Sunday afternoon in April. An audit senior at a small IRBA firm off William Nicol has three files open: a Kya Sand manufacturing client with a February year-end, a retirement fund whose June audit is still in first-quarter planning, and a body corporate whose trustees have not returned last year's engagement letter. The PBC list she sent the manufacturer's financial manager two weeks ago has come back at forty percent. Half of what did arrive is in the wrong template. The Standard Bank confirmation has not been received, and the branch keeps sending it to the wrong email. In an hour she will call her partner about extending fieldwork by a week without slipping the sign-off.
This is what busy season actually looks like at a small-to-mid SA audit firm. Not judgement. Not risk. Not the professional skepticism the ISAs and IRBA inspectors talk about. Coordination. Chasing. Reformatting. Following up.
AI does not do the audit. It cannot sign the opinion, and any partner who thinks otherwise is a year or two from an uncomfortable Reg 29 conversation. What it can do, applied by a partner who understands the difference between admin and judgement, is take a large slice of the coordination burden off the file. Not the interesting slice. The slice that has always been paid at cost.
Where the hours actually go on an SA audit file
Any partner who has run a busy season in a small-to-mid IRBA firm knows the distribution by heart:
- Engagement admin — letters, independence declarations, acceptance and continuance decisions, ISQM 1 evidence
- PBC coordination through planning, fieldwork, and completion
- Confirmations to banks, attorneys, and legal counsel
- Workpaper administration — TB imports, PY-CY rollforward, indexing, cross-referencing, sign-off logs
- Analytical review drafts at trial-balance and lead-schedule level
- Running client comms — "did you receive", "can you resend", "the format was wrong"
- File closing and archival, the last week nobody wants to touch
Every item on that list is structured work. Every one is well-suited to automation or to AI assistance layered on top of a well-designed workpaper system. None of them, done properly, requires the partner to release professional judgement to a bot.
Engagement letters and independence: the annual cliff
For most small firms, the second half of February is a wall of engagement letters going out for the year ahead. Existing clients need reappointment with updated fees. New clients need full ISA 210 packs. Groups where the partner is rotating off in year six under Companies Act s92 need the new signing partner's letter. Every letter needs the independence declaration refreshed under ISQM 1 element five.
Most of the content is boilerplate. The specifics change: fee, reporting deadline, scope for non-audit services, group audit arrangements, whether the entity is a public interest entity under the Auditing Profession Act. The underlying letter structure is the same across the book.
An AI-assisted flow drafts the right engagement letter for each client from a template library, pulling client-specific fields from the practice management system. It flags any client whose year-on-year fee change sits meaningfully outside the norm, so the partner reviews before the letter leaves. It produces a matching independence questionnaire pre-filled with last year's answers, so the team confirms rather than starts from scratch.
The reviewing partner still signs each letter. Continuance decisions, particularly where the client's risk profile has changed, remain a judgement call. AI produces the paperwork. It does not produce the decision.
PBC lists: where the audit actually starts
The Prepared-By-Client list is the coordination artefact that decides whether the audit runs on time. Get it wrong and fieldwork gets spent chasing basic schedules. Get it right and the team walks in with clean support for eighty percent of what they need.
A well-designed PBC workflow does three things a manual one struggles with.
First, it rolls the list forward from the prior year with changes flagged. New IFRS 17 disclosures for a small insurer, or SARS-provided data pulled through the client's payroll, or the segment change from the September board pack: those get added, not lost because the senior who ran last year has moved on.
Second, it sends the list to the client's finance team through their preferred channel (usually email for the formal request and WhatsApp for the follow-up) and tracks receipt at line-item level. Not "the client sent something", but "the fixed-asset register was received, the addition schedule was received, the impairment memo has not".
Third, it flags format problems on receipt. A trial balance uploaded as a PDF instead of an Excel export gets bounced back with a specific note about what is needed. A lease schedule in the wrong template gets a link to the right one. The senior does not learn about the format issue three days later at 22:00.
The gain here is not that the audit runs faster. It is that when fieldwork week starts, the team walks in with the right documents in the right shape. Every senior who has ever spent Monday of fieldwork on missing schedules understands what that is worth.
Confirmations: the workflow that reliably gets worse before it gets better
Bank confirmations. Attorney letters of representation. Related-party confirmations. Legal representation letters. None of them are technically difficult. All of them regularly slide.
The pattern is familiar. Standard Bank confirms in two weeks, ABSA in three, and the client's small-business banker at a niche bank takes six weeks and confirms the wrong entity. The attorney's letter comes back with the wrong reporting period. The legal representation letter needs a redraft because the client's in-house counsel changed the wording in a way that does not answer ISA 501.
AI-assisted confirmation management does a few things at once. It drafts each confirmation from the current-year template with correct entity and reporting period, so a redraft loop from a copy-paste error is one less thing that happens. It tracks receipt and chases the counter-party on a cadence the partner has approved, escalating from email to a phone follow-up when the delay crosses a threshold. On receipt, it does a first-pass check that the response actually answers the confirmation: right entity, right period, right balances, right signatories.
Anything the check flags routes to the senior. Anything that passes lands on the file with an audit trail of when it arrived and how it was checked. The partner walks into review knowing which confirmations are open, which are late, and which the team has already reviewed.
Workpapers and analytical review: what AI can genuinely draft
The workpaper stack is where CaseWare, Draftworx, and TeamMate have owned the SA market for a decade. AI does not replace the file. It sits alongside it and helps in specific places.
TB import and rollforward, mapping this year's TB to last year's lead schedules and flagging accounts that have moved by more than the materiality-scaled threshold, becomes a five-minute review instead of a two-hour setup. Cross-referencing between lead schedules and detail workpapers, which every senior has done manually at 23:00 the night before review, can be generated and then checked.
Analytical review commentary — the "revenue is up eleven percent because of the two new distribution contracts signed in November, in line with the board pack's outlook" kind of paragraph — can be drafted from PY-CY movements plus minutes the client has already sent. The senior confirms it against what they see in the file. The partner reads a draft, not a blank template.
The line to hold: AI drafts, auditors conclude. The conclusion in the lead schedule is a human conclusion. The sign-off is the auditor's. A partner who lets AI-generated commentary onto the file without a human read is going to have a very uncomfortable inspection.
Where AI does not belong on an audit file
This is the part most vendors will not say clearly. It is worth naming.
Sample selection driven by fraud-risk overlays, where the auditor is deliberately targeting accounts most likely to have been overridden by management, is not a job for a bot. Going concern for a mid-market client where a covenant breach may or may not signpost a real problem is not either. Any ISA 240 consideration weighing motive and opportunity, rather than balance movements alone, is the auditor's. The difficult conversation with a financial director whose reconciling item does not reconcile is a partner's job, not a chat window.
Client acceptance and continuance, where the partner is weighing whether to walk away because risk no longer matches fee, is a decision taken with the file in front of them and other partners in the room. A bot's opinion on whether to continue an engagement is worth nothing at an IRBA inspection.
The signing partner remains the signing partner. Any product selling itself on "reducing the need for auditor judgement" is either misunderstood by whoever is selling it or heading for a CFRC referral.
POPIA, IRBA, and ISQM 1: what the partner needs in writing
An SA audit firm handles some of the most sensitive commercial data any professional services firm sees. Trial balances. Board minutes. Executive contracts. Going-concern memos. Related-party detail. Any automation touching the file has to treat POPIA as a hard requirement and IRBA's expectations as the ceiling.
Practically:
- Client data stays in infrastructure the firm controls, or in contracted processors with a written operator agreement that satisfies POPIA section 21. Anything that would land in a consumer AI tool's training data does not go there.
- The partner can walk an IRBA inspector through where client data lives, who has access, and how access is logged.
- ISQM 1 evidence covering AI-assisted work is auditable, not a slide deck. If the firm cannot produce the run log, the vendor contract, and the review record for an inspection, the tool should not be on the file.
When evaluating a vendor, the questions are basic: where is data processed, who has access, what is retained, what happens on deletion, what happens if the vendor is subpoenaed. If they cannot answer cleanly on a first call, they are not ready to touch an audit file.
Where to start: one narrow project, done properly
The mistake most firms make is trying to automate the whole busy season at once. The firms that get real value almost always start narrow and build outwards from something that already works.
The right first project for most SA audit firms is PBC coordination for the top ten to fifteen clients by fee. It is high-volume, structured, has an immediate visible impact on the file, and does not touch any judgement work. The output is a cleaner set of client documents arriving in the right format at the right time. Every senior who has ever spent fieldwork Monday chasing schedules knows why that matters.
Once that is working, the natural extensions are engagement-letter drafting ahead of February, confirmation tracking through March and April, and analytical review drafts on the largest files. Each step compounds the previous one. Within two busy seasons, coordination overhead on the file drops meaningfully, and the partner reads the file rather than assembling it.
The audit firms in Cape Town and Johannesburg that have built AI for auditors this way describe the same shift. Busy season stops being a run of coordination emergencies. Senior time moves back onto risk, sampling, and the judgement clients actually pay for. The IRBA file passes inspection because the evidence is on the day it was produced, not reconstructed a week later.