The APES 110 conceptual framework: applied to AI.

APES 110 does not try to list every situation it covers. Section 120 sets out a conceptual framework that members must apply to identify, evaluate and address threats to the five fundamental principles. Adopting AI is exactly the kind of situation the framework exists for, and the Code now gives technology examples to work with.

How the framework works

R120.3 requires members to apply the framework in three steps: identify threats to compliance with the fundamental principles, evaluate whether each is at an acceptable level, and address any that are not. R120.5 requires an inquiring mind, professional judgement and the reasonable and informed third party test throughout. An acceptable level is one at which a member using that test would likely conclude that the member complies with the fundamental principles (120.7 A1).

The threats the Code names for technology

The Code groups threats into five categories: self-interest, self-review, advocacy, familiarity and intimidation (120.6 A3). For members in public practice, 300.6 A2 gives examples of how technology creates them:

• Self-interest threats where the data available might not be sufficient for effective use of the technology, where the technology might not be appropriate for its purpose, or where the member lacks the information and expertise, or access to an expert, to use and explain it.
• Self-review threats where the technology was designed or developed using the knowledge, expertise or judgement of the member or the firm.

The first group is a fair description of an AI rollout gone wrong: a general-purpose tool applied to work it was never evaluated for, by people who cannot say why its answers should be trusted. The second applies to firms that build their own prompts, templates or agents and then rely on the output without independent review.

Automation bias

Section 120 also asks members to be aware of bias when exercising professional judgement, and its examples include automation bias: a tendency to favour output generated from automated systems, even when human reasoning or contradictory information raises questions as to whether such output is reliable or fit for purpose (120.12 A2). Separately, R112.1 names undue reliance on technology as one of the things that must not compromise a member’s judgement.

Automation bias grows with fluency. AI output reads well, arrives instantly and is usually right, and that combination is what makes a reviewer stop checking. The actions the Code suggests to mitigate bias (120.12 A3) include seeking advice from experts, consulting others to ensure appropriate challenge, and training on identifying bias.

Evaluating and addressing the threats

Paragraph 300.7 A6 says the evaluation of technology threats can be affected by the firm’s environment, including the level of oversight and internal controls over the technology, third-party assessments of its quality and functionality, and regular training so employees can understand, use and explain it. Those translate into safeguards a firm can put in place:

Where a threat cannot be reduced to an acceptable level, R120.10 leaves the remaining option: decline or end the activity. For some work, that means AI is not used at all.

The third party test, applied

A practical way to use the test is to imagine explaining to a reasonable, informed outsider how a piece of AI-assisted work was produced: which tool, why it was appropriate, what went into it, and who checked the output and how. If that explanation is comfortable, the firm is in a defensible position. If it rests on “the tool is usually right”, it is time to add a safeguard.

Where deployment posture fits

Deployment changes some of the factors in 300.7 A6. A unit inside the firm puts oversight, access controls and inputs in the firm’s own hands, and answers that cite their source excerpts make independent review quicker. It does not remove the threats that come from people: over-reliance, rushed review and untrained users. Those belong in the firm AI policy. Our AI for accounting practices page shows how Ermos units are set up.

Common questions