On Sept. 9, California set some of the nation’s first rules for who may audit artificial intelligence.
uncertain
who → set → intelligence
I spent four years on the board that regulates public company auditors, often as its lone dissenter, and the state got more right than wrong.
asserted
state → spend → right
The problem with the policies is that nothing requires proof that an AI audit got the numbers right, which defies the whole point.
asserted
which → require → point
Financial auditors, like everyone else, are increasingly adopting AI in their work, but faster audits are useful only if they avoid the persistent, costly mistakes we keep making.
asserted
we → adopt → mistakes
In 2024, federal agencies reported an estimated $162 billion in improper payments, despite most receiving clean opinions on their financial statements.
asserted
most → report → statements
In the private sector, researchers estimated that corporate fraud destroys $830 billion annually at 2021 valuations.
asserted
fraud → estimate → valuations
These losses are not all audit failures, but they do show how wide the gap has grown between passing an audit and getting the numbers right.
asserted
numbers → show → audit
That gap can pose steep costs to businesses, which pay their accountants by the hour for work that spends too much time box-checking processes and not enough on verifying the results themselves.
asserted
that → pose → results
No matter how good a process is, if it produces a wrong conclusion, it should be marked as failed, even if the inspection finds the process was followed.
asserted
process → produce → conclusion
A single employee hid over $100 million in expenses over nearly three years, falsifying documentation along the way.
asserted
employee → hide → way
In December 2024, Macy’s said neither its own financial controls nor its auditor’s assessments of them could be trusted.
uncertain
controls → say → them
The controls were signed off on, but the numbers were wrong anyway.
asserted
numbers → sign → ?
California did get two big things right, and the first is competition.
asserted
first → get → ?
The Big Four accounting firms audit nearly every large public company in the United States, leaving customers little choice in their provider.
asserted
firms → audit → provider
California opens AI auditing to smaller CPA firms, technology companies, nonprofit groups, and academic consortia that demonstrate expertise.
asserted
that → open → expertise
Qualified entrants can bring better tools, lower costs, and more choice about whom to trust.
asserted
entrants → bring → whom
Even OpenAI calls for the government to help build a competitive market of AI auditors and develop standards that assess safety and security risks without imposing unnecessary burdens on small companies.
asserted
that → call → companies
Second, California required safeguards against conflicts of interest.
asserted
California → require → interest
When Arthur Andersen served as both auditor and consultant to Enron, the arrangement famously exposed the danger of competing interests.
asserted
arrangement → serve → interests
Customers need to trust that an auditor’s conclusions are free from influence, which is why certain financial and operational relationships have to be firewalled.
asserted
relationships → need → influence
These are fine steps, but the next one is the hard one, and no government body has taken it.
asserted
body → take → it
Markets work best when regulators say plainly what they expect.
asserted
they → work → what
Right now, no one knows what will count as adequate proof.
asserted
what → know → proof
Buyers cannot tell good tools from bad ones, and a firm that adopts what it thinks is the former still cannot be sure a regulator will accept its results.
asserted
regulator → tell → results
The technology is ready to be put to use.
asserted
technology → put → use
What is missing is business confidence.
asserted
missing → miss → ?
Regulatory clarity unlocks a market where 1) auditors are chosen on demonstrated performance and capability, 2) smaller firms win on the evidence they can comply, and 3) companies learn about a problem in March instead of the following January.
asserted
companies → unlock → March
I left the Public Company Accounting Oversight Board to help build Oath Verified because machine checking machine, with a human answering for the result, is how the profession earns back trust.
asserted
profession → leave → trust
Sacramento’s formula is “trust, but verify.”
asserted
formula → trust → ?
At Oath, we believe in the reverse order.
asserted
we → believe → order
When the outputs are right, the trust naturally follows.
asserted
trust → follow → ?
She served on the Public Company Accounting Oversight Board, 2021-26
asserted
She → serve → Board
The Aporia
