iscover Before you switch it on: why every accounting firm needs an AI review checklist
RegulationA new AI tool can save hours on a single engagement. It can also put a client's confidential information on a server you've never heard of, produce a citation to a ruling that doesn't exist, or quietly appear inside software you already use after a vendor update. For Australian accounting firms, the question is no longer whether to use AI, but how to adopt it in a way you can defend to a client, a professional body reviewer or the Tax Practitioners Board.
The rules are now clearer than they have ever been. The TPB's guidance statement TPB(GS) 55/2026 The use of Artificial Intelligence and the Code of Professional Conduct, issued on 22 July 2026, explains how the Code applies when tax and BAS agents use AI. For members of CA ANZ, CPA Australia and the IPA in public practice, APES 320 Quality Management for Firms that provide Non-Assurance Services already requires a documented system of quality management that covers the technology the firm relies on. Together they make one thing plain: AI doesn't shift responsibility. The practitioner remains responsible for the service and the advice.
"Most firms we speak to didn't decide to adopt AI. It arrived," says James McPhedran, Head of Product and co-founder of Elfworks. "A staff member signs up to a free chatbot, a practice management system switches on a new AI feature, a vendor sends a demo. Without a review checklist, nobody has asked where the client data goes, whether the output can be checked, or who signs off. That's exactly the gap the TPB guidance and APES 320 expect firms to close."
Why a checklist, and why now?
GS 55 is guidance rather than new law, but it spells out how existing obligations under the Tax Agent Services Act and the Code of Professional Conduct Determination apply to AI. Practitioners must exercise their own judgement and not rely on AI output as a substitute for analysing a client's circumstances. Output should be verified at each step of the workflow, with processes to understand and contest it. And entering client information into an AI tool may be a disclosure to a third party, which needs the client's permission first.
APES 320 provides the structure. Its seven elements, from governance and leadership through to monitoring and remediation, already cover technology resources, service providers, engagement performance and documentation. An AI review checklist simply makes those obligations practical for each new tool and each AI-assisted job. Importantly, APES 320 says policies need not be complex or time-consuming to be effective, so a two-partner firm can run a sound process with a register and a few checklists.
What an AI review checklist should contain
An effective checklist works at two levels: approving a tool before anyone uses it on client work, and checking each engagement where AI contributes to the result. At a minimum, it should cover:
- Purpose and reliance. What will the tool do, how far will you rely on its output, and is it suited to the task and the data going into it? Assign a risk tier: a tool that drafts internal admin from public information is very different from one that touches identifiable client data or feeds into lodgments.
- Accuracy and validation. Test the tool on de-identified past matters with known answers. Check that every citation exists, says what is claimed and is current, and ask the vendor how the tool keeps up with changes in law and standards.
- Data security and residency. Where is data processed and stored, including backups and sub-processors? Is it encrypted, who can access it, and are your inputs used to train the model? How is data retained and deleted?
- Confidentiality and client permission. Would using the tool be a disclosure to a third party? If so, does your engagement letter tell clients to whom and where their information goes, where it is stored and whether AI may be used?
- Privacy Act and TFNs. Confirm whether the Privacy Act applies to your firm, assess any cross-border disclosure, and decide your position on tax file numbers before anyone enters one.
- Human oversight. Identify any feature that can send, lodge or change records on its own, and make sure nothing goes out without a person's documented approval.
- Review at the right level. Match the reviewer to the risk: a routine workpaper needs a different level of review from written tax advice or a novel, contentious issue.
- Documentation and audit trail. Record the tool, the data entered, the output, what was verified, who reviewed it and when, so a reviewer, inspector or the TPB can see what the tool did and what the practitioner checked.
- Training, monitoring and review. Train people before they get access, include AI-assisted files in your APES 320 inspection cycle, keep an incident log, and re-assess tools when guidance, vendors or use cases change.
"The two items firms most often skip are data residency and verification, and they're the two that matter most," McPhedran says. "If you can't say where your client's data is processed and stored, you can't honestly get their permission to put it there. And if a tool won't show you the legislation, ruling or case behind its answer, you can't verify it, which means you're relying on it. GS 55 is very clear that you can't do that."
He also points to the engagement letter as the simplest control a firm can put in place. "Clients can give permission through a signed engagement letter or consent. A clear AI clause that tells them which providers you use, where the data sits and that your people review everything gets you most of the way on confidentiality, and it builds trust rather than eroding it."
On documentation, McPhedran is equally direct. "Write down what you checked. If an inspector picks up an AI-assisted file in twelve months' time, the record should show which tool was used, what went into it and how every citation was verified. That record is what turns a good process into evidence of a good process."
Building compliance into the platform
Elfworks, an AI tax research and advice platform for Australian public practice accountants, was designed with these obligations in mind from the start.
"We built Elfworks around the idea that the accountant must stay in control and be able to prove it," says Ian Youngman, co-founder and Managing Director of Elfworks. "Client data is processed in Australia, so firms aren't wrestling with offshore disclosure questions before they can start. Every piece of advice is cited and validated against Australian legislation, ATO rulings and case law, and the platform shows its working at each step so the practitioner can check it before anything reaches a client."
Youngman says the aim is to make APES 320 compliance part of the everyday workflow rather than an extra layer of paperwork. "APES 320 asks firms to show that their technology is fit for purpose, that work is reviewed at the right level and that it's documented. If the tool gives you traceable sources and a clear record of each step, much of that evidence is created as you work. Data security and ease of compliance shouldn't be things a firm has to bolt on afterwards. They should be how the platform works on day one."
Start with the checklist, not the tool
AI offers public practice a genuine opportunity to spend less time on repetitive, high-stakes analysis and more time on the client conversations that matter. The firms that will benefit most are those that decide how they'll assess, approve and review AI before the next tool lands on someone's desk.
Get your free AI review checklist. Elfworks has prepared a practical AI review checklist aligned with TPB(GS) 55/2026 and APES 320, covering tool approval, engagement-level review and ongoing monitoring.
To receive a copy by email, contact James McPhedran at
Want to see more stories from trusted news sources?Make Accountants Daily a preferred news source on Google.