AI assurance and tax-file readiness: three separate checks

A practice leader approves an AI tool after reviewing its assurance evidence. Weeks later, a preparer receives a clear summary of a client's account history. The summary cites a real document. The document belongs to the prior year, while the current organizer leaves the account question unanswered.

The vendor review and the file review have each reached a different question. A useful handoff must preserve that distinction.

On October 19, the AICPA and AIUC announced an offering combining a SOC 2 report and AIUC-1 certification through a CPA-led engagement. Initial engagements were underway, with a full launch expected in early 2027. The announcement is relevant to firms evaluating AI systems; it does not report an assurance engagement for AmitaSoft. AICPA announcement

Our practical inference is to keep three reviews explicit: the supplier and system, the authorized engagement workflow, and the evidence supporting this file's next handoff. The following framework is our proposal, not an AICPA assurance standard or a prescribed tax procedure.

1. Establish what the vendor evidence covers

Ask for the actual report or other evidence through an approved review process. Identify the entity, system, covered period, relevant exceptions and applicable customer responsibilities. Ask whether the feature your team intends to use falls within that scope. A marketing reference to assurance is a starting point for questions, not a substitute for reading the applicable evidence.

Record one plain-language conclusion: which deployment decision does this evidence support, and what remains unresolved? Keep any report distribution restrictions intact. This article neither assesses a particular vendor's report nor claims that every type of assurance has identical scope.

2. Confirm the authorized workflow

Before a demonstration, name the engagement, permitted purpose, source set and intended reviewer. Can that reviewer inspect the relevant original? If the assignment changes, how will the firm establish the replacement reviewer's authorization? Who owns a question that the assistant cannot resolve?

These are operational questions to test in the firm's approved environment. Do not turn a helpful vendor conversation into permission to upload taxpayer records. A synthetic exercise can expose an unclear handoff without sharing a real client's information.

NIST describes its AI Risk Management Framework as voluntary support for incorporating trustworthiness into AI design, development, use and evaluation. That wider lifecycle perspective is useful here; it is not a certification or evidence that our proposed exercise satisfies the framework. NIST AI RMF overview

3. Inspect the particular evidence decision

For each material question, identify the source, period, version and remaining uncertainty. Distinguish a client answer from a supporting document and an extracted value from a practitioner conclusion. Name the reviewer who may accept the next stage.

In the fictional account example, the prior-year statement establishes historical context. It does not resolve the blank current-year answer. A useful result keeps that current question visible with an owner and a concrete next action. A polished summary that silently closes it is an observation to investigate, even if the supplier review was satisfactory.

Start with the capabilities your current tools already provide. Drake's Guided Organizer, for example, documents prior-return-based document checklists and prefilled questionnaire answers. Those features can make intake more useful. Our proposed test asks a separate question: does the reviewer know which answer was carried forward, which current source supports it, and what remains unresolved? This is an evaluation question for the firm's actual workflow, not a claim that Drake fails it or that TaxFlo integrates with it. Drake Guided Organizer

Configuration can also change which evidence takes precedence. Thomson Reuters' tax-year 2025 1040SCANverify policy explains that organizer-extracted personal details can take precedence over carried-forward values and documents a verification-rule option to prevent that override. For a separate fictional holdout, give the organizer and prior record different contact addresses. Ask which source and configured rule support the selected value, who may accept the change, and what remains unresolved. A difference may be a legitimate update. This proposed exercise has not been run and does not show a product defect, prescribe a configuration change or establish a TaxFlo integration. Thomson Reuters 2025 processing standards

Try a twenty-minute synthetic exercise

Use a fictional prior-year account statement, a current organizer with an unanswered account question, and a current-period statement introduced later. Define the expected observations before running the case.

Spend the first five minutes recording the relevant vendor-review scope separately from the file's facts. Spend five more asking a reviewer to identify what the old statement supports and what it leaves unknown. Introduce the current source and allow five minutes to inspect the change in evidence. Use the final five minutes to hand the case to another authorized reviewer and record the unresolved question, accepted source and next owner.

Compare the same case with your existing workflow. Record minutes needed to locate the supporting source, any unsupported current-year conclusions, and questions that lost their owner during handoff. Count a premature completion as a failure to examine, rather than rewarding a shorter completion time by itself. This exercise has not been run as part of this article; there are no claimed customer results or product pass rates.

Keep the decision record small

One worksheet can hold three separate conclusions:

The goal is an explainable decision. Avoid merging these conclusions into one green indicator that hides which review is still open.

Your existing tools may already handle the action layer. For example, Liscio documents assigned tasks, due dates, reminders and a review handoff after a client completes a task. Start the comparison there. Then ask which source, period or unresolved question supports accepting the next stage. A completed request and an accepted file-level conclusion answer different questions. This is a test proposal, not a claim that a particular platform lacks evidence controls. Liscio Tasks overview

Where TaxFlo and SafeVault fit

I founded AmitaSoft and built TaxFlo on SafeVault's governed document foundation. TaxFlo supports guided intake, classification and extraction, discrepancies, missing-evidence visibility and authorized prior-year context. A workflow review should distinguish demonstrated behavior from requirements still needing implementation or validation. We do not claim SOC 2 or AIUC-1 assurance for these products in this article.

TaxFlo assists evidence readiness. Tax judgment, eligibility, advice, staff supervision and final preparation or approval remain with the practitioner. Vendor assurance review remains a separate professional decision.

Continue the series

The reviewer-handoff test examines authorization when responsibility changes. Reusing prior-year evidence separates retained context from current support. This installment adds the supplier-assurance decision without collapsing those file-level checks.

Review one synthetic workflow

Bring one recurring evidence question to a 20-minute review. We can compare the current handoff, agree on an observable readiness measure and assess whether a controlled 10–25 engagement pilot merits further scoping. No taxpayer documents are needed. Arrange a TaxFlo workflow review.