;
• whether access rights and program changes are controlled;
• how the model identifies a transaction as anomalous;
• whether the model's parameters align with the audit risks; and
• whether all material exceptions have been investigated.

A model output is the result of a tool. It can support an audit conclusion only after the data source, processing, result reliability and implications of exceptions have been tested appropriately.

Common mistakes to avoid

1. Treating the IAASB drafts as final standards or as SPAP requirements already in force.
2. Assuming that purchasing automated audit software is the same as improving audit quality.
3. Using every reliability attribute as a checklist without connecting it to the procedure's intended purpose.
4. Relying on controls without meeting the conditions and performing current-period testing.
5. Calling a high-level trend analysis a substantive analytical procedure.
6. Ignoring contradictory evidence because most analysis supports the initial expectation.
7. Adding documentation in bulk without showing the connection between risk, procedure, evidence and conclusion.

Practical steps before the proposals are finalised

1. Prepare a gap analysis. Compare the current SA 330, SA 500 and SA 520 methodology with the IAASB proposals. Clearly separate requirements in force from proposed changes.
2. Strengthen the audit trail. Each important procedure should show the connection between risk, assertion, objective, information, reliability evaluation, result and conclusion.
3. Establish audit data governance. Set standards for extracting, reconciling, storing, accessing, changing and validating client data.
4. Test analytics and AI tools. Document their capabilities, limitations, data sources, processing logic, version changes, involvement of experienced personnel and the follow-up of inconsistent results.
5. Improve the design of analytical procedures. Expectations should be sufficiently precise and independent of the amount being tested. Investigation thresholds and follow-up procedures should be established during planning.
6. Engage management and audit committees early. Data and control readiness cannot be fixed entirely after fieldwork has begun.
7. Consider responding to the consultation. Audit firms, academics, regulators, financial statement users and professional bodies may submit comments before 15 December 2026.

Conclusion

The direction proposed by the IAASB is clear: audit quality is not determined by the sophistication of the tool or the volume of data examined. It is determined by whether the auditor can justify the connection between risk, the procedure's objective, information reliability, test results and the resulting conclusion.

Technology can expand an audit's reach. Without data governance, professional scepticism and disciplined methodology, however, technology merely makes a weak process run faster.

For related discussion, read Revised ISA 240: The Auditor's Responsibilities Relating to Fraud, Revised SA 600: Changes to Group Financial Statement Audits, or see our Financial Statement Audit service.

Verified references

1. IAASB Proposes Revisions to Core Standards to Enhance Risk-Based Audit Framework and Address Technological Advances — IAASB, 5 August 2026.
2. Strengthening the Risk-Based Audit Framework: Proposed Revisions to ISA 330, ISA 500, and ISA 520 — IAASB.
3. Exposure Draft for the Audit Evidence and Risk Response Project Overall — IAASB, August 2026.
4. Proposed ISA 330 (Revised)—The Auditor's Responses to Assessed Risks — IAASB, August 2026.
5. Proposed ISA 500 (Revised)—Audit Evidence — IAASB, August 2026.
6. Proposed ISA 520 (Revised)—Analytical Procedures — IAASB, August 2026.
7. IAASB eNews October 2026 — IAASB, 5 October 2026.
8. IAASB Launches Interactive Digital Technology Catalog — IAASB, 8 October 2026.
9. Standar Profesional Akuntan Publik — IAPI; accessed 13 October 2026.

This article is educational and analyses IAASB exposure drafts. It is not an audit opinion, professional advice for a particular engagement, or a statement that the proposed ISAs have become Indonesian Public Accountant Professional Standards. Application must refer to the standards and regulations applicable to each engagement. The Indonesian version is the original text.