We’ve Always Been in the Trust Business. This Is What It Looks Like in the AI Era.

I remember sitting in a Major Firms Group meeting several years ago when Barry Melancon, then CEO of the AICPA, said something that has stayed with me ever since: CPAs have always been in the trust business. 

In fact, his message was even stronger. We own the trust industry. I remember thinking about how simple, yet powerful, that statement was, and over the years I've found myself coming back to this message as technology continues to reshape the world around us.

Trust Has Always Been Our Business 

For generations, independent financial audits have given investors, businesses, and capital markets confidence in information they couldn't independently verify themselves. 

An auditor's opinion became something people could rely on because it was grounded in independence, evidence, professional judgment, and a rigorous set of standards. An independent opinion could help a company raise capital, give investors confidence, and ultimately support the functioning of our financial markets. There aren't many professions that can say their work has had that kind of impact.

As business evolved, so did the need for assurance. Companies began outsourcing more of their operations, relying on third parties to process transactions, manage information, and eventually operate critical technology systems.  The profession evolved with it, extending independent assurance from financial statements to the service organizations businesses depended on.

What Cloud Taught Us About Trust

Then came cloud computing, and this is where the parallels to what we're experiencing with AI become especially interesting. Companies were being asked to trust providers with their most critical business processes, often without the ability to directly observe or evaluate how those environments operated. CISOs, CFOs, and boards needed to understand how their information was being protected, what controls were in place, and whether those controls were actually working.

SOC 2 addressed that need in a meaningful way by creating a common framework for evaluating controls relevant to security, availability, processing integrity, confidentiality, and privacy, and it gave customers an independent CPA's report they could use as part of their vendor risk management processes. 

Over time, what began as a way to address customer concerns became an expectation for doing business in the technology ecosystem. Today, it's difficult to imagine enterprise technology procurement without SOC 2 being part of the conversation.

Since 2002, Schellman has had a front-row seat to that evolution, issuing thousands of SOC reports a year, helping technology companies demonstrate trust to their customers. What has always fascinated me, isn't necessarily the report itself, but what that report enables.

It gives an enterprise the confidence to move forward with a vendor, helps a technology company enter new markets, and creates opportunities for businesses to adopt innovations they might otherwise have been hesitant to embrace. The real value of independent assurance is helping businesses move forward with confidence.

AI Is a Different Kind of Trust Problem 

Technology didn't stop evolving with the cloud, with each development introducing different risks and raising new questions about accountability, security, and trust.  Our profession has continued to adapt, but I believe AI represents one of the most significant shifts yet because we're moving beyond technology that primarily stores, processes, or transmits information to technology that can make decisions and take actions on our behalf. 

AI agents are already writing code, reviewing legal documents, supporting financial decisions, interacting with customers, and executing workflows that previously required significant human involvement. As a result, the questions organizations now need answered are becoming much more complex.

It's no longer enough to ask whether a system is secure or the underlying infrastructure is properly controlled. We also need to understand whether an AI system behaves as intended, how it responds to unexpected situations, whether it can be manipulated, and what safeguards exist when something goes wrong. Most importantly, organizations need a credible, independent way to evaluate those claims.

Our own State of AI Governance research found that 74% of organizations believe they could pass an AI compliance audit today, yet only 27% report having fully mature AI governance programs. That gap between confidence and actual readiness tells us something important: organizations want to move forward with AI, but they need better ways to demonstrate that they're doing so responsibly.

Why the AICPA, AIUC, and Schellman Are Partnering Together for SOC 2 + AIUC-1

This is why I'm so excited about the collaboration between the AICPA, AIUC, and Schellman to bring SOC 2 and AIUC-1 together. This joint effort represents an opportunity to combine the established discipline and credibility of independent CPA assurance with a framework purpose-built for the unique risks of AI systems and agents.

SOC 2 evaluates the controls supporting a system, while AIUC-1 addresses AI-specific risks, including governance, safeguards, and technical evaluation. Together, they give enterprises a far more comprehensive understanding of the systems they're being asked to trust.

What makes this collaboration especially meaningful is the combination of expertise involved. The AICPA has played a defining role in developing the standards and frameworks that support independent assurance. AIUC brings technical expertise, and a framework focused on the rapidly evolving risks associated with AI.

And at Schellman, we've been fortunate to help pioneer this space as the first accredited AIUC-1 assessor, with more than 100 AI assurance engagements across the AI ecosystem, including some of the companies developing and deploying these technologies at scale. 

One thing has become very clear through that work: the market needs independent assurance that can evolve alongside technology without compromising the rigor that makes assurance valuable in the first place.

The CPA Profession’s Job Hasn’t Changed, Even as the Technology Has

 We live in a world where companies regularly describe their products as secure, safe, responsible, or trustworthy. Those commitments are important, but making a claim and independently demonstrating it are two very different things. An independent CPA's opinion carries weight because of the work that stands behind it: independence, evidence, professional judgment, and accountability.

We don't exist to simply validate what a company wants to say about itself. We exist to objectively evaluate whether the subject matter meets the applicable criteria and provide a conclusion that others can rely on within the scope of our examination. Opinions matter, particularly when they're issued by professionals who have earned the trust of the market over generations.

As we expand into new areas like AI assurance, we have a responsibility to protect that credibility. The technology may be new, but the importance of independence and professional skepticism is not. Those principles become even more valuable as technology becomes more sophisticated and harder for the average business leader to evaluate.

AI Won’t Be the Last Transformation Impacting How We Think About Trust

As exciting as AI is, it certainly won’t be the last major technological transformation that changes how we think about trust. Quantum computing is already raising important questions about cryptography, cybersecurity, and the resilience of systems that organizations rely on today. There will undoubtedly be other technologies that we haven't even imagined yet, each creating new opportunities and new challenges for organizations trying to understand what they can trust.

The AICPA and CPA profession’s opportunity is to be part of those conversations early. This means not waiting for emerging technologies to become mainstream before asking how independent assurance can help organizations adopt them responsibly but, working alongside technical experts, researchers, and standards bodies to shape it from the start. 

That proactivity requires us to keep learning, investing in new capabilities, and being willing to evolve. It also means recognizing that the future of assurance will increasingly involve collaboration across disciplines.

The partnership between the AICPA, AIUC, and Schellman is a great example of what becomes possible when we combine the profession's established strengths with the technical expertise needed to evaluate emerging technologies.

Our Most Exciting Chapters Are Still Ahead

When I think back to Barry's comments at that Major Firms Group meeting, I realize how much they continue to resonate with me. We are in the trust business, and we always have been.

But that doesn't mean we can assume the world will automatically look to us every time a new technology emerges. We have to continue earning that position by demonstrating that our profession is willing and able to evolve alongside the businesses and markets we serve.

At Schellman, our purpose to help our clients build trust with their customers has remained unchanged over more than two decades, even though the technologies we evaluate and the risks we address have changed dramatically. I'm proud that we've been able to play a role in helping organizations build confidence in cloud technology, cybersecurity, and now AI, and I'm even more excited about the opportunities ahead. 

I often say that trust is built in drops and lost in buckets. As we give technology more responsibility and autonomy, that principle only becomes more important. The future isn't just about AI, cloud, blockchain, or quantum computing. It's about giving businesses and society the confidence to embrace whatever comes next, knowing that credible, independent assurance can help them understand and manage the risks.

Barry was right. We're in the trust business. And I believe our most exciting chapters are still ahead of us.