AI in finance and accounting
Section 290 governs using the work of an external expert, and its own boundary paragraph puts a commercial AI model outside it. 290.4 A4 excludes information from external sources for general use — benchmarking data, statistics, mortality tables. So the external-expert machinery does not apply and R220.8 does. The misreading is attractive, and it is wrong.
§ 1 — Who it binds
A professional accountant in business intending to rely on work performed by someone outside the employing organisation — a valuer, an actuary, a specialist firm — and, by exclusion, one relying instead on a general-purpose model or a bought-in dataset. The section applies as adopted by each IFAC member body, and adoption timing differs between jurisdictions.
§ 2 — In practice
Section 290 is new, added by IESBA’s pronouncement on using the work of an external expert, and the paragraph that decides this page is its own scoping provision. 290.4 A4 says the section does not apply to two things: individuals or organisations engaged by the accountant and working under the accountant’s direction, supervision and review; and information provided by individuals or organisations that are external information sources for general use, the examples given being benchmarking data, employment statistics, real estate prices, mortality tables and other datasets for general use. A commercial model sold to everyone is not a person engaged for their expertise on this matter. It sits far closer to the second category, which the section expressly places outside itself.
The misreading has an obvious cause. Section 290’s own illustration of what an external expert might do includes the assessment and evaluation of IT systems, including those related to cybersecurity, so a reader skimming for technology finds a hook and concludes the section governs the AI tool too. It does not, and the consequence runs in both directions. None of the machinery applies: no terms of engagement to agree, no competence, capability and objectivity evaluation of the model, no prohibition to observe. What applies instead is R220.8, which asks a different question — what steps this use of the output needs — and which cannot be discharged by the paperwork Section 290 would have called for.
R220.7 completes the map: using the work of others means others, that is people and organisations. Technology output has its own provision precisely because it is not that, so the Code’s structure here is three-way rather than two-way — the work of others, external experts, and technology output, each with its own governing paragraph. Where a case genuinely does sit inside Section 290 is where a person or firm is engaged for expertise the accountant lacks, and that remains so when the expert’s own work is AI-assisted: the reliance is on the expert, and what the accountant should be asking about is the expert’s method. A supplier’s support engineer explaining how a tool works is not an external expert either, unless they were engaged on those terms — a boundary the supplier register draws in a different vocabulary.
§ 3 — What a weak answer looks like
The model assessed as though it were a person. The file carries an independence declaration for a software supplier, a competence conclusion drawn from a product datasheet, and terms of engagement in the form of a licence agreement. Every document is genuine and not one of them answers a question the Code asks. What has happened is that a diligent accountant reached for the nearest recognisable framework, and the section they reached for contains the paragraph that excludes the thing they were assessing.
§ 4 — What discharges it
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
One line per source saying which provision governs it. The classification is what selects the duty, and a file that never makes it will end up applying the wrong one to something.
02
The judgement about what this use needed and what was established about fitness for purpose. The absence of a Section 290 file for a tool is correct; the absence of this one is not.
03
Competence, capability and objectivity for a human expert, with the terms on which they were engaged. None of it travels to a software licence, and none of it is satisfied by a datasheet.
04
Where an engaged expert produced their work with AI assistance, what the accountant asked and what they were told. The reliance is on the expert, and what it rests on is a fair thing to establish.
§ 5 — Worked example
A finance function engages a valuation firm to value an intangible acquired in a business combination. Separately, it licenses an AI tool that builds a discounted cash-flow model from the deal data. The controller treats both the same way in the file: a competence and objectivity assessment for each, terms of engagement for each, and a conclusion that both were suitably qualified for the work.
Is the treatment of the tool right?
The valuation firm sits squarely inside Section 290 and the assessment done for it is the right work. The tool does not, and the paperwork done for it is the wrong work done carefully. Assessing a model’s objectivity is a category error: objectivity in the Code is a property of a person exercising judgement, and a licence agreement will tell you nothing about it. Meanwhile the questions that do apply have gone unasked — whether the tool was tested and evaluated for valuation work of this kind, whether anyone in the function can explain how it derives a discount rate, whether the inputs it was given were appropriate, and what oversight the organisation has over it. The file therefore looks thorough and would not survive the first question. There is a cost on the other side too: engaging the valuation firm generates real obligations under Section 290, and effort spent evaluating software is effort not spent on them.
§ 6 — Elsewhere
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
Finance and accounting standards
Section 290 excludes technology output from the external-expert regime. R220.8 governs it instead, and the judgement it requires is the work the exclusion leaves behind.
A supplier register asks what a third party does for an institution and on what terms. The Code asks a prior question about the same relationship: whether what is relied on is a person’s expertise or a system’s output.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 7 — When it applies
17 January 2025
The date IESBA issued the final pronouncement Using the Work of an External Expert. An issue date, not an effective date.
15 December 2026
IESBA’s own effective date for new Section 290, stated in the 2025 Handbook under Approved Changes that Are Not Yet Effective. Early adoption is permitted and encouraged. The section reaches an accountant through adoption by an IFAC member body, and adoption timing differs between jurisdictions.
1 January 2026
The operative date of one adopting body’s amending standard bringing Section 290 into its national code. An adoption date in a single jurisdiction, not a global commencement and not a compliance deadline.
§ 8 — Exposure
No Code fine; consequences run through the body that adopted the relevant Code edition
Where a member body has adopted the edition containing Section 290, applying the wrong provision is a disciplinary matter for that body: reprimand, fine, conditions on practice, or withdrawal of membership and the practising certificate. Adoption is uneven in timing, so whether Section 290 binds a particular accountant is a question about their own body’s adopted text rather than about the pronouncement’s issue date.
§ 9 — Where this is assessed
Examined in one credential, in the domains named on each card.
Verifying AI output before reliance · 20% of the paper
For finance and accounting professionals who use AI in analysis, close and reporting work — and verify the output before the numbers are relied on.
§ 10 — provenance
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
§ 11 — Also read
Certification
What this page sets out is examined, on work the candidate has not seen, in the credential beside it. Every paper is machine marked against its key and every result is reviewed and released by a named person, and every credential is on the public register.
AIAC-FNAF
Certified AI in Finance & Accounting, Fundamentals2 hours · remote, proctored · valid 2 years
Ten questions on using AI at work. About two minutes, free. You finish as one of six types, with a card to share.
SHARE BY 31 OCTOBER, US$199 FEE WAIVED
A free quiz from the AI Assurance Council. Not a certification.