Can AI be used in a review engagement?

The short answer

Yes, on the preparation. The heavy arithmetic in a review is analytical: building comparatives, computing ratios, disaggregating revenue by month and by stream, and identifying the accounts whose movement does not fit the entity's own history. That is computation at speed, and doing it across three years rather than one is genuinely better work rather than merely faster work.

What comes out is a list of things to ask management about. The conversation is a person's, the judgment about the answers is a person's, and the report at the end is signed by the public accountant. The requirements for the engagement itself are set out in CSRE 2400, Engagements to Review Historical Financial Statements, in the CPA Canada Handbook — Assurance; the AASB's effective-dates record for Other Canadian Standards is where to check its current status rather than a summary.

Why the statute matters more than you think

Practitioners often treat ‘review or audit’ as a client preference. For a federal not-for-profit it is not. Under section 188 of the Canada Not-for-profit Corporations Act, the public accountant of a designated corporation shall conduct a review engagement in the prescribed manner, unless the members pass an ordinary resolution requiring an audit engagement. Section 189 runs the other way for corporations that are not designated: an audit engagement is the default, and a soliciting corporation may have a review only if its gross annual revenues for the last completed financial year are at or below the prescribed amount and its members pass a special resolution. Section 191 then requires the public accountant to report in the prescribed manner after either engagement.

‘Prescribed’ is doing real work in those sentences. Section 83 of the Canada Not-for-profit Corporations Regulations provides that a review engagement shall be conducted, and the report prepared, in accordance with the standards set out in the CPA Canada Handbook — Assurance, as amended from time to time; section 84 sets the prescribed amount for paragraph 189(2)(a) at $250,000. Corporations Canada sets the whole ladder out in one table:

• • Soliciting corporation, gross annual revenues of $50,000 or less. Members appoint a public accountant by ordinary resolution at each annual meeting, and may waive the appointment by annual unanimous resolution. The accountant must conduct a review engagement unless the members pass an ordinary resolution requiring an audit. If no accountant is appointed, only a compilation is necessary.
• • Soliciting, more than $50,000 and up to $250,000. An audit, unless the members pass a special resolution requiring a review engagement instead.
• • Soliciting, more than $250,000. An audit.
• • Non-soliciting, $1 million or less. A review engagement, unless the members pass an ordinary resolution requiring an audit; the appointment itself may be waived by annual unanimous resolution.
• • Non-soliciting, more than $1 million. An audit.

A firm that decides to run a lighter procedure because the client is small is therefore not exercising judgment. It is departing from a regulation, and the client's own filing obligations depend on the result.

Where AI helps, concretely

• • Building the analytical file. Three-year comparatives, common-size statements, monthly disaggregation and ratio sets, assembled from the general ledger rather than typed.
• • Anomaly surfacing. Listing accounts and periods whose movement departs from the entity's own history, with the underlying figures attached so the practitioner can look rather than trust.
• • Inquiry preparation. Turning that list into a structured set of questions for management, grouped by area, so the meeting is efficient and the responses are documented against specific figures.
• • Consistency checking. Comparing the draft financial statements against the disclosure checklist and against the prior year, and flagging what is missing or newly worded.

Notice that each of those ends in a person looking at a number. That is not a stylistic preference; it is how you avoid the failure mode regulators are already describing, which is a tool being treated as the primary source of evidence with limited work done on the completeness and accuracy of what went into it.

The regulator has already named the risk

The Canadian Public Accountability Board's page on technology in the audit records that Canadian firms are integrating advanced tools including agentic AI into their workflows, that this introduces new risks alongside the opportunities, and that the use of technology is a focus in CPAB's inspections — specifically the system of quality management practices around obtaining or developing, approving, implementing and maintaining automated tools and techniques at both firm and engagement level. CPAB's remit is audits of reporting issuers rather than reviews of a community association, but the observation transfers cleanly: the question an inspector asks is not whether you used a tool, it is whether you can show why it was fit for the work.

The AASB's own Technology Quality Management workstream frames the same issue at the standard-setting level, noting that emerging technologies raise challenges when the technology's logic is hard to explain, when outputs vary for the same input, and when tools change over time. Those three properties are the reason a review file needs to record which version of a tool produced which schedule.

Worked example (illustrative)

A single-partner practice in British Columbia performs reviews for eleven not-for-profits, several of which sit close to a statutory threshold. Its analytical work has historically been two ratios and a conversation, because the alternative cost more than the fee supported.

It introduces a tool that builds a three-year disaggregated analytical file from the ledger in minutes. The immediate effect is not time saved — the partner spends the same hours — but the conversation with each board changes, because the questions are now specific to a month and an account rather than general. The partner documents which schedules the tool produced, keeps the underlying export, and records the inquiry responses against the figures that prompted them.

The countable measure here is the number of inquiry points raised per engagement and the number that produced an adjustment. Both come out of the file. Neither requires anyone to estimate hours.

What has not changed and will not

The report is the practitioner's and the file has to support it. If a client or a lender later argues that the statements they relied on were wrong, the question a court asks is about the practitioner's conduct, not the tool's — Treadstone Law sets out how Ontario courts decide the standard of care a professional owed and when the firm rather than the individual is the defendant.

Questions we get asked

Can AI decide whether a review is enough, or an audit is needed?
No, and for a federal not-for-profit that decision is not the practitioner's either — it is set by sections 188 and 189, the prescribed amounts, and a members' resolution.

Does the client need to consent to AI in the engagement?
Consider it in the engagement letter. The driver is usually confidentiality and where the data is processed rather than the standard itself.

Are review engagement standards changing?
The AASB's effective-dates record shows narrow-scope amendments concerning the use of a practitioner's expert taking effect for CSRE 2400 for reviews of financial statements for periods beginning on or after 15 December 2026. Check that record rather than a summary before you rely on a date.