Where this goes wrong

A weak answer is rarely a wrong one. It is usually a true statement doing less work than it appears to — a policy that exists but binds nobody, an artefact produced once and never since, a judgement recorded without the person who made it or the basis they made it on. Each entry below names the specific failure for its provision; the obligation page it links to sets out what discharges the duty instead.

The answer that does not hold

• IESBA Code 110.1 A1(b)(iii)Objectivity

  Objectivity treated as a conflicts question. The function’s answer is that nobody holds a financial interest in the tool, the supplier was selected competitively, and no one’s bonus turns on the output — all of which addresses limb (ii) and none of which addresses limb (iii). Conflict of interest and undue reliance sit as separate limbs of one definition precisely because they fail differently: one is about what the accountant wants the answer to be, the other about whether they arrived at it themselves.

• IESBA Code 120.12 A2Bias

  Scepticism asserted as a control. The function’s answer is that its accountants are experienced professionals who take nothing on trust, and the reviewer is offered a run of review sign-offs as proof. A sign-off records that output was accepted, which is precisely the behaviour the named tendency predicts, so the file is consistent with the threat rather than evidence against it. What would be evidence is the opposite record: the occasions on which the output was contradicted, and what happened next.

• IESBA Code R113.1, 113.1 A3, R113.2 and R113.3Professional Competence and Due Care

  The supplier’s training certificate offered as competence. Everyone who touches the tool has completed the onboarding, the completion rate is reported upward, and the function considers Section 113 addressed. Supplier training teaches the interface and is built to make a product easy to adopt; it is not designed to say where the method fails, and it addresses neither supervision nor what users have been told. Three provisions are in play, and the certificate reaches part of one.

• IESBA Code R114.1, R114.2, 114.3 A3 and R114.4Confidentiality

  The tenancy boundary offered as the answer. The tool runs on the organisation’s enterprise licence, prompts are excluded from supplier training, and the review closes there. Section 114 asks four further questions that review never reached: on what terms was the material acquired, what use is now being made of it, how long does the platform keep it, and could anyone be identified from what comes out. A duty owed to the person whose information it is does not stop at the edge of a tenancy.

• IESBA Code R220.4, R220.5 and R220.6Preparation and Presentation of Information

  The tool named instead of the assumptions. A board pack marks the figure as AI-assisted, sometimes with a sentence about the model’s accuracy on historical data, and the finance team treats that as the disclosure. It discloses provenance, which nobody was going to dispute, and withholds the four or five assumptions on which the number entirely depends. What R220.6 asks for is the material that lets a reader form their own judgement about the information. A provenance label lets them form a view about the software.

• IESBA Code R220.8Using the Output of Technology

  The AI use policy produced as the judgement. One page circulated to the finance function — check outputs before use, keep sensitive data out, remember the tool is not a substitute for professional scepticism — with a completion log showing everyone read it. It is a perfectly sound policy and it discharges nothing, because the provision attaches to a person using an output on an occasion. The policy reads identically for a summarised board paper and a fair-value estimate, and the paragraph exists precisely because those two uses need different steps.

• IESBA Code R220.9 and R220.10Addressing Information that Is or Might be Misleading

  The escalation treated as an email. A controller raises a doubt with a manager, gets a reassuring reply, and files the exchange. Two things the provision requires are missing from it. Nothing states what specifically was believed misleading and why, so the reply is answering an impression rather than a case. And nothing records what was asked for — correction, or telling the users — so there is no way to say whether the response met the request or changed the subject. The duty is to seek to resolve. A thread ending in reassurance has resolved nothing; it has only stopped.

• IESBA Code R230.3 and R230.4Acting with Sufficient Expertise

  The refusal that never happened, expressed as a caveat. The accountant does the work and protects themselves with a sentence in an email noting that the tool’s method could not be verified. It reads as a sensible professional precaution and it engages neither provision: no determination has been made about whether to decline, and no reasons have been communicated in a form anybody must act on. The employing organisation has a caveat, the deadline is met, and the named threat is still sitting under the signature.