# License Audit Workpapers for AI: What Firms Can Share

> Can an audit firm license workpapers, sampling and review notes for AI? AICPA rule 1.700, Section 7216, PCAOB rules and what needs no client data.

Canonical: https://origindatapartners.com/guides/license-audit-workpapers-ai
By: Origin Data Partners
Status: Published
Published: 2026-11-12
Updated: 2026-11-14
Sources checked: 2026-11-12

## Quick answer

Mostly not without client consent. The AICPA confidentiality rule bars a firm in public practice from disclosing confidential client information without the client's specific consent, and the AICPA Ethics Division says redaction alone does not change that. Tax return information adds Section 7216. What a firm can usually license is its own material: audit programs, sampling methods, checklists, review-note patterns and expert-built practice cases with no client data.

## Key points

- Client workpapers are confidential client information; specific client consent is the starting point.
- Removing names does not, by itself, make client information nonconfidential.
- Tax return information is a separate, criminal statute: Section 7216.
- A firm's own methods, templates and synthetic practice cases carry the reasoning buyers want without client data.

## Can an accounting firm license audit workpapers for AI?

Demand is real. Business Insider reported that "Fields that AI giants are trying the hardest to automate, like law and accounting, see especially high demand." ([Business Insider](https://www.businessinsider.com/ai-training-employee-data-emails-slack-dms-2026-10)). Workpapers show exactly what AI builders want: a procedure, the evidence, the judgment and the reviewer's sign-off.

The limit is confidentiality. The AICPA rule states: "A member in public practice shall not disclose any confidential client information without the specific consent of the client." ([AICPA ET 1.700.001](https://mn.gov/boa/assets/AICPA%20Code%20of%20Professional%20Conduct_tcm1233-764395.pdf)). Writing for the Journal of Accountancy on November 2, 2026, the AICPA Professional Ethics Division's communications manager put it plainly: "A sale or other transfer intended to train an AI model does not eliminate that specific-consent requirement." ([Journal of Accountancy](https://www.journalofaccountancy.com/news/2026/nov/asked-to-sell-firm-data-for-ai-training-be-very-cautious/)).


## What audit workpapers contain, and whose they are

PCAOB AS 1215 defines the record: "Audit documentation is the written record of the basis for the auditor's conclusions". It must be detailed enough "to enable an experienced auditor, having no previous connection with the engagement" to understand the work ([PCAOB AS 1215](https://pcaobus.org/oversight/standards/auditing-standards/details/AS1215)). That standard of completeness is why buyers want it, and why it is full of client facts.

| Record | What it teaches | Holds client information? |
| --- | --- | --- |
| Tie-outs and reconciliations | Tracing figures from statements to ledgers and source documents | Yes |
| Sampling selections and test results | How samples are drawn and exceptions evaluated | Yes, in the items tested |
| Review notes and their clearance | What a reviewer challenges and how the preparer responds | Usually, in the context |
| Risk assessments and memos | Judgment on where errors are likely | Yes |
| Audit programs and checklists | The firm's method | Usually no, if kept generic |
| Sampling methodology and templates | How the firm sizes and selects samples | No |
| Training cases and quality review findings | Common errors and how they are caught | Depends; often anonymized already |


## AICPA rule 1.700: what the Ethics Division says about AI sales

The November 2026 Journal of Accountancy article sets out the AICPA Ethics Division staff view ([Journal of Accountancy](https://www.journalofaccountancy.com/news/2026/nov/asked-to-sell-firm-data-for-ai-training-be-very-cautious/)). Its main points, quoted:

- "The prudent default response to any request to sell, give, or share confidential client information for AI training is to decline unless you can clearly establish that the transaction is permissible."
- "Redaction does not, by itself, turn confidential client information into nonconfidential information."
- The "Disclosure of Client Information to Third Parties" interpretation (ET 1.700.060) applies "even when client information is disclosed without the client being specifically identified".
- "Do not assume an ordinary engagement letter is sufficient."
- "The recommendation is caution, not a claim that AICPA rules categorically prohibit every data transfer."


## Tax return information: Section 7216

Firms that prepare returns face a criminal statute. Section 7216 reaches a preparer who knowingly or recklessly "discloses any information furnished to him for, or in connection with, the preparation of any such return" ([26 U.S.C. 7216](https://www.law.cornell.edu/uscode/text/26/7216)). Tax workpapers and client organizers fall inside it. Read [Section 7216 and AI data licensing](https://origindatapartners.com/guides/section-7216-ai-data-licensing) before including any tax material.


## PCAOB documentation rules for public-company audits

For audits of public companies, AS 1215 says "The auditor must retain audit documentation for seven years from the date the auditor grants permission to use the auditor's report" ([PCAOB AS 1215](https://pcaobus.org/oversight/standards/auditing-standards/details/AS1215)). Retention is not permission to reuse: those files stay subject to client confidentiality and to any engagement terms. Do not change, extract from or move retained files in a way that could affect the record the standard requires; ask counsel before copying anything out of a retained engagement file.


## What a firm can license without client data

Buyers already work this way. micro1 built audit test cases for DataSnipper, which "is committed to not training on client data, so testing its agents on client files was never an option". The result: "an expert-validated, reusable evaluation dataset of ~100 tasks across audit and finance use cases" built from synthetic documents ([micro1](https://www.micro1.ai/blog/micro1-x-datasnipper-testing-ai-agents-without-client-data)). A firm's own expertise can feed the same kind of work.

| Licensable without client data | Why buyers value it |
| --- | --- |
| Audit programs, procedures and checklists your firm wrote | Shows how procedures are chosen and sequenced |
| Sampling methodology and tools | Teaches sizing, selection and exception evaluation |
| Review-note libraries rewritten without client facts | Shows what a reviewer challenges and why |
| Synthetic practice cases built by your staff, with answer keys | A ready-made evaluation set with a known right answer |
| Internal training material and quality-review lessons | Common errors and how they are caught |
| Staff time as subject-matter experts | Paid expert work grading and writing tasks |

A firm's own materials can still contain client facts in examples. Search them before anything leaves.


## What audit material is worth

No buyer publishes a price for audit workpapers. General company data ranges are $100K to over $3M from [micro1](https://company.micro1.ai/register/?referralCode=24823479-4339-4311-a157-2600b8cf72cf&utm_source=referral&utm_medium=share&utm_campaign=job_referral) and $100K to $4M+ from [Handshake AI](https://joinhandshake.com/ai/data-partnerships/license/); these are published ranges, not offers. Firm-authored methods and evaluation cases are usually a smaller asset than a full client archive, but they are one a firm can actually license.


## How to prepare

Related: [data licensing for accounting firms](https://origindatapartners.com/who-we-help/accounting-firms), [ERP and accounting records](https://origindatapartners.com/guides/license-erp-accounting-records-ai), [data for AI evaluation](https://origindatapartners.com/guides/license-data-for-ai-evaluation) and [which training data holds its value](https://origindatapartners.com/guides/ai-training-data-that-holds-value).

- Separate firm-owned material (methods, templates, training) from client files.
- Run any proposal through legal, ethics and information-security review, as the AICPA article recommends.
- If you want to include client material, draft a specific, written client consent that names the recipient and the training purpose.
- Keep tax material out unless counsel confirms a Section 7216 path.
- Consider building synthetic practice cases with answer keys; they are licensable and reusable.


## Next step

This page states what each rule says and where to read it. It is not legal advice: your counsel decides how the rules apply to your records.

Does your company hold records like these? [See what your data is worth](https://origindatapartners.com/check-fit).

Origin Data Partners works with companies that own data and helps get it bought. We are independent of the services on this page, and a buyer may pay us when a deal closes ([how Origin is paid](https://origindatapartners.com/referral-disclosure)). [See what your data is worth](https://origindatapartners.com/check-fit).


## Questions and answers

### Can a CPA firm sell client workpapers for AI training?

Not without the client's specific consent under AICPA ET 1.700.001. The AICPA Ethics Division says a sale for AI training does not remove that requirement and that redaction alone does not make client information nonconfidential.

### Does anonymizing workpapers solve the confidentiality problem?

Not by itself. The AICPA Ethics Division says redaction does not turn confidential client information into nonconfidential information, and ET 1.700.060 applies even when the client is not named.

### Does Section 7216 apply to audit work?

It applies to information furnished for preparing tax returns. Tax workpapers and organizers fall inside it; audit-only files do not, but they remain confidential client information.

### What can an audit firm license without client data?

Its own audit programs, checklists, sampling methods, training material, review-note libraries rewritten without client facts, and synthetic practice cases with answer keys.

### How long must audit documentation be kept?

For PCAOB audits, seven years from the report release date under AS 1215. Keeping it does not give permission to license it.

### What is an audit engagement letter?

It is the written record of the terms of the audit: its objective, the auditor's responsibilities and management's. Under PCAOB AS 1301, which governs audits under PCAOB standards, the auditor should record that understanding in an engagement letter and provide it to the audit committee annually ([PCAOB AS 1301](https://pcaobus.org/oversight/standards/auditing-standards/details/AS1301)). Read it, and any other agreement with the client, before licensing anything built from an engagement; for tax clients, see whether a [Section 7216 consent can sit in an engagement letter](https://origindatapartners.com/guides/section-7216-ai-data-licensing).

### Who owns audit workpapers, the firm or the client?

The auditor. The AICPA's records-requests interpretation says working papers, such as audit programs, analytical review schedules and statistical sampling results, are the member's property and the member is not required to make them available, although statutes, regulations and contracts may impose additional requirements ([AICPA](https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf)). Ownership does not lift the confidentiality rule covered in the [AICPA rule 1.700 section](#aicpa-confidentiality) which still applies to the client information in them.

## Sources

- [AICPA Code of Professional Conduct, ET 1.700.001 (copy published by the Minnesota Board of Accountancy)](https://mn.gov/boa/assets/AICPA%20Code%20of%20Professional%20Conduct_tcm1233-764395.pdf)
- [Journal of Accountancy: Asked to sell firm data for AI training? Be very cautious (November 2, 2026)](https://www.journalofaccountancy.com/news/2026/nov/asked-to-sell-firm-data-for-ai-training-be-very-cautious/)
- [26 U.S.C. 7216: disclosure or use of information by preparers of returns](https://www.law.cornell.edu/uscode/text/26/7216)
- [PCAOB AS 1215: Audit Documentation](https://pcaobus.org/oversight/standards/auditing-standards/details/AS1215)
- [micro1 x DataSnipper: testing AI agents without client data](https://www.micro1.ai/blog/micro1-x-datasnipper-testing-ai-agents-without-client-data)
- [Business Insider: AI labs are fueling a wild market for your Slack DMs (October 2026)](https://www.businessinsider.com/ai-training-employee-data-emails-slack-dms-2026-10)
- [micro1: Company Data Partnerships](https://company.micro1.ai/register/?referralCode=24823479-4339-4311-a157-2600b8cf72cf&utm_source=referral&utm_medium=share&utm_campaign=job_referral)
- [Handshake AI: data partnerships](https://joinhandshake.com/ai/data-partnerships/license/)
- [PCAOB AS 1301: Communications with Audit Committees](https://pcaobus.org/oversight/standards/auditing-standards/details/AS1301)
- [AICPA Code of Professional Conduct, ET sec. 1.400.200 Records Requests (PDF)](https://pub.aicpa.org/codeofconduct/ethicsresources/et-cod.pdf)

## Related reading

- [/who-we-help/accounting-firms](https://origindatapartners.com/who-we-help/accounting-firms)
- [Section 7216 and AI: can a tax practice license return data?](https://origindatapartners.com/guides/section-7216-ai-data-licensing)
- [License ERP and Accounting Records for AI Training](https://origindatapartners.com/guides/license-erp-accounting-records-ai)
- [License data for AI evaluation: training, testing and holdouts](https://origindatapartners.com/guides/license-data-for-ai-evaluation)
- [Can a law firm license anonymized documents to AI companies?](https://origindatapartners.com/guides/law-firm-ai-data-licensing-ethics)
- [Which AI Training Data Holds Its Value in 2026?](https://origindatapartners.com/guides/ai-training-data-that-holds-value)
- [License Loan Underwriting and Credit Decision Data for AI](https://origindatapartners.com/guides/license-loan-underwriting-decision-data-ai)
- [License Insurance Underwriting Files to AI Companies](https://origindatapartners.com/guides/license-insurance-underwriting-files-ai)
- [/case-studies](https://origindatapartners.com/case-studies)
- [/refer](https://origindatapartners.com/refer)
- [/case-studies/accounting-firm-workpapers-575000](https://origindatapartners.com/case-studies/accounting-firm-workpapers-575000)
- [/case-studies/accounting-firm-workpapers-235000](https://origindatapartners.com/case-studies/accounting-firm-workpapers-235000)