ACRA Audit Practice Guidance on AI: What SMEs Being Audited Should Expect

Short answer: ACRA’s Audit Practice Guidance No. 1 of 2026, issued on 2 October 2026, tells auditors how to use AI responsibly. It places no new duty on audited companies, but SMEs should expect fuller digital data requests, closer checking of AI-prepared records, and should ask which AI tools will process their confidential and personal data.

The ACRA audit practice guidance on AI is the first document from Singapore’s audit regulator that deals squarely with auditors who use artificial intelligence (AI), meaning software that can analyse, summarise or generate content with limited human input. It is written for auditors and audit firms, not for the companies they audit. Even so, if your company has a statutory audit, the way your auditor works with your ledgers, bank statements and contracts is likely to change, and you have a direct interest in how your data is handled.

Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.

What is ACRA’s Audit Practice Guidance No. 1 of 2026?

It is a short practice note from the Accounting and Corporate Regulatory Authority (ACRA) on how auditors should use AI responsibly in day-to-day audit work. It is guidance, not a new statute or auditing standard, and ACRA states that its considerations are not exhaustive. You can read ACRA’s announcement and the full guidance.

The guidance notes that auditors will meet AI in two ways: when they use AI to support audit procedures, and when they audit information that has been prepared or assisted by AI. That second point matters to SMEs. If your bookkeeper uses AI to categorise transactions, or your finance team drafts schedules with a chatbot, the auditor is expected to evaluate that output like any other information.

The guidance is organised around five themes:

Does the ACRA audit practice guidance on AI apply to my company?

Not directly. The guidance is addressed to auditors and audit firms, so it creates no filing, disclosure or approval step for the audited company. Its effect on you comes through your auditor’s methods and the questions you are entitled to ask.

The guidance states that, where appropriate, auditors should be able to explain to those charged with governance how AI was used during the audit, the safeguards applied and how professional judgement was exercised. In an SME, those charged with governance are usually the board of directors. ACRA links this to its Audit Quality Indicators (AQI) framework, which encourages dialogue on audit quality, including the use of technology where relevant. Directors can raise this at the planning meeting.

What data will an AI-assisted auditor ask for?

Expect requests for fuller, machine-readable data rather than paper samples. AI tools work best on complete datasets, so auditors may ask for whole general ledger exports, bank statement files and organised document folders.

The guidance separates two kinds of task. For process-driven tasks where AI executes predefined steps, such as extracting information from documents or matching accounting records to supporting documentation, the auditor should consider whether the output is complete and accurate. For work involving judgement, such as risk assessment or generating audit documentation, the auditor should, where appropriate, verify AI outputs against the underlying sources. Both have practical consequences for you:

• Completeness checks mean the auditor may reconcile the full ledger export to your trial balance and bank statements before running any tool on it. Gaps or duplicates in the export will come back to you as queries.
• Verification against sources means an AI-flagged anomaly is the start of a question, not a finding. You may be asked for the invoice, contract or approval behind a flagged item.
• ACRA notes that AI enables broader coverage of transactions, so unusual entries a manual sample might miss are more likely to surface.

Clean, consistently labelled records pay off. Our guide on preparing for your first statutory audit in Singapore covers the core document set.

How will auditors treat records your team prepared with AI?

With the same professional scepticism as any other evidence. The guidance says AI can hallucinate, reinforce bias and misinterpret context in ways that are not immediately obvious, and that auditors should actively assess or challenge outputs rather than accept them at face value.

ACRA cites recent incidents in which international accounting firms issued reports containing fabricated references and fictitious case studies generated by AI; the firms withdrew or corrected the reports and, in one case, agreed to partially refund the client. The guidance closes by observing that auditors have long expected businesses to explain and support how information was prepared and how figures were derived. That expectation applies to your AI-assisted work too.

If your finance function uses AI, be ready to show:

• which schedules, reconciliations or memos were drafted or populated with AI;
• who in your team reviewed the output, and what source documents they checked it against;
• how figures in an AI-drafted schedule tie back to the ledger and bank records.

What confidentiality and PDPA questions should you ask your auditor?

Ask which AI tools will process your files, where the data is stored, whether it is retained or used to train a model, and what personal data the auditor actually needs. The guidance expects auditors to understand these points before using a tool.

Specifically, auditors should understand how an AI platform processes, stores, retains and shares data, including whether information entered may be retained or used to train the underlying model. Where there is uncertainty, they should avoid entering confidential or client-identifiable information, and should use only AI tools approved under their firm’s governance, confidentiality, security and compliance requirements. One of its reflective questions is whether the auditor would be confident telling the client what information was entered into an AI tool and why it was necessary.

Your company has its own duties under the Personal Data Protection Act 2012 (PDPA) for personal data you hold, such as payroll and customer records. The Personal Data Protection Commission (PDPC) lists these as the data protection obligations, including the Protection Obligation (reasonable security arrangements), the Transfer Limitation Obligation (rules for sending personal data overseas) and the Data Breach Notification Obligation. Useful steps before you hand over data:

• Send only what the audit needs. Payroll testing may not require the full identity numbers, home addresses or bank details of every employee.
• Use the auditor’s secure portal rather than email attachments for bulk exports.
• Ask whether any AI tool processes data outside Singapore, which is relevant to the Transfer Limitation Obligation.
• Check that your engagement letter covers confidentiality and data handling, and involve your data protection officer (DPO).

The same questions arise with any vendor; see our article on a software supplier that wants customer data for AI training, and for the wider picture, what every company must do under the PDPA. If you need advice on a specific data-sharing arrangement, speak to a lawyer.

How should an SME prepare for an AI-assisted audit?

Prepare complete, consistent digital records and agree data handling with the auditor before fieldwork starts. A short checklist:

1. At the planning meeting, ask whether and how the firm will use AI, which tools, and how the engagement team reviews the outputs.
2. Confirm data handling in writing: approved tools, storage location, retention, and whether your data is used to train any model.
3. Close the books properly first. Reconcile bank accounts, clear suspense accounts and make sure the trial balance ties to the general ledger.
4. Export the full general ledger, bank statements and sub-ledgers in the format the auditor requests, with consistent account codes and descriptions.
5. Name and organise supporting documents so each invoice, contract and approval can be matched to its ledger entry.
6. List any schedules your team prepared with AI and keep evidence of human review.
7. Minimise personal data in what you send, and route it through a secure channel.
8. Assign one contact person to answer queries quickly, since full-population testing can generate more questions at once.

Our free tools can help with related compliance dates and checks.

Does your company need an audit at all?

Many SMEs do not. Under the current framework, a private company qualifies for audit exemption if it meets at least two of three criteria for each of the two financial years immediately preceding the current one: total annual revenue of S$10 million or less, total assets of S$10 million or less, and 50 or fewer employees. A company in a group qualifies only if the entire group meets two of the three criteria on a consolidated basis.

On 26 February 2026, ACRA announced a review of the audit exemption framework, including whether to raise the revenue and asset thresholds and whether subsidiaries may qualify under specific conditions. No outcome had been announced on that page as at 28 October 2026. ACRA has said that, whatever changes result, companies must still keep proper accounting records and prepare financial statements under the prescribed standards, and shareholders holding at least 5% of the issued shares retain the right to require an audit.

For the detail, see audit exemption and the small company test. For company secretarial support around audits and AGMs, our sister site Singapore Secretary Services has further resources.

Frequently asked questions

Is ACRA’s AI guidance mandatory for auditors?

It is practice guidance setting out considerations auditors and audit firms should apply, and ACRA says they are not exhaustive. Auditors remain bound by the auditing standards and ACRA’s Code of Professional Conduct and Ethics, which the guidance cites on integrity and confidentiality.

Can I refuse to let my auditor use AI on my data?

The guidance does not give audited companies a veto. You can discuss concerns, ask which tools are used and agree data-handling terms in the engagement letter. Raise specific concerns before the audit starts.

Does the guidance cover AI used by my own company?

Indirectly. It tells auditors to evaluate information prepared or assisted by AI with professional scepticism. Your company should be able to show how AI-prepared figures were reviewed and how they tie back to source records.

Who is responsible if the auditor’s AI tool makes a mistake?

The auditor. The guidance states that the auditor remains accountable for the work performed, the conclusions reached and the audit opinion, and that this responsibility cannot be delegated to AI.

Last reviewed: 28 October 2026. The Editorial Team, Raffles Corporate Services.