Assurance Over a Client's AI Credit Model While Selling Advisory Services
Harper & Vale, a mid-tier CA firm, has been asked by Kestrel Bank to provide independent assurance over Kestrel's new AI-driven small-business credit-scoring model. The engagement would involve testing model inputs, governance and outcomes, and issuing a public assurance report. Separately, Harper & Vale's advisory division earns $480,000 a year implementing a data-visualisation tool that Kestrel's risk team uses to monitor the model. The assurance engagement fee would be $150,000. The advisory contract is due for renewal in three months. The engagement partner's performance bonus is partly based on advisory revenue. Kestrel's regulator has signalled that it expects third-party assurance over material AI models within 12 months.
1. Identify the threats to independence and evaluate whether safeguards can reduce them to an acceptable level.
Read the worked answer
Threats
- Self-interest. The advisory fee ($480,000) is more than three times the assurance fee ($150,000). Losing the advisory renewal is a significant financial threat. The partner's bonus linked to advisory revenue intensifies it.
- Self-review. The firm implements the data-visualisation tool used to monitor the model. If the assurance team relies on that tool, it would be reviewing its own work.
- Advocacy. A public assurance report may be seen as endorsing the model, and the firm has a commercial interest in the model looking good.
- Intimidation. The client can threaten to move the advisory work if the assurance opinion is unfavourable.
- Familiarity. A long-standing advisory relationship may blunt scepticism.
Evaluation
Safeguards cannot eliminate the self-interest and self-review threats while the firm both advises on the monitoring tool and assures the model. A Chinese wall is weak here because the tool is central to the subject matter. The partner's bonus creates a direct personal interest. The threat is significant because the assurance is public and regulator-expected. Safeguards such as separate engagement teams, independent quality review and removing the partner reduce but do not eliminate the threat. The firm should not accept the assurance engagement while the advisory contract and bonus remain.
Recommendation
Either decline the assurance engagement, or resign from the advisory work and remove the partner's bonus link before accepting. If the firm retains both, the only credible path is a different firm for assurance.
2. Recommend a course of action to the firm's ethics committee, including conditions if the engagement were accepted.
Read the worked answer
Recommendation
Decline the assurance engagement unless three conditions are met: (1) the advisory contract is terminated or transferred, with no continuing fee; (2) the engagement partner's bonus is not linked to advisory revenue and the partner is removed from advisory oversight; (3) the assurance team does not rely on the firm's own visualisation tool and has independent access to model data. If the client will not accept these, decline and document why.
Reasoning
The regulator expects independent assurance. An opinion tainted by a $480,000 advisory relationship and a partner bonus is unlikely to withstand scrutiny. The reputational cost of a failed or challenged assurance report exceeds the $150,000 fee. The ethics committee should also consider whether accepting creates a precedent. If the firm declines, it should offer a non-assurance readiness review with clear limits, or refer the client to another firm.
Conditions if accepting
- Pre-condition: advisory contract ended before fieldwork begins.
- Independent quality control reviewer with no advisory involvement.
- Written confirmation that the assurance team can report adverse findings without commercial consequence.
- Disclosure to those charged with governance of the safeguards and remaining threats.
- Ongoing monitoring: if advisory work resumes, reassess independence.