Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesAccounting firms should treat prompts that influence client work as controlled firm work product: approve who may create and change them, specify which tools and data they may use, and require qualified review of the results. A shared prompt library can make workflows more consistent, but owning a prompt does not make an AI answer accurate, confidential, or compliant.
What it means for a firm to own its prompts
Here, “own” means operational control—not a claim about legal intellectual-property rights. The firm, rather than an individual employee’s personal account or an informal team chat, should decide which prompts become approved reusable workflows, what tasks they support, and how their outputs are checked.
As an Amazon Associate I earn from qualifying purchases.
A prompt is not merely a clever instruction. It can encode assumptions about a tax question, accounting treatment, research process, or client communication. If staff reuse it without knowing its limits, the same mistake can travel across engagements. Firm control makes the workflow visible and reviewable; it does not transfer professional judgment to the model.
ICAEW guidance on using generative AI recommends establishing a governance policy with guardrails or restrictions. The AICPA discussion of risks to CPA firms likewise highlights permitted use, confidentiality, reliability, and review. These are professional perspectives, not a single rule that applies identically in every jurisdiction.
Start with a policy, not a prompt collection
Before staff build a library, the firm should set a policy that makes responsibility clear. It should identify permitted and prohibited uses, approved tools, data-handling expectations, and who is accountable for reviewing work. This is especially important where a task produces or informs a client deliverable.
Define allowed work and escalation points
State which tasks staff may use AI for, such as administrative assistance or an approved research workflow, and which require prior approval or are prohibited. Give staff a clear way to stop and ask a supervisor when a task calls for confidential client facts, a jurisdiction-specific conclusion, or professional judgment the approved workflow cannot support.
Assign roles
- Prompt author: drafts or proposes a workflow and documents its intended use.
- Practice lead or designated reviewer: evaluates and approves prompts used in client work, including material changes.
- Engagement professional: checks the output in context and remains responsible for the professional work.
- Firm leadership or governance owner: sets policy, selects approved tools, and ensures the library is maintained.
Staff can suggest improvements, but a successful one-off prompt should not become a firmwide standard until it has been reviewed for its task, data needs, and failure modes.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Protect client and firm information before entering a prompt
A prompt may contain client information or proprietary firm material, even when it looks like an ordinary question. AICPA guidance advises firms to understand the tool’s terms and privacy practices and to handle information shared with AI with care comparable to a public posting. Do not assume that an account is private, that prompts are not retained, or that submitted data is excluded from model training without checking the applicable terms.
For each approved tool, the firm should review how data is stored, used for training, accessed, shared, retained, and de-identified; who is responsible if an incident occurs; and whether the controls fit the intended work. AICPA’s client-disclosure guidance identifies these as issues clients may ask about and recommends considering provider terms and responsibilities.
- Do not include client identifiers or confidential facts unless the firm has approved the tool, the handling, and the contractual basis for that use.
- Use only the data classification and tool combination permitted by firm policy.
- Keep real client data out of prompt examples unless that use has itself been approved.
- Escalate uncertainty rather than trying a sensitive prompt in a public-facing tool.
Build a prompt library that can be supervised
A useful library is a control system, not a folder of “best prompts.” Each entry should give staff enough context to decide whether it applies and enough instructions to verify what the model returns.
Rank #3
| Library field | What to record |
|---|---|
| Owner and approver | The person or practice responsible for maintenance, and the reviewer who approved client-work use. |
| Intended task | The defined workflow, its scope, and when staff should not use it. |
| Approved tool | The permitted provider or product and, where relevant, the model or configuration. |
| Permitted data | The data classification that may be entered, including any required de-identification. |
| Version and date | When it was approved or changed, so staff can identify the current workflow. |
| Test examples and limitations | Examples used to check behavior and known cases where the prompt may fail or mislead. |
| Review instructions | What sources, calculations, facts, and professional judgments a qualified person must verify. |
| Escalation rules | When to stop, ask a supervisor, or use another approved process. |
Keep the entry concise enough to use during actual work. A prompt whose limitations or review steps are buried in separate documentation is less likely to be followed.
Require professional verification of accounting and tax outputs
Generative AI can produce a plausible answer that is incomplete, outdated, or wrong. The AICPA notes that a model may respond more reliably to a straightforward general question than to an attempt to apply the same standard to a particular transaction. Uncritical reliance can create errors and liability exposure.
For accounting, audit, tax, standards, law, and regulatory work, the approved workflow should require a qualified professional to check the underlying authority and the facts of the engagement. That means verifying cited sources rather than accepting a generated citation at face value, confirming that the authority is current and relevant to the jurisdiction, and checking calculations or conclusions independently where the work requires it. Record material AI assistance when engagement documentation or firm policy calls for it.
Rank #4
AI can assist with research or drafting; it does not determine whether a rule applies to a client’s circumstances. The professional reviewing the work must be able to explain and support the final conclusion without treating the model’s confidence or fluent wording as evidence.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Decide when clients should be told
There is no universal disclosure answer established by the cited guidance for every use case. Whether to tell a client or obtain consent depends on the work, the information involved, the provider’s terms, applicable professional obligations, and the engagement context. Firms should set a policy for those decisions and consult counsel when contractual, privacy, or regulatory questions arise.
Staff should be prepared to answer practical client questions about where data goes, whether it is retained or used for training, who can access it, how it is protected, and what human review occurs. A firm should not promise a safeguard unless it has verified that safeguard in the relevant provider terms and configuration.
Best Value
Maintain the library as tools and rules change
An approved prompt can become unsuitable when the provider changes its terms, the model or configuration changes, or professional requirements evolve. Assign an owner to review the library after material changes and to retire or revise workflows that no longer meet firm policy. Keep the approval date and version visible so staff do not mistake an old prompt for a current one.
Professional observations also need to be read within their scope. In a July 22, 2024 release, PCAOB staff described outreach in which contacted audit firms’ generative-AI use was primarily administrative and research oriented; the firms also recognized limitations and the need for strong supervision, privacy, and security. That is a dated observation about the firms contacted, not a census or a current adoption rate. Read the PCAOB release.
Professional guidance and legal obligations differ by location, and provider features and contracts can change. U.S.-oriented AICPA and PCAOB material should not be treated as a substitute for requirements applicable to firms elsewhere. Other professional perspectives include CPA Ontario’s discussion of CPA accountability and AI and the CCAB AI Hub.
A practical approval path for a reusable prompt
- Define the task. State the intended output and the boundary of the workflow; do not frame a prompt as a substitute for a professional conclusion.
- Check the data and tool. Confirm that the selected tool and data classification are permitted under firm policy and provider terms.
- Test representative cases. Have a knowledgeable reviewer examine useful examples, including cases likely to expose ambiguity or unsupported assumptions. Record limitations and required source checks.
- Approve and publish. Assign an owner, approver, version, date, and review instructions in the firm-controlled library.
- Monitor and revise. Reassess after material provider, model, contract, or professional-rule changes; withdraw the workflow if it cannot be supervised safely.
Firms looking for broader accounting and finance AI resources can consult the AICPA & CIMA AI resources page; its materials and offerings may change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
