Generative AI can produce a convincing, cohesive, professional-looking report that contains fabricated sources, inaccurate statistics, or conclusions the underlying evidence does not support. These errors—often referred to as hallucinations or confabulations—can be particularly difficult to detect because they are frequently presented in confident, precise, and authoritative language.

Recent high-profile examples have included reports issued by professional services firms containing inaccurate statistics, unsupported conclusions, fabricated citations, and AI-generated content that was not adequately verified. The problem is not unique to the accounting profession. Similar failures have surfaced in legal briefs, academic publications, news content, and other professional work product.

For CPA firms, however, the consequences extend well beyond embarrassment or reputation damage. Unreliable work products threaten the trust that gives the CPA profession its value. When a report, analysis, financial statement, or other communication carries a CPA firm's name, those relying on it should be able to expect that the firm has exercised the professional care appropriate to the engagement.

Why Convincing Output Deserves Greater Scrutiny

One of generative AI's greatest strengths is also one of its greatest risks: it can make incorrect information sound remarkably credible.

The confidence of the language, the specificity of the citations, and the professional structure of the response can lower professional skepticism. AI may even fabricate technical guidance that appears to support a particular conclusion.

Consider, for example, an AI-generated response that cites a seemingly legitimate section of the Financial Accounting Standards Board's (FASB) Accounting Standards Codification requiring all software development costs to be immediately expensed. Or imagine AI-generated ethics guidance stating that CPAs are always required to disclose their use of AI to clients.

Would you immediately recognize that the cited guidance was fabricated?

Perhaps you would if the topic falls within your area of expertise. But what if you are researching an unfamiliar accounting issue? What if the task is delegated to a staff member who has limited experience with the applicable standards? What if the answer is generally correct but includes one nonexistent citation or subtly overstates the requirements?

That is what makes AI-generated errors particularly challenging. They may not look like errors.

Professional Responsibility Stays with the Practitioner

The use of AI does not transfer professional responsibility from the practitioner to the technology.

Responsibility for professional work remains with the firm and the professionals performing, supervising, and reviewing the engagement. A practitioner cannot rely on the fact that a technology tool generated the content as a defense for inaccurate or unsupported work product.

The American Institute of Certified Public Accountants (AICPA) Code of Professional Conduct's General Standards Rule addresses professional competence, due professional care, planning and supervision, and obtaining sufficient relevant data to provide a reasonable basis for conclusions or recommendations.

Applied to AI-assisted work, these responsibilities require deliberate decisions about how the technology will be used and how its output will be evaluated.

Practitioners should take these steps:

• Understand both the task and the technology. The engagement team needs sufficient subject-matter expertise to evaluate the result and enough understanding of the AI tool to recognize its capabilities and limitations.
• Retain professional judgment. AI can assist with research, analysis, drafting, and summarization, but the practitioner must evaluate the conclusions reached and the evidence supporting them.
• Plan meaningful supervision and review. Firms should determine who will review AI-generated work, the qualifications necessary to perform that review, and the specific risks the review is intended to address.
• Protect confidential information. Firms should understand how information entered into an AI system is stored, retained, accessed, and potentially used by the technology provider, and obtain appropriate permissions when necessary.

Depending on the nature of the engagement, other provisions of the Code may also apply, including requirements addressing integrity and objectivity, confidentiality, independence, and compliance with applicable professional standards.

Establish Effective Safeguards

The profession should recognize AI hallucinations as a meaningful risk that requires deliberate safeguards.

This becomes increasingly important as AI moves beyond simple drafting assistance and into audit, accounting, and financial reporting. These include preparing financial statements, drafting annual reports and Form 10-K disclosures, researching technical accounting issues, analyzing contracts, preparing communications with those charged with governance, and evaluating audit evidence.

Appropriate safeguards will depend on the nature and significance of the work but could include the following:

• Verifying citations directly against authoritative sources.
• Confirming that quoted or referenced professional standards actually exist and say what the AI represents them as saying.
• Evaluating conclusions for unsupported assumptions, omissions, overgeneralizations, or contradictory evidence.
• Reperforming calculations and validating data used in quantitative analyses.
• Comparing significant conclusions against authoritative guidance or independent source material.
• Using technology-based validation tools, including separate AI systems when appropriate, as a supplemental check for inconsistencies or potential fabrication.
• Requiring unresolved exceptions or questionable content to be investigated before work product is released.
• Ensuring that significant AI-assisted work is reviewed by someone with sufficient subject-matter expertise to recognize when the answer does not make sense.

The last point is critical. A safeguard is only effective if the reviewer is capable of identifying the problem.

Running an AI-generated answer through another automated tool may provide additional information, but it does not replace knowledgeable professional review. Ultimately, someone must understand the subject matter well enough to determine whether the work can be relied upon.

CPAs Need to Provide Trust

The public-interest principle in the AICPA Code of Professional Conduct recognizes that the CPA profession serves not only clients and employers, but also investors, lenders, governments, the business and financial community, and others who rely on the profession's objectivity and integrity.

That principle has direct implications for the profession's adoption of AI.

AI can dramatically improve productivity. It can accelerate research, analyze large amounts of information, identify patterns, improve drafting, and allow professionals to focus more of their time on higher-value analysis and judgment.

But speed and efficiency are not substitutes for reliability.

An AI-generated report has limited value if its facts, citations, reasoning, and conclusions cannot withstand scrutiny. The CPA profession's opportunity is not simply to become more efficient at producing information. It is to apply professional judgment, verification, and accountability to information increasingly produced by technology.

AI can generate the report. The CPA's responsibility is to provide the trust.