What Auditors Should Ask When an Agent Performs the Control.

This week I spoke to the technology and life sciences group at a regional public accounting firm. The talk was about how companies move from AI tools to agents. The audit side of that shift gets far less attention than the productivity side, so this one is written for auditors.

Your clients are starting to hand recurring work to agents: software that starts on a schedule or an event, follows a written method, works inside their systems and hands the judgment calls to a person. Sooner or later you'll be asked to rely on that work.

What's changing at your clients

• Most companies are still prompting. Copilot, ChatGPT and Claude are rolled out, and people use them one question at a time. Individuals get faster. The process around them stays the same, and nothing runs unless someone asks.
• The next step is agents. A signed contract, a new upload or 7 a.m. every weekday starts the work. The agent follows a skill, the method the best person on the team wrote down, and routes the exceptions to a named person.
• Engineering teams are further along. Coding agents now write, test and review a growing share of the code. Engineers review and approve what merges.

An agent can perform a control. A person still owns it.

None of this is new to an auditor. The questions are the ones you already ask, pointed at a new performer: who owns the control, what was done and to which records, who reviewed the exceptions, and when.

The record that answers them is a run log. Every agent action recorded, every approval tied to a person, every cost traced back to the cloud bill. When a client can't produce that log, all they can show you is activity.

Capitalizing software when agents write the code

FASB's ASU 2025-06 removed the project stages from ASC 350-40. Capitalization now starts when management has authorized and committed to funding the project and it's probable the project will be completed and the software used as intended. It's effective for all entities for annual periods beginning after December 15, 2027, and early adoption is permitted.

Agents change what the cost looks like. More of the work shows up as metered model usage and less of it as engineer hours. Ask which of those costs a client capitalizes, how they tie them to a project, and whether agent spend can be separated from the rest of the cloud bill.

R&E when an agent wrote the first draft

Section 174A, added in July 2025, lets companies deduct domestic research and experimental expenditures for tax years beginning after December 31, 2024. Foreign R&E stays on 15-year amortization, and software development is still treated as R&E.

For clients whose engineers now direct coding agents, two questions follow. Is model and agent spend in engineering tracked well enough to support the deduction and the research credit? And how is qualified research documented when an agent did the first pass?

Life sciences: AI inside the quality system

For medical device clients, FDA's Computer Software Assurance guidance sets a risk-based approach to validating software used in production and quality systems. FDA finalized it in September 2025, reissued it in February 2026 for the new quality management system rule, and says the approach can apply to AI and machine learning tools. The question for the client is which agents touch production or quality records, and how each one was validated for its intended use.

Measure it the way you'd audit it

The pattern we see most is what we call random acts of AI: a pilot here, a hackathon there, usage climbing and nobody able to say what it's worth. Seat counts and token spend tell you people are busy. They don't tell you whether any work moved off anyone's plate.

We measure each workflow as the value of the work times the number of runs, minus the people time spent on exceptions, minus the model cost. Every input traces back to the run log and the billing record. That's the standard an auditor would hold it to, so it's the standard we hold ourselves to.

Five questions for your next client meeting

• Which recurring process would you hand to an agent tomorrow if you trusted it?
• Who approves what your agents do, and where is that recorded?
• How much of your code is written by coding agents, and how are you tracking that cost?
• What's your AI spend by department, and who owns it?
• If an agent performs a control, how would your auditor test it?