Audit Firms Under FRC Scrutiny in 2026: Draft ISA 230 Working Papers On Device

UK audit firms can draft ISA (UK) 230 audit working papers with AI on their own hardware, so the file is prepared in house and no client financials ever leave the building. Doing it that way replaces AuditBoard, Workiva, CaseWare and TeamMate licences and the offshore working paper preparation that sits on top of them, turning a stack of recurring subscriptions into one owned system the firm keeps.

Why the FRC has audit working papers and ISA 230 AI in its sights in 2026

The Financial Reporting Council's Audit Quality Review has flagged documentation shortcomings in a significant share of the audits it inspects year after year, and in 2026 the regulator sharpened the point. Alongside its March 2026 guidance on generative and agentic AI in audit, the FRC criticised firms for not monitoring how AI affects audit quality. Industry reporting on those inspections singles out weak evidence over automated controls and over data that a model has touched. The message for engagement leaders is direct: if a tool drafts part of the file, the same standard still applies to what it produces.

ISA (UK) 230 is the reason this matters commercially, not just professionally. The standard requires that an experienced auditor with no previous connection to the engagement can understand, from the file alone, the work performed, the evidence obtained and the conclusions reached. A thin or unexplained working paper fails that test whether a junior wrote it or a model did. So the question every firm is now costing is not whether to use AI on the file, but where the drafting runs and whether it leaves a trail an inspector will accept.

What documentation and outsourcing cost a firm today

Working paper preparation is one of the most labour heavy parts of an engagement, and firms have spread that load across two lines that both meter. The first is software: audit and working paper platforms charge per seat and per engagement, and the AI features arrive as a further add on. The second is people: offshore delivery centres and contract preparers bill by the hour to build files during peak season. On top of both sits reviewer time, because a manager who inherits a thin paper writes it up again rather than signing it off.

Every one of those lines grows with headcount, with client volume and with each renewal. And because the client's trial balance, ledgers and supporting documents live inside a hosted platform or move to an offshore site, the firm is also carrying confidentiality and data residency exposure it does not control. The spend is recurring, the data leaves, and the documentation risk the FRC keeps naming does not go away.

How Aletheia drafts ISA (UK) 230 papers on the firm's own hardware

Aletheia is our audit studio, a ready-made application for one business function, drafting working papers and assessing controls, that runs inside the wider system a firm already owns. It drafts to ISA (UK) 230 with independence preserved, tests and documents controls, and pulls the file together from the same evidence a preparer would use. The difference is where it runs. Aletheia works fully offline on the firm's own hardware, and the Assistant runs on the firm's own brain, built on its own methodology and prior files, not on a shared cloud model. The client's financials stay on the machine and never enter an external training set.

That on-device design is what makes the AI usable on real engagements. Because nothing is sent out for inference, there is no per token cloud charge as the model drafts through a busy file, and no cross border transfer of the client's data to worry a general counsel or a regulator. The firm buys hardware once and runs the season on it, rather than paying a platform per seat and a delivery centre per hour to do the same work in someone else's environment.

What you replace, and what you save

The meter that disappears is the recurring one: the per seat platform fee, the per engagement charge, the AI add on and the offshore hour. What replaces it is a capability the firm owns outright and runs on hardware it controls. The reviewer time does not vanish, but it moves up the value chain, from rewriting thin documentation to exercising the professional judgement that only a person can sign.

The evidence trail: independence preserved and a sealed record

Independence is the line an audit tool cannot cross, and it is designed into how Aletheia runs. The studio drafts and assesses, it does not make the audit judgement, and because it runs on the firm's own brain no client data feeds a model shared with anyone else. Every draft, every control assessment and every version is sealed under post-quantum cryptography into a signed audit record, the Open Audit Record, so there is a tamper-evident trail of what the AI produced, when, and on what inputs.

That trail is exactly the artefact the FRC's 2026 position asks firms to hold. It does not claim any certification on the firm's behalf. What it does is produce the evidence that supports the firm's own quality monitoring: a record that shows an inspector how AI was used on the file and lets an experienced auditor with no prior connection reconstruct the work, which is what ISA (UK) 230 demands in the first place.

How a file comes together, step by step

• Point Aletheia at the engagement evidence held on the firm's own hardware, with nothing uploaded to a cloud.
• It drafts the working papers to ISA (UK) 230, setting out the work done, the evidence obtained and the conclusion reached.
• It assesses and documents the relevant controls, flagging gaps and the testing behind each judgement.
• Each draft and version is sealed into the Open Audit Record under post-quantum cryptography as it is produced.
• The reviewer works from a complete, explained file, applies professional judgement, and signs the work that is theirs to sign.

The sequence is deliberately the same shape a preparer and reviewer already follow. Aletheia does the drafting that consumes the hours, on the firm's hardware, and leaves the judgement and the sign off with the people who are accountable for them.

Frequently asked questions

Does drafting working papers with AI meet ISA (UK) 230?

The standard is about the file, not the author. ISA (UK) 230 requires that an experienced auditor with no previous connection to the engagement can understand the work performed, the evidence obtained and the conclusions reached from the documentation alone. Aletheia drafts to that requirement and seals each version to the Open Audit Record, so the file shows what was done and why, which is what an inspection tests.

Where does the client's financial data go?

Nowhere. Aletheia runs fully offline on the firm's own hardware, so the trial balance, ledgers and supporting documents stay on the machine. Nothing is sent to a cloud for inference and no client data enters an external training set, which removes the cross border transfer and residency exposure that a hosted platform or an offshore preparer carries.

What exactly does this replace in the audit software budget?

The recurring lines. AuditBoard, Workiva, CaseWare and TeamMate licences, the AI features priced on top of them, and the offshore or contract hours spent building files during peak season. Those meters stop, and the drafting they paid for runs inside one system the firm owns and hosts itself.

Does the tool make the audit judgement?

No. Aletheia drafts working papers and assesses controls, and independence is preserved by design. The professional judgement and the sign off stay with the auditor. The studio's job is to prepare a complete, explained and sealed file so the reviewer spends their time on judgement rather than on rewriting thin documentation.