Continuous Assurance Replaces the Annual Audit by 2029

The AICPA published a practice aid on October 13, 2026, titled Artificial Intelligence Considerations for Financial Statement Auditors, covering both how a company's use of AI affects its audit and how firms use AI inside engagements. Its chief auditor summarized the position in one sentence: the auditor remains responsible for the audit and the audit opinion. That sentence is the whole thesis in miniature, because it draws a line this thesis routinely erases.

The Thesis Conflates Evidence With an Opinion

Almost every version of continuous assurance describes continuous monitoring: automated control checks, exception detection in near real time, and testing that covers an entire population rather than a sample. That is an evidence-production technology, and it scales well.

An audit is a different object. It is a dated opinion on a complete set of financial statements prepared by management, issued once, by a named accountable party carrying liability and subject to inspection. The evidence is an input. The opinion is the product, and the opinion is what everyone relying on the word audit is actually relying on.

So for the thesis to hold by 2029, three things have to be true, and only the first is close. Continuous evidence has to be permitted and reliable. A standard has to exist for issuing a rolling or continuous opinion rather than a periodic one. And somebody has to accept liability for that output at every moment it is live, rather than at one moment a year.

The Standards Already Allow the Testing

The permission question is largely settled, which is why it is the wrong place to look for the constraint.

The PCAOB amended AS 1105 on audit evidence and AS 2301 on responses to risks of material misstatement to clarify responsibilities when using technology-assisted analysis, effective for audits of financial statements for fiscal years beginning on or after December 15, 2025, subject to SEC approval. Under the amendments an auditor may analyze a full population to help identify risks of material misstatement, and may perform substantive procedures on every item in a population. Where one procedure serves more than one purpose, each objective has to be achieved.

That is the testing half of continuous assurance, authorized in current standards. Nobody needs a new thesis to do it. What the amendments do not provide is a different kind of report.

Where the Burden Moves

Here is the part that makes this interesting rather than inevitable.

The same amendments say that when an auditor relies on electronic information, reliability has to be established either by testing whether the information was modified, or by testing controls over its receipt, maintenance and processing, including information technology general controls and automated application controls.

Read that against full-population testing and the consequence is structural. Sampling put the auditor's risk in selection: did the twenty-five items chosen represent the five hundred. Full-population testing removes that risk and replaces it with a harder one: is the system that produced all five hundred thousand records trustworthy. The burden does not disappear. It moves up a layer, from the transactions to the machine.

For a digital asset operation that relocation lands badly. The controls that make a system of record reliable include privileged access, key management, upgrade authority and change management. Those controls are rare by design, because rarity is itself a control, and a full population of two signing-quorum changes is still two. Testing everything does not create occurrences.

The net effect is that continuous assurance sharply improves coverage of high-frequency, low-consequence activity, which was already the well-covered half, and leaves the consequential half where it was. Measured assurance rises. Risk-weighted assurance moves very little.

What the Ledger Actually Contributes

The on-chain primitive here is narrow and real: deterministic replay of state at a stated block height, and existence of an asset verifiable by a third party without the operator's cooperation. For the subset of assertions that reduce to does this balance exist at this moment, continuous verification is genuinely available, and no conventional asset class offers that.

The asymmetry is that existence is continuously verifiable while entitlement and completeness are not, which is a separate problem and not one cryptography solves.

This is also where the agent case gets misread. If software agents transact autonomously, volume and velocity defeat sampling outright, so continuous transaction evidence stops being a luxury. But the controls that decide whether an agent's activity was authorized are the rare ones: granting the agent authority, raising a spend limit, adding a destination, rotating the key it signs with. Agents therefore need authorization assurance, and continuous monitoring supplies transaction assurance. Those are not the same product, and the second is the one being built.

Invalidation, and What to Watch

The thesis fails outright on any of three findings. If no standard-setter opens a project on a continuous or rolling opinion, as opposed to continuous procedures, then the annual report form survives by default. If liability allocation stays as it is, no firm will issue an opinion that is live continuously, because that multiplies the moments at which it is wrong without multiplying the fee. And if debt covenants, regulators and fund agreements keep referencing audited annual financial statements, the demand side never arrives regardless of capability.

Four things are trackable monthly, all public. SEC approval status and adoption of the technology-assisted analysis amendments. Any standard-setting project on the form of the report rather than the conduct of the work. Whether findings in general technology controls and automated application controls rise as firms lean harder on full-population testing, which is the observable signal that the burden has in fact moved. And whether any covenant or rule begins accepting something other than an annual audited statement.

The constructive reading is that the evidence side is being modernized carefully, with the responsibility anchor restated rather than relaxed, which is what makes the testing improvements safe to adopt at all. The honest version of the claim is narrower than its title. By 2029 continuous assurance very likely replaces most sampling and most interim testing inside the audit, and sits alongside the annual opinion rather than in place of it. For anyone building toward it, the target is reliability evidence for the system of record, not more transaction monitoring.

For informational purposes only. Not an offer to buy or sell any security. Available only to accredited investors who meet regulatory requirements.

‍