.png)
PCAOB technology-assisted analysis amendments to AS 1105 and AS 2301 apply to audits of fiscal years beginning on or after December 15, 2025, so a calendar-year SaaS issuer's FY2026 audit is the first one covered. They set out what auditors must do with items that data analysis flags, how to judge the reliability of electronic data a company passes to the auditor from third parties, and what happens when one procedure serves more than one purpose.
For SaaS companies, this matters because most revenue evidence is electronic: billing platform exports, usage logs, payment processor files and CRM contract data. This guide explains what the PCAOB technology-assisted analysis rules require, how AI and analytics fit into sampling and ASC 606 testing, what the PCAOB staff observed about generative AI, and how finance teams can prepare data that holds up. It is written for auditors at US CPA firms and for controllers at SaaS companies preparing for an audit.
The PCAOB adopted the amendments on June 12, 2024, in Release No. 2024-007, and the SEC approved them in August 2024. According to the SEC approval order, they "will be effective for audits of financial statements for fiscal years beginning on or after December 15, 2025." The SEC also approved applying them to audits of emerging growth companies, which covers many recently listed SaaS issuers.
The order lists what the amendments do. They clarify what a test of details is and "specify auditor responsibilities when identifying items that require further investigation when performing tests of details." They also require the auditor to achieve each objective when a procedure is used for more than one purpose, address external information provided by the company, emphasize controls over information technology, and stress the importance of disaggregation or detail in the information used.
The main paragraph changes, taken from the text of the amendments in the PCAOB adopting release, are summarized below.
| Paragraph | What it now says | What it means in a SaaS audit |
|---|---|---|
| AS 1105.07 | Relevance depends partly on "the level of disaggregation or detail of information necessary to achieve the objective of the audit procedure" | Revenue analytics run on summarized monthly totals may not give relevant evidence for contract-level assertions |
| AS 1105.10 | Test accuracy and completeness of company information, or test controls over it, including ITGCs and automated application controls where applicable | A billing system export used in an AI tool needs completeness and accuracy work or tested controls |
| AS 1105.10A (new) | Evaluate reliability of information the company received from external sources and gives the auditor in electronic form | Payment processor settlement files and bank feeds supplied by the company fall here |
| AS 1105.14 | "If the auditor uses an audit procedure for more than one purpose, the auditor should achieve each objective of the procedure." | An anomaly model used for risk assessment and as a substantive test must meet both bars |
| AS 2301.48 to .50 (new) | Defines tests of details, sets duties for items that need further investigation and for items not selected | Every flagged invoice needs a documented outcome, and untested remainders need a risk assessment |
New AS 1105.10A matters a lot for SaaS. The standard gives "cash receipts, shipping documents, and purchase orders" as examples of external information. The auditor must understand the source and "the company's process by which such information was received, maintained, and, where applicable, processed," then either test whether the company modified the information or test controls over it. A Stripe or bank settlement file that finance downloads, filters in a spreadsheet and then hands to the auditor is exactly this kind of evidence. In July 2025 the Center for Audit Quality asked the PCAOB to defer the effective date of paragraph .10A, saying the requirement lacked clarity, so engagement teams should check the PCAOB's current implementation resources on .10A when planning FY2026 work.
New AS 2301.49 says the investigation of flagged items "should include determining whether these items individually or in the aggregate indicate (i) misstatements that should be evaluated in accordance with AS 2810, Evaluating Audit Results, or (ii) deficiencies in the company's internal control over financial reporting." The footnote gives the example of balances or transactions "that contain a certain characteristic or that are valued outside of a range." In practice, when an AI model flags 300 unusual credit memos, the workpapers need to show how each of the 300 was resolved and whether any pattern points to a control gap, rather than a single blanket conclusion.
SaaS revenue sits across several systems, which makes full-population analysis practical when the data is clean. Common uses that remain sound under the amended standards:
Each of these becomes audit evidence only when the inputs are reliable under AS 1105.10 or .10A and each flagged item is resolved under AS 2301.49. For a wider view beyond SaaS, see our practical guide to AI in audit and assurance and our guide to technology in auditing, analytics and automation.
AS 2301.48 footnote 21 points back to the three ways AS 1105 allows auditors to choose items: "selecting all items, selecting specific items, and audit sampling." AI changes how auditors combine them. A model can score every transaction, the auditor selects all high-scoring items as specific items, and statistical sampling covers the rest.
New AS 2301.50 adds a duty that is easy to miss. When the auditor selects specific items, "the auditor should determine whether there is a reasonable possibility that remaining items within the account or disclosure include a misstatement that, individually or when aggregated with others, would have a material effect on the financial statements." If that possibility exists, the auditor performs substantive procedures on the remainder, so a model's flagged list on its own rarely completes a test of details.
The figures below are illustrative. A SaaS company reports $48,000,000 of FY2026 subscription and usage revenue across 12,000 invoices. The audit team runs a technology-assisted analysis over the full invoice population after testing the completeness and accuracy of the billing export.
| Group | Selection basis | Invoices | Amount | Share of revenue |
|---|---|---|---|---|
| Mid-term contract modifications | All items (specific) | 85 | $6,200,000 | 12.92% |
| Discounts above 40% of list price | All items (specific) | 140 | $2,100,000 | 4.38% |
| Usage true-ups invoiced after year end | All items (specific, cutoff) | 60 | $900,000 | 1.88% |
| Remaining invoices | Audit sampling under AS 2315, or AS 2301.50 assessment | 11,715 | $38,800,000 | 80.83% |
| Total | 12,000 | $48,000,000 | 100.00% |
The three targeted groups cover 285 invoices and $9,200,000, or 19.17% of revenue, while being only 2.38% of the invoice count. The remaining $38,800,000 is too large to ignore under AS 2301.50, so the team still samples it using the firm's sampling methodology. If the model's thresholds change during the audit, the team keeps both versions and records why.
For first-time issuers or companies preparing for a private company audit, a PBC request list that asks for raw exports, not summaries, saves a round of follow-up requests. Auditors set the threshold for "material" in each group using planning materiality, which our article on materiality and risk in audits explains for business owners.
ASC 606's core principle is that "an entity recognizes revenue to depict the transfer of promised goods or services to customers in an amount that reflects the consideration to which the entity expects to be entitled in exchange for those goods or services" (606-10-05-3). The five steps run from identifying the contract to recognizing revenue when each performance obligation is satisfied. In SaaS audits, analytics are most useful in these areas:
For the accounting itself, see our SaaS revenue recognition under ASC 606 implementation guide.
In July 2024, PCAOB staff published a Spotlight on generative AI in audits and financial reporting, based on outreach "mainly at larger firms" and several companies. It states that it represents "the views of PCAOB staff and not necessarily those of the Board" and is "not a rule, policy, or statement of the Board." Its main observations, from the PCAOB staff Spotlight:
The AICPA added its own guidance on 13 October 2026 with a practice aid, Artificial Intelligence (AI) Considerations for Financial Statement Auditors. The AICPA announcement says it "provides a framework for understanding how artificial intelligence affects the financial statement audit" and quotes AICPA chief auditor Jennifer Burns: "Ultimately, the auditor remains responsible for the audit and the audit opinion." The announcement says the AICPA plans to add a deeper look at assessing the risk of material misstatement and evaluating audit evidence when a company uses AI.
If your finance team is introducing AI tools of its own, see our practical guide to implementing AI in your accounting department.
Inspectors and engagement quality reviewers want to reperform or follow the work. These practices tie directly to the amended paragraphs:
Pre-IPO and newly public SaaS companies can build many of these controls before the first audit. Our guide to SOX-lite internal controls for scale-ups covers practical controls to put in place before a first audit.
Many CPA firms use offshore teams to prepare data, run tie-outs and maintain exception logs, with US engagement staff keeping review and sign-off. That model fits the Spotlight's point that the engagement team member stays responsible for the work. Use role-based access, keep client data inside approved environments, and share data dictionaries for every table used in an analytic. For more detail, see our guide to offshore audit support for PCAOB and US GAAP workpapers.
When do the PCAOB technology-assisted analysis amendments take effect? They apply to audits of financial statements for fiscal years beginning on or after December 15, 2025. For a calendar-year company, the FY2026 audit is the first one covered, and the SEC approved applying them to emerging growth companies too.
Does AS 1105.10A apply to a SaaS company's payment processor data? It applies when the company receives information in electronic form from an external source and provides it to the auditor as audit evidence. Settlement reports and bank files that the company downloads and passes on are typical examples, so the auditor evaluates the source, the company's handling and any modifications, or tests controls over them.
Can auditors test only the transactions an AI model flags? No. Under AS 2301.50, when the auditor selects specific items, the auditor must decide whether the untested remainder could contain a material misstatement and, if so, perform substantive procedures on it. Flagged items also need individual investigation under AS 2301.49.
Is the PCAOB GenAI Spotlight a rule? No. It states that it reflects the views of PCAOB staff and is not a rule, policy or statement of the Board. It summarizes staff outreach observations from 2024.
What should a SaaS finance team give auditors for analytics-based testing? Raw, unfiltered exports from billing, CRM, usage and payment systems, with extraction dates, record counts and control totals, plus the original external files. Summaries and edited spreadsheets slow the work because the auditor has to establish reliability first.
Madras Accountancy supports US CPA firms and their clients with audit preparation, workpaper support, data tie-outs and SaaS revenue accounting, with review and sign-off staying with your engagement team. To discuss support for an upcoming audit, contact our team.
The section 4960 excise tax is 21% of nonprofit pay over $1M. From 2026 it covers all employees. See the medical carve-outs, Form 4720 and a worked example.
The paid family and medical leave tax credit is permanent from 2026. See the 12.5% to 25% rates, the premium option, the 6-month rule and how Form 8994 works.
Opportunity zones become permanent in 2027 under the One Big Beautiful Bill. See the new deferral, rural bonus, and the 2026 handoff.
