AI and Machine Learning Risk and Governance for CPAs

Note: The Live Virtual course is presented in collaboration with CPA Western Provinces. The content is applicable to all participants. If you have questions regarding this course, please contact pdregistration@cpaalberta.ca.

Overview:

AI and machine learning models are increasingly embedded in financial reporting, audit processes, and management decision-making, but most organizations have no governance framework for the outputs they produce. This course equips CPAs with a practical framework for evaluating, validating, and governing AI and ML models in financial contexts, with specific reference to OSFI Guideline E-23 (Model Risk Management), Canada's Bill C-27 (Artificial Intelligence and Data Act), and the Air Canada liability precedent. The course addresses both the technical governance questions (how do you validate an AI model's outputs?) and the professional obligation questions (what are you accountable for when you sign off?). Includes  AI bias, and the CPA's obligations under the Code of Professional Conduct.

CPAs who complete this course will be able to assess whether their organization's AI and ML models meet a defensible governance standard, and to build or evaluate an AI governance framework that protects the organization and the professional from liability. You will understand what regulators and courts are looking for — and what questions to ask before putting your name on an AI-assisted output.

Course Content

Module 01 — The Governance Gap 

• Why AI adoption is outpacing governance in most organizations
• What regulators and courts are asking: OSFI E-23, Bill C-27, Air Canada ruling
• The CPA's professional accountability for AI outputs: Code of Professional Conduct obligations
• The four governance obligations: Data, Assumptions, Outputs, Accountability

Module 02 — Model Risk Framework 

• What makes an AI model high-risk in a financial context
• Model validation: what to check and how to document
• The interpretability test: glass box vs. black box, when each is acceptable
• Hallucination, bias, and data quality: the three failure modes that create liability
• The LLM usage framework for CPAs: Green / Yellow / Red

Module 03 — Building the AI Governance Audit Trail 

• Data source documentation and financial classification taxonomy
• Assumption logging: what must be documented and why
• Prompt documentation for LLM-assisted work: the non-negotiable work file entry
• Output review protocol: plausibility testing, outlier checks, source verification
• Sign-off standards: what a defensible sign-off looks like
• Workshop: evaluate a sample AI governance audit trail against the standard

Module 04 — Professional Liability and Ethics 

• Air Canada chatbot ruling (Moffatt v. Air Canada, 2024): full case analysis
• AI bias and fairness: the CPA's obligation to identify and flag discriminatory outputs
• Explainability as a professional standard: if you can't explain it, you can't sign off
• Scenario analysis: three governance failure cases and the professional consequences
• Building a governance culture: how to raise AI governance concerns in your organization

Learning Objectives 
Upon completing this course, you should be able to:

• Apply the CPA Control Framework for AI covering data quality gates, assumption documentation, output validation, and professional accountability to evaluate AI-assisted financial deliverables.
  
• Assess an organization's AI governance posture against the OSFI E-23 Model Risk Management standard and Canada's Bill C-27 obligations, identifying gaps and priority remediation steps.
• Identify and document professional liability exposure arising from AI-assisted outputs, using the Air Canada precedent and the CPA Code of Professional Conduct as the governance standard.
   

Who Will Benefit: 

CPAs in finance, audit, and risk management who are responsible for, or involved in, AI-assisted financial outputs — including those overseeing AI adoption in their organization, reviewing AI-generated reports for external use, or advising clients on AI governance. Particularly relevant for CPAs in regulated industries or public-interest entities.