How do firms ensure responsible technology adoption? How will firms benefit from GenAI usage while also effectively managing the risks? And what principles or frameworks are available to guide adoption? The public trusts CPAs and look to us for our integrity and competence. That means CPAs must adhere to responsible principles when integrating or utilizing AI applications.
This was recently emphasized in the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) new publication released in February 2026, Achieving Effective Internal Control Over Generative AI (GenAI). The guidance offers organizations a practical, COSO-aligned approach to managing the risks and opportunities introduced by the rapidly advancing generative AI technologies.1 In addition, an updated Generative AI Governance Framework, published in March 2026, further focuses on harnessing the power of GenAI while appropriately managing the risks.2 With these frameworks coupled with other guidance, CPAs can both innovate responsibly and protect clients, investors, and the public interest.
AI, particularly GenAI and Agentic AI, are transforming the accounting profession. However, while adoption has accelerated, governance maturity has not kept pace. This imbalance is creating measurable risks, exposing firms to compliance failures, data breaches, and operational inefficiencies. In the spring 2025 issue of the Pennsylvania CPA Journal, Colleen Krcelich, Christina Olear, and John Peatross discuss the various GenAI risks and risk mitigation strategies firms should consider.3 Their discussion reinforces a broader concern: while generative AI can enhance efficiencies in reporting, auditing, and client communication, it also introduces significant risks related to data accuracy, privacy, and ethical use. Generative AI outputs often appear reliable, but they can be incomplete or, even worse, incorrect. Additionally, improper handling of client data can expose firms to cybersecurity threats and legal consequences. To mitigate these risks, firms must implement strong governance practices, including clear policies, employee training, and ongoing human oversight.
Despite the awareness of AI-related risks, many organizations fail to implement AI-related oversight programs. In a recent report by AuditBoard, a cloud-based software platform, about 25% of organizations have fully implemented AI governance programs.4 Many firms have drafted governance frameworks but struggle to embed them into daily processes due to unclear ownership, limited expertise, and resource constraints.
At the leadership level, governance integration also remains limited. According to a National Association of Corporate Directors (NACD) 2025 board survey, 62% of boards discuss AI regularly, while only 27% have formally embedded AI governance into committee charters.5 Executive accountability is just as fragmented. According to McKinsey & Company’s 2025 State of AI Report, only 28% of CEOs directly oversee AI governance initiatives.6 The lack of top-level ownership often results in lacking or inconsistent risk management practices. Organizations that centralize oversight through dedicated AI committees or governance boards are more likely to achieve alignment between strategy, compliance, and operational execution.
Recognizing the importance of governance as a strategic priority is on the rise. According to recent data from Cicso’s data privacy benchmark studies (2025 and 2026), nearly 98% of respondents expect AI governance budgets to increase, signaling more investment in controls, monitoring, and compliance infrastructure. Over 90% of organizations plan to allocate additional resources into privacy and data governance over the next two years.7 Many organizations are establishing AI-governance committees to oversee AI policies, the risks across AI systems, and AI-monitoring programs.
Given the challenges, CPAs and organizations need more than just an awareness of risk. They need structured, practical guidance for implementation. While high-level principles such as transparency, accountability, and data privacy provide an important ethical foundation, they often lack specificity. COSO’s guidance on generative AI provides a structured approach to bridge the gap between principle and practice. It translates responsible AI concepts into actionable policies, controls, and procedures embedded across strategy, operations, and reporting.
Responsible AI (RAI) principles coupled with recent governance frameworks are the foundation for secure and effective GenAI adoption. Many organizations have published RAI principles, and, overall, they center around the following core components:
When PwC analyzed over 100 sets of ethical principles and consolidated them into nine core ethical AI principles for responsible AI, it included interpretability, reliability, accountability, data privacy, lawfulness and compliance, beneficial AI, human agency, safety, and fairness.8 EY emphasizes the principles of accountability, data protection, reliability, security, transparency, explainability, fairness, compliance, and sustainability.9 Security is an area of RAI that is heavily emphasized, especially in terms of data encryption, data anonymization, data retention, and data audit. These help ensure CPAs can use AI without compromising safety, especially when working with sensitive or confidential information.10
The GenAI Governance Framework can be used alongside RAI principles to ensure CPAs can innovate responsibly with GenAI. The framework provides a top-down, materiality-based foundation for organizations when assessing their governance of GenAI. It sets the enterprisewide GenAI governance foundation while COSO’s GenAI internal control guidance shows how to translate the foundation into specific controls, policies, and procedures.11 The GenAI Governance Framework (see graphic below) breaks down governance into five domains:12
Each domain directly relates to the overall principles of RAI. For instance, ensuring traceable GenAI decision-making through the transparency, accountability, and continuous improvement domain directly advances the RAI principle of transparency, or managing GenAI IT security through the operational and technology management domain directly contributes to the RAI principle of data privacy and security.
As organizations adopt AI tools into their ecosystem, there are a number of internal and external factors that must be considered. In a recent CPA Now blog, Ian McDowell, principal with S.R. Snodgrass PC, stresses that before exploring AI, organizations should look at the firm’s operational needs.14 Several internal factors can influence AI adoption including, but not limited to:
As the conversation around AI, GenAI, and agentic AI grows, so do the external pressures to adopt these tools. Some external factors for firm consideration include the following:
GenAI offers unprecedented opportunities to enhance efficiency, automate routine tasks, and elevate the role of accountants. Yet, as adoption accelerates, firms are increasingly recognizing that the benefits must be carefully balanced against significant risks related to accuracy, privacy, and professional judgment. Successful integration depends on embedding governance, training, and oversight into AI adoption strategies.
While much of the conversation around AI centers on governance and risk, it is equally important to recognize where AI is creating value in the accounting profession. Across audit, tax, and advisory services, AI is actively reshaping how professionals analyze data, generate insights, and deliver client value. Many Pennsylvania CPA Journal articles and CPA Now blog posts have discussed the various ways in which AI is transforming the accounting profession.16
In audit, AI enables the analysis of entire populations of transactions rather than samples, strengthening audit evidence and improving anomaly detection. Tools can summarize contracts, monitor internal controls in real time, and assist with complex areas such as revenue recognition and going concern assessments. However, these benefits introduce new risks, including AI-generated inaccuracies (“hallucinations”), documentation challenges, and evolving regulatory expectations around audit evidence and traceability.
In tax, AI is proving valuable in automating high-volume, process-driven work such as mapping trial balances, identifying book-to-tax differences, and drafting technical memoranda. More advanced applications include contract analysis and AI-assisted research across prior-year documentation. Yet, tax practice presents heightened risks due to the complexity and constant evolution of tax law, requiring careful validation of outputs and strict safeguards around client confidentiality.
In advisory, AI enhances financial modeling, forecasting, and scenario analysis, enabling CPAs to deliver deeper insights more efficiently. However, overreliance on AI-generated recommendations can expose firms to significant professional and reputational risk if underlying assumptions are flawed.
Nevertheless, across all functions a consistent theme emerges: AI does not replace professional judgment, it elevates the need for it. The AI-ready CPA must apply professional skepticism to all AI outputs, understand model limitations, and ensure proper documentation and governance of AI-assisted work. This governance requires an integration of technical understanding with traditional accounting judgement. CPAs will benefit from the knowledge of how their AI models function by being able to understand the sources of the models’ errors, the implications of data quality, and the conditions under which AI outputs are most meaningful and most reliable. This “AI literacy” enables more effective prompting, more meaningful interpretation of outputs, and more defensible documentation of AI-assisted deliverables.
The AI conversation is no longer centered on whether to adopt GenAI, but rather how to do so responsibly. This is a challenge when adoption outpaces governance. Firms that fail to close this gap risk operational inefficiencies, compliance failures, and erosion of client trust. In contrast, organizations that invest in governance through leadership accountability, clear policies, strong internal controls, and continuous monitoring are better positioned to capture AI’s value while managing its risks. What ultimately differentiates successful organizations will not be the tools they adopt, but the governance structures they build, implement, and monitor.
For CPAs, this moment presents both an opportunity and a responsibility. As trusted advisers and stewards of financial integrity, CPAs are well positioned to lead AI governance efforts. By leveraging expertise in internal controls, auditability, and regulatory compliance, we can help ensure that AI systems are not only innovative but also transparent, secure, and aligned with organizational objectives and can help close the gap between adoption and not just good, but great governance.
4 AuditBoard, “From Blueprint to Reality: Execute Effective AI Governance in a Volatile Landscape” (2025).
6 www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai
7 www.cisco.com/c/en/us/about/trust-center/data-privacy-benchmark-study.html#~key-findings
9 www.ey.com/en_gl/insights/ai/principles-for-ethical-and-responsible-ai
10 https://blog.picpa.org/how-accounting-firms-can-implement-ai-responsibly
12 Ibid.
13 www.genai.global/solutions/framework
14 https://blog.picpa.org/integrating-ai-into-an-accounting-firm-how-should-you-decide
15 www.picpa.org/professional-resources/research-publications/insights-research-whitepapers
16 Pennsylvania CPA Journal; CPA Now blog
Shannon H. Galletta, CPA, is a PhD candidate at the University of Scranton, a manager at PwC, and an adjunct accounting professor at Stony Brook University in Stony Brook, N.Y. She can be reached at shannon.galletta@stonybrook.edu.
Jacob Crowley, CPA, is a PhD student at the University of Scranton and an assistant professor in accounting at Ohio Northern University’s James F. Dicke College of Business in Ada, Ohio. He can be reached at jacob.crowley@scranton.edu or j-crowley.1@onu.edu.
Ashley Stampone, CPA, PhD, is an assistant professor of accounting at the Kania School of Management at the University of Scranton in Scranton and is a member of the Pennsylvania CPA Journal Editorial Board. She can be reached at ashley.stampone@scranton.edu.