Introduction

Audit and assurance are undergoing their most significant transformation since the move from paper working papers to digital audit files. Artificial Intelligence (AI), machine learning, and generative AI are moving rapidly from experimentation into everyday practice. For Kenya and the wider East African Community (EAC), this transition comes at a pivotal moment as sustainability reporting requirements emerge, digital adoption accelerates and a new generation of technology-enabled professionals enters the workforce.

Why This Matters Now for Kenya and East Africa

Two regulatory developments make this a live issue rather than a future one for the region:

  1. Mandatory sustainability disclosures – Kenya is preparing to introduce mandatory IFRS S1 and S2 sustainability disclosures starting in January 2027, under a phased roadmap led by the Institute of Certified Public Accountants of Kenya (ICPAK), while the global assurance standard ISSA 5000 is expected to take effect around December 2026. Assuring ESG and carbon data at scale is very difficult to do manually, which is why AI-enabled continuous monitoring tools are already being piloted in the Kenyan market.
  1. A live example – Grant Thornton Kenya and Newtral Technologies have partnered to deploy an AI platform called Noa, which continuously monitors organizational data, reconciles information, identifies reporting gaps and prepares audit-ready disclosures for carbon accounting and ESG reporting. A concrete illustration of how continuous, machine-assisted assurance is starting to replace the old model of periodic, sample-based review.

At the same time, the profession’s own institutions are actively discussing what this means for practice. KCA University and the Institute of Internal Auditors (IIA) Kenya jointly hosted a forum on the future of internal auditing in May 2026, focused explicitly on AI, governance reform, and strategic risk management across public and private sectors.

Where AI Is Already Showing Up in East African Audit Practice

Adoption in the region is uneven but real and it clusters around a few use cases:

  1. Document and data extraction – Tools that read invoices, receipts, and bank statements and pull the data straight into working papers are gaining traction locally. These are the most immediately useful forms of AI for East African practices because it attacks the single most labour-intensive part of a traditional audit, manual data capture and reconciliation.
  2. Public-sector audit management – Kenya’s Office of the Auditor-General relies on audit management platforms such as TeamMate+ to track the entire audit lifecycle in a secure environment, which is important for institutional transparency on large public projects. As these platforms add AI-assisted risk scoring and anomaly detection, public-sector audit stands to benefit significantly from earlier detection of irregular spending patterns.
  3. Locally built infrastructure – ICPAK itself has developed an online audit automation platform, commonly referred to as myAudit, built around IFRS for SMEs and the official ICPAK Audit Manual, allowing auditors to collaborate remotely, manage client access, and centralize working papers in the cloud. 
  4. Continuous assurance for ESG and compliance – Platforms like Noa point toward a model where assurance is not a once-a-year exercise but an ongoing check against live organizational data, such a meaningful departure from the traditional audit cycle.

The Opportunities

  1. Efficiency and cost – Manual vouching, reconciliation and sampling are time-consuming and expensive. AI-driven data extraction and continuous monitoring can shrink fieldwork time substantially, potentially making quality audits more affordable and accessible to a broader base of businesses including the large informal and semi-formal sector that currently receives little or no assurance coverage at all.
  2. Better risk detection – Instead of testing a sample of transactions, machine learning models can scan entire populations of data for anomalies, unusual relationships or patterns consistent with fraud. In markets where financial crime, mobile-money fraud and public procurement irregularities are recurring concerns, full-population testing is a genuine upgrade over sample-based methods.
  3. Freeing auditors for judgment work – If AI absorbs routine testing and drafting, auditors can spend more time on professional skepticism, client dialogue and complex judgment calls, the parts of the job regulators most want strengthened and the parts hardest to outsource to a machine.

The Risks and Constraints

  1. Data and connectivity gaps – AI tools are only as good as the data feeding them. Many East African businesses, particularly SMEs and informal enterprises keep incomplete, paper-based, or inconsistent records and rural connectivity remains patchy. An AI tool trained or tuned on data-rich, well-digitized environments may perform poorly, or produce misleading confidence, when applied to messier local datasets.
  2. Cost and the small-firm reality – Enterprise AI-audit platforms (of the kind used by large multinational networks) are often priced well beyond what a small Kenyan, Ugandan, Tanzanian or Rwandan practice can afford. Without deliberate low-cost alternatives the ICPAK myAudit approach is a useful model. AI adoption risks widening the gap between large and small firms rather than levelling the playing field.
  3. Skills and training – Auditors need to understand not just how to use AI tools but how to evaluate them: what data they were trained on, where they are likely to be wrong and how to document reliance on their output. This is a new competency area and East African accountancy curricula, and CPD programmes are only beginning to catch up. The KCA University/IIA Kenya forum on the future of internal audit is an early sign that institutions recognize this gap.
  1. Overreliance and the “black box” problem – Auditing standards require auditors to understand and be able to explain the basis for their conclusions. Many AI models, particularly deep learning ones, do not readily explain their outputs. Regulators globally are grappling with how auditors can rely on a tool whose reasoning cannot be fully inspected, without simply treating the AI’s output as ground truth.
  2. Data protection and confidentiality – Client financial data is highly sensitive. Kenya’s Data Protection Act, 2019, and equivalent frameworks in neighbouring countries impose obligations on how personal and financial data is processed, stored and transferred, obligations that become more complex when AI tools process data via cloud infrastructure that may sit outside the region. Firms need clear policies on what data can be fed into third-party AI systems, especially where models are hosted abroad.
  3. Talent and job-displacement concerns – Junior audit roles have traditionally been where vouching, ticking and reconciliation work is learned. If AI absorbs that work, the profession needs a deliberate plan for how junior staff still develop the foundational skills and judgment that senior auditors rely on, otherwise the pipeline of well-trained future partners and Audit staff could weaken over time.

What are Standard-Setters and Regulators Doing?

The global standard-setting response is directly relevant to Kenya and East Africa because ICPAK and its counterparts across the EAC adopt International Standards on Auditing.  The International Auditing and Assurance Standards Board (IAASB) held global roundtables in the second half of 2025 with more than 240 stakeholders across six continents to explore how AI and other emerging technologies affect audit engagements and the application of quality management standards, concluding that robust quality management of AI-enabled tools is the starting point for maintaining trust and consistency in their use. The IAASB has also been building out guidance on “Automated Tools and Techniques” – a deliberately broad term covering AI, robotic process automation and other evolving technologies. In December 2025 the Board approved development of non-authoritative material on this topic, meaning more detailed guidance is on its way rather than already finalized.

Domestically, ICPAK maintains direct responsibility for quality assurance review in Kenya and supports members through mandatory training on audit quality assurance, quality management, and inspection readiness, alongside implementation tools such as audit software and illustrative financial statements. As AI tools proliferate, this quality-assurance apparatus will need to explicitly extend to reviewing how firms select, validate and rely on AI in engagements not just whether the final opinion was correctly formed.

A Regional, Not Just Kenyan, Concern!

While Kenya has the most visible activity the same dynamics apply across Uganda, Tanzania, Rwanda and Burundi. All EAC member states’ professional bodies are IFAC members that base their standards on the same International Standards on Auditing, meaning:

  • Any AI-related guidance the IAASB eventually issues will apply, in principle, across the whole region.
  • Cross-border audit networks operating in multiple East African markets will face pressure to apply consistent AI tools and controls across offices of very different sizes and levels of digital maturity.
  • Regional bodies have an opportunity to coordinate, through the Pan African Federation of Accountants, for instance: on shared, affordable AI-audit tooling and joint training, rather than each country building parallel, under-resourced solutions.

Recommendations

  1. For audit firms, especially SMPs: start with narrow, well-understood use cases (data extraction, reconciliation) rather than end-to-end AI decision-making; document clearly where AI output was used and how it was reviewed and invest in staff training on AI literacy alongside traditional technical training.
  2. For regulators and professional bodies: issue interim local guidance on AI use in audits while global standards catch up; extend quality assurance inspections to cover AI tool governance; and keep licensing and technology costs) low enough that small firms are not locked out.
  3. For educators: integrate AI literacy, including its limitations into accountancy curricula now, so that the next generation of auditors enters practice already able to evaluate, not just operate, these tools.
  4. For businesses and audit clients: improve the quality and digitization of underlying financial records, since AI-enabled audit and assurance can only be as reliable as the data it is given.

Conclusion

AI is not going to replace professional judgement in audit and assurance, but it is already changing what auditors spend their time on. How much of a population can be tested and how quickly assurance can be delivered. East Africa is an active participant in this shift, the region’s challenge is to capture the efficiency and quality gains that AI offers without deepening the divide between large, well-capitalized firms and the small practices that make up most of the profession. Getting the balance right will depend on deliberate, affordable and locally grounded choices by ICPAK, its regional counterparts, the firms and universities that train the next generation of auditors.

Credits to Robert Maithia | Business Dev. Officer | Zade Associates LLP