Letter to JCOTS on IVO Study Bill

Sept. 29, 2026

Jodi Kuhn,
Executive Director,
Joint Commission on Technology and Science
General Assembly Building, 4th Floor
201 North 9th Street
Richmond, VA 23219

RE: Comments on JCOTS IVO Study Bill

Dear Director Kuhn:

On behalf of the Virginia Society of Certified Public Accountants (VSCPA), we appreciate the opportunity to provide comments regarding the legislative study evaluating the feasibility and impact of developing a framework for persons or entities seeking to act as independent verification organizations (IVOs) assessing artificial intelligence (AI) models’ or applications’ adherence to standards reflecting best practices for the prevention of personal injury and property damage. 

The VSCPA represents Certified Public Accountants (CPAs) working at firms and businesses across Virginia. As a leading voice for the CPA profession, the VSCPA works with policymakers, government agencies, regulatory bodies and other stakeholders to advance the public interest and help CPAs meet the needs of their clients, employers and the public. The profession’s perspective is one important part of a broader policy discussion about how existing assurance, technical expertise, ethics, independence, risk management and quality frameworks can support trustworthy AI oversight. The VSCPA is not taking a position in support or opposition of legislation establishing an IVO framework for artificial intelligence. However, if legislation is to move forward, we have included recommendations and considerations to ensure that scope of practice for CPAs and IVOs is clear. The recommendations in this letter will help preserve public trust and provide clarity for CPA firms and IVO's should legislation move forward in the 2027 session.

With the evolution of business and technology, the CPA profession has continually enhanced its independent third-party assurance standards and audit methodologies to provide trust in new and complex subject matters, including technology, cybersecurity, compliance and system controls. The CPA profession can offer valuable insight into the impact and practical application of proposed policies.

The VSCPA appreciates efforts to build public trust in artificial intelligence through independent assessment. Independent assessment can help promote transparency, accountability, and confidence in AI systems, but only if the statutory framework is clear about what kind of review is intended, what standards govern the work, and what role independent assessors are expected to perform. Clarity around the intended assessment is especially important where legislation uses terms like “audit,” “audit methodologies,” or similar terminology that may imply a level of rigor, independence, evidence and reporting requirements that the assessment is not intended to provide.

We encourage the Commonwealth to establish clear, consistent and credible standards for independent assessment while recognizing existing professional qualifications and oversight structures where they are relevant. The VSCPA encourages the Commonwealth to develop a framework that recognizes the different types of expertise needed for AI oversight, including technical, legal, risk management, cybersecurity, ethics and assurance expertise. Where an existing professional licensure or oversight framework already imposes relevant qualification, independence, ethics, quality management and accountability requirements, the Commonwealth should consider how to recognize that framework rather than impose duplicative requirements. For CPA assurance engagements, this would include recognition of existing CPA licensure, professional standards, independence requirements and quality monitoring.

Finally, we strongly recommend ongoing collaboration with stakeholders — including VSCPA, the American Institute of CPAs (AICPA), the Virginia Board of Accountancy (VBOA), and other professional organizations — to ensure clear guidelines on the scope of services and the application of professional standards that CPAs and other professionals will need to effectively assist impacted entities in meeting their obligations. Our detailed comments relating broadly to IVO legislation are outlined below.

1. Establish clear qualification standards and recognize existing oversight frameworks

Any IVO framework should establish clear, consistent and credible standards for independent assessment, while recognizing existing professional qualifications and oversight structures where they are relevant. A CPA license should satisfy applicable qualification requirements for assurance services performed under professional standards, without requiring additional verifier licensure.

2. Clarify whether assurance is intended and define the engagement

A question for the study is whether the Commonwealth intends to require assurance. Assurance typically refers to an engagement in which an assurance practitioner designs and performs procedures to obtain sufficient, appropriate evidence, based on the practitioner’s consideration of risk and materiality, to express an opinion or conclusion about the subject matter in the form of an assurance report. In this type of engagement, the practitioner employs a systematic process of evaluating whether there are material misstatements in the subject matter based on specific criteria. Also referred to as a third-party assurance engagement, this type of engagement is performed by an assurance practitioner that is an independent party and adheres to rigorous professional standards, providing a high level of confidence to stakeholders.

If assurance is intended, legislation should identify the subject matter to be evaluated, the criteria against which that subject matter will be measured, the required level of assurance, the reporting framework, practitioner qualifications and applicable independence requirements. That determination drives the type of engagement to be performed and the standards that should apply. CPAs are well positioned to help explain these options because the profession has continually enhanced its assurance standards and methodologies to address new and complex subject matters, including non-financial disclosures, cybersecurity, compliance and system controls. Effective AI assurance often requires both assurance expertise and technical subject-matter knowledge, and CPA firms routinely work with specialists while maintaining responsibility for the engagement and conclusion.

For example, a reasonable assurance engagement — an “examination” — provides a high, but not absolute, level of assurance and is designed to support an opinion on whether the subject matter is in accordance with suitable criteria, in all material respects. A limited assurance engagement — a “review” — is narrower in scope, providing a lesser level of assurance, and supports a conclusion about whether the practitioner is aware of any material modifications that should be made for the subject matter to be in accordance with the criteria. A review is substantially less extensive than a reasonable assurance engagement and is not appropriate for all subject matters. By contrast, an agreed-upon procedures (AUP) engagement is not an assurance engagement; the practitioner performs specific procedures and reports findings without providing an opinion or conclusion. Consulting services may also be appropriate where the work involves advising a developer or deployer on how to design, implement, or improve controls, processes, or risk mitigation practices.

3. Align terminology if assurance is not intended

If assurance is not the intended policy objective, the profession would suggest other standards that could be leveraged. Otherwise, legislation should ensure clear terminology that is aligned with the intended engagement. Terminology, such as “audit” or “audit methodology,” could imply assurance where it is not intended. Additionally, legislation should clearly set the criteria for the subject matter to be measured against. Without this clarity, different providers could interpret the same statutory requirement differently, apply different procedures or standards, and issue reports that are not comparable.

4. Use consistent criteria and protect independence

Regardless of the engagement type, it is recommended that the legislation identify suitable criteria to be used to ensure consistent evaluation of the subject matter, rather than allow core risk standards, criteria and mitigation requirements to be defined by each IVO independently. This distinction is particularly important if the engagement is intended to provide assurance. In assurance engagements performed by CPAs, management typically selects the criteria, while the practitioner evaluates whether those criteria are suitable and available. If an IVO were responsible for determining acceptable risk levels, methodologies, corrective actions, and verification consequences, evaluations could vary across providers, and the IVO’s independence could be called into question.

According to the AICPA attestation standards, suitable criteria have the following characteristics:

• Relevance — Criteria are relevant to the subject matter.
• Objectivity — Criteria are free from bias.
• Measurability — Criteria permit reasonably consistent measurements, qualitative or quantitative, of subject matter.
• Completeness — Criteria are complete when the subject matter prepared in accordance with them does not omit relevant factors that could reasonably be expected to affect decisions of the intended users made on the basis of that subject matter.

Criteria also need to be available to the intended users of the report to allow them to understand how the underlying subject matter has been measured or evaluated.

Considering these characteristics when identifying what the subject matter would be measured against supports a consistent approach among engagements and increases transparency, which enhances the degree of confidence decision makers have in the integrity and reliability of the information being reported.

5. Leverage existing assurance standards and oversight mechanisms

Where assurance is intended, we recommend leveraging existing professional standards rather than developing a duplicative state-specific assurance framework. The AICPA attestation standards provide a well-established structure for evaluating subject matter against suitable criteria, obtaining evidence, maintaining independence and issuing reports that are meaningful to users. These standards are developed by the AICPA’s Auditing Standards Board through transparent due process, including public meetings, exposure drafts, consideration of public comment and public votes on final standards. That openness and broad stakeholder participation help ensure the standards serve the public interest and meet expectations for high-quality, objective assurance.

Assurance engagements are performed by licensed CPAs who must comply with professional ethics and independence requirements, maintain appropriate competence through continuing professional education, implement quality management systems and undergo external quality review. Only CPAs and CPA firms subject to these monitoring and quality safeguards may perform assurance engagements under the AICPA attestation standards. Those standards require suitable criteria that are relevant, objective, measurable, and complete, helping ensure that AI assurance evaluations are consistent, transparent and meaningful. Recognized frameworks such as the NIST AI Risk Management Framework may provide a useful example of criteria or a reference point for developing suitable criteria in AI assurance contexts.

Leveraging existing assurance standards offers policymakers an efficient and proven path forward. Rather than creating an entirely new assurance structure, Virginia can rely on a framework that is already widely used, publicly available, subject to transparent due process, and supported by extensive professional and regulatory oversight. Combining established assurance standards with the public-protection requirements of CPA licensure would help promote trust, accountability, comparability and confidence in AI systems while avoiding duplicative or inconsistent state-specific requirements.

6. Apply comparable safeguards to all providers performing comparable work

The Commonwealth may determine that a range of qualified providers can serve as IVOs, depending on the nature of the assessment. Regardless of provider type, any person or entity performing comparable assurance or verification work should be subject to appropriate qualifications, independence, evidence, reporting, quality management and accountability requirements.

The VSCPA encourages JCOTS to develop an IVO framework that promotes public trust, clearly defines the type of assessment intended, identifies suitable criteria and engagement requirements, recognizes existing professional standards and oversight mechanisms where applicable, applies comparable safeguards to providers performing comparable work, and avoids creating duplicative or inconsistent state-specific requirements. Additional resources detailing the finer points of those raised in this letter are attached.

Thank you for your time and consideration. The VSCPA appreciates the opportunity to provide input and stands ready to serve as a resource as the Commonwealth evaluates how best to support trustworthy, transparent, and reliable AI oversight. 

Please feel free to contact me or VSCPA Vice President, Advocacy & Pipeline Emily Walker, CAE, at (804) 612-9428 or ewalker@vscpa.com if we can be of further assistance.

Sincerely,

Stephanie R. Peters, CAE
President & CEO
Virginia Society of CPAs