AI is not outside your system of quality management. CSQM 1 names technological resources as a quality objective in their own right, so the question is not whether the standard applies but what you have written down about it.
Key takeaways
AI fits into CSQM 1 as a technological resource, and the standard already says so. The Auditing and Assurance Standards Board’s Technology Quality Management Workstream page quotes the requirement directly: paragraph 32(f) requires a firm to establish the quality objective that “appropriate technological resources are obtained or developed, implemented, maintained, and used, to enable the operation of the firm’s system of quality management and the performance of engagements”, and the related application material provides guidance on what “appropriate” means in that context.
So there is no gap to fill and no new standard to wait for. If your firm performs audits, reviews, other assurance or related services engagements, the tools you use are already inside the system you are already required to operate. The work is describing them.
The Canadian Standards on Quality Management are set by the AASB and adopted from the international standards. As the Board’s own summary records, ISQM 1 is adopted in Canada as CSQM 1, Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements, and ISA 220 (Revised) is adopted as CAS 220, Quality Management for an Audit of Financial Statements.
The division of labour matters. CSQM 1 is the firm-level system. CAS 220 addresses the responsibilities of engagement partners and teams, including engagement resources — which, as the Board notes, covers technological tools made available by the firm, such as tools the firm has certified for use. A tool an individual downloads and uses on an engagement without the firm certifying it sits awkwardly against both.
The Board is unusually direct about the difficulty. Emerging technologies including generative AI, machine learning and advanced automation offer opportunities to enhance engagement quality and efficiency, but they introduce challenges — specifically when the technology’s logic is hard to explain, when its outputs vary for the same input, and when tools change over time.
Those three properties are the whole problem in one sentence. A traditional audit tool is deterministic, documented and stable between versions. A model is none of the three, and every control you write has to survive that.
On 30 October 2025 the AASB and the IAASB held an in-person Technology Quality Management roundtable in Toronto with 25 attendees from across the external reporting ecosystem — practitioners from firms of various sizes, regulators, professional accounting organisations, tool providers and users of audit reports. The AASB published what it heard on 6 February 2026. The list of practices participants described is the most useful thing in it, because it is what firms are actually doing rather than what a standard aspires to:
Read that as a checklist. A firm that can point to each of the six has a defensible answer to paragraph 32(f); a firm that can point to none of them has a tool and a hope.
The same publication lists the questions participants said they could not answer from the standards alone: how to build governance frameworks when responsibilities span global networks, local firms and engagement teams; how to validate and document inputs and outputs when the technology has limited transparency; how often evolving tools should be tested or recertified and what requires ongoing monitoring, including relevant general IT controls; how to evaluate vendor-developed tools and set certification criteria for third-party risk; and how to demonstrate effective direction, supervision and review, professional judgment and professional scepticism when AI is involved.
Two conclusions were reached. First, that the principles in CSQM 1 and CAS 220 remain fit for purpose and can address risks from emerging technologies. Second, that non-authoritative material would help apply them consistently, and that any such guidance should be scalable and proportionate to firm size, level of AI adoption and technological infrastructure, with practical examples for small and medium-sized practices. The AASB records that the IAASB agreed at its December 2025 meeting to pursue non-authoritative materials, and would discuss a proposed action plan at its March 2026 meeting.
The roundtable summary states plainly what documentation continues to be for: to demonstrate that professional judgment was applied, to show consideration of contradictory evidence, and to support results that can be replicated. Every one of those three is harder when a tool’s output varies for the same input, which is exactly why the documentation has to be written rather than assumed.
The transparency point is worth noting too. Participants saw value in open communication with those charged with governance about AI used by both the auditor and the entity, and discussed whether transparency with users about AI use in the audit could help build trust in the short term until its use becomes more widespread.
Proportionate does not mean absent. A four-person practice can discharge this in two pages:
None of that requires a technology function. It requires a decision and a document, and it is the difference between a firm that has considered paragraph 32(f) and a firm that will be considering it for the first time during an inspection.
A three-partner practice performing compilation and review engagements adopts a document-extraction tool. It certifies the tool centrally, restricts it to two engagement types, requires every extracted figure to be agreed to the source document before it is used, and runs a short re-test whenever the vendor ships a major version.
Nothing about the engagements changes except that the extraction step is faster and the validation step is now explicit and recorded. Where a partner previously trusted a junior’s keying, both the extraction and the check are now on the file. That is a stronger position than the practice was in before, which is the argument the firm makes internally rather than a claim about the tool.
Firm-level exposure is the reason to bother. Treadstone Law’s note on suing a professional’s firm rather than the individual explains why the system, not the individual, is where a claim usually lands.
The AASB’s Other Canadian Standards page is where the related services standards live, and is worth watching if your practice does compilation work — the Board approved CSRS 4250, Compilation Engagements on Future-oriented Financial Information and Pro Forma, at its March 2026 meeting, replacing AuG-16, effective for compilation engagement reports dated on or after 1 July 2028.
Does CSQM 1 apply to a firm that only does tax and bookkeeping?
CSQM 1 addresses firms that perform audits or reviews of financial statements, or other assurance or related services engagements. Whether a particular engagement falls inside that description is a question to answer deliberately — check the scope of the standard against your engagement mix rather than assuming either way.
Do we have to certify a tool everyone already uses informally?
That is precisely the gap the roundtable participants described closing. Centralised certification of firm-level tools was one of the six practices named, and an uncertified tool used on an engagement is the case CAS 220 and CSQM 1 both point at.
Is a vendor’s own assurance report enough?
It is evidence, not an answer. Oversight of third-party tools — how to evaluate vendor-developed tools, set certification criteria and monitor them — was listed by participants as an area where guidance is still needed, which tells you it is not a settled question you can delegate.
When will the guidance arrive?
The AASB records that the IAASB agreed in December 2025 to develop non-authoritative materials and would discuss the action plan, themes, scope and timing at its March 2026 meeting. Until it arrives, the standards themselves are the authority.
A 30-minute call is enough to tell you whether AI pays for itself here.
