EY
Company-reportedExceptions onlyAudit risk assessment can begin with population-wide analytics instead of statistical samples alone.
Financial crime · Global
Collections: Regulated autonomy
Executive brief
Population coverage changes the audit queue; it does not transfer the opinion to AI.
AI value · Population coverage
Company-reportedApproximately 480 billion general-ledger lines loaded into the US analyzer in FY2025
Operator-reported coverage, not causal audit-quality evidence.
Before
Defines the risk population and selects transactions for testing under EY's sample-first baseline. → Examines selected transactions and follows anomalies through client evidence.
After
Loads general-ledger and subledger data and runs full-population analyses across ERP systems. → Uses patterns and outliers to target follow-up questions and additional audit procedures.
Human boundary
Audit partner and auditors retain all assurance conclusions; AI prioritizes evidence.
Why it matters
Audit risk assessment can begin with population-wide analytics instead of statistical samples alone.
This case is company-reported. Use it for the operating-model shift; do not treat the numbers as independently measured.
Before
How the work ran before the change.
Engagement audit team
Defines the risk population and selects transactions for testing under EY's sample-first baseline.
ControlAuditing standards and engagement methodology; EY does not publish a baseline cycle time.
Auditor
Examines selected transactions and follows anomalies through client evidence.
ControlProfessional skepticism and partner review; the source does not quantify sample size.
What changed
Audit risk assessment can begin with population-wide analytics instead of statistical samples alone.
Decision rightAI handles the default; humans own exceptions
After
How the same work runs now.
Client data and EY Helix
Loads general-ledger and subledger data and runs full-population analyses across ERP systems.
ControlData provenance, quality, lineage, and analyzer configuration are explicit controls.
Engagement auditor
Uses patterns and outliers to target follow-up questions and additional audit procedures.
ControlAuditors retain evidence evaluation and the audit opinion; no anomaly is an autonomous finding.
Exception path
Unreliable provenance or data quality requires conventional or expanded testing.
Work removed
Decision authority
Audit partner and auditors retain all assurance conclusions; AI prioritizes evidence.
Before
Engagement audit team
Defines the risk population and selects transactions for testing under EY's sample-first baseline.
Control: Auditing standards and engagement methodology; EY does not publish a baseline cycle time.
Auditor
Examines selected transactions and follows anomalies through client evidence.
Control: Professional skepticism and partner review; the source does not quantify sample size.
After
Client data and EY Helix
Loads general-ledger and subledger data and runs full-population analyses across ERP systems.
Control: Data provenance, quality, lineage, and analyzer configuration are explicit controls.
Engagement auditor
Uses patterns and outliers to target follow-up questions and additional audit procedures.
Control: Auditors retain evidence evaluation and the audit opinion; no anomaly is an autonomous finding.
Work that left the path
Human role before
Engagement auditors selected transaction samples, examined supporting evidence, and escalated anomalies through audit review to the partner under the engagement methodology.
Human role after
Auditors validate data, investigate exceptions and retain the audit opinion.
AI roleScreens complete ERP populations and surfaces patterns and outliers.
Statistical samples→Approximately 480 billion general-ledger lines loaded into the US analyzer in FY2025
Fiscal 2025 · US audit clients; global platform
Operator-reported coverage, not causal audit-quality evidence.
Anti-pattern
Do not equate population screening with substantive audit of every transaction.
Questions
Portability conditions
Reputation risk
low
Evidence and authority
Current · updated
2 primary; publication outcomes are reported.
Bundle 1.0.0 · reviewed 2026-08-23 · stable ID 60af9a4866ff31fc
Netherlands Tax and Customs Administration / Benefits · Exceptions only
Fraud-risk triage can cause institutional harm without fair features, recovery rules, or challenge rights.
HSBC · Exceptions only
Transaction-monitoring teams do not need a large rules-generated queue to preserve risk coverage; machine-learning risk detection can narrow the queue while investigators retain consequential review.
Waymo · Exceptions only
Within a defined domain, automated driving can control the vehicle while remote assistance handles exceptions.
Ocado Group / Ocado Retail · Exceptions only
Robotic arms can pick more grocery items on-grid while people handle exceptions and fulfillment operations.