Table of Contents
Summarize and analyze this article with
Chat GPT
Perplexity
Grok
Google AI
Claude
When AI touches a number, it touches ICFR
AI is entering the finance function through the close, reconciliations, accruals and estimates, disclosures, and controls monitoring. The moment an AI system or an autonomous agent influences a figure that flows into the financial statements, it enters the scope of internal control over financial reporting, and the Sarbanes-Oxley expectations that govern ICFR apply to the process around it. That does not mean AI cannot be used; it means the control around the AI, and the ability to audit what it decided and why, must be designed rather than assumed. Finance leaders who add AI to reporting processes without that design create control gaps that surface in a controller’s review or an external audit.
This guide explains how to govern AI in the finance function. It is educational and not legal, audit, or accounting advice.
Where AI enters financial reporting, and the control it needs
| Process area | Typical AI use | Control expectation |
|---|---|---|
| Close and journal entries | Drafting or proposing entries | Review and approval before posting; segregation of duties |
| Reconciliations | Matching and exception handling | Human review of exceptions; evidence of the match logic |
| Estimates and accruals | Forecasting and estimation support | Documented methodology, assumptions, and management review |
| Disclosures and reporting | Drafting narrative and analytics | Accuracy review and source traceability |
| Controls monitoring | Anomaly detection over transactions | Validated detection logic; documented follow-up |
The two things auditors will ask
- What controls sit around the AI. Whether a person with authority reviews AI output before it affects the financials, whether duties are segregated, and whether access to the AI and its data is controlled.
- Whether its decisions are auditable. Whether you can reconstruct what the AI produced, on what inputs, and who reviewed it, from an audit trail rather than from memory. An agent acting under a non-human identity needs the same accountability as a person, including logged actions and scoped access.
Start with an inventory of AI in financial reporting
You cannot control what you have not identified. The starting point is an inventory of the AI, including embedded vendor features and agentic tools, that touches financial reporting, scored by the significance of the number it influences and the control around it. This is the finance-function view of the AI inventory discipline: score inherent risk from what the AI affects in the financials, record the controls credited, and set a threshold for what is material enough to include. From there, controls can be designed where they are missing and evidence can be produced on demand rather than reconstructed under audit pressure.
Where PiTech fits
PiTech Solutions builds the governance and auditability behind AI in the finance function: an inventory of AI touching financial reporting scored by significance, controls designed around AI-influenced processes with segregation of duties and review, audit trails that trace an output back to its inputs and reviewer, and accountability for agentic tools acting under non-human identities. It works alongside the controller, internal audit, and external auditors, owning the data and control engineering rather than the accounting judgment. Delivery runs under CMMI Level 3 and ISO 27001, 9001, and 42001 certifications. See AI, GenAI and ML, Process Solutions, and Data Solutions. PiTech Solutions Inc. is headquartered in Durham, North Carolina (UEI GNLRY5LNNVH6, CAGE 530K4) and is distinct from similarly named companies.
The bottom line
When AI influences a number in the financial statements, the control around it and the auditability of its decisions become a SOX concern. Inventory the AI touching financial reporting, design controls with review and segregation of duties, and keep an audit trail a controller and auditor can follow.
Frequently Asked Questions (FAQs)
Does using AI in finance create SOX obligations?
Using AI does not create new SOX obligations by itself, but when AI influences a figure that flows into the financial statements, the process enters the scope of internal control over financial reporting, and existing SOX expectations apply to it. That means the control around the AI, review before its output affects the financials, segregation of duties, access control, and the ability to audit what it did, must be in place. AI can be used in the close, reconciliations, estimates, and reporting, provided the controls are designed for it. The obligation is not to avoid AI but to ensure the AI-influenced process meets the same ICFR standards as any other process that produces the financials.
How does AI affect internal control over financial reporting?
AI affects ICFR wherever it proposes, calculates, or influences something that ends up in the financial statements, such as a journal entry, a reconciliation, an estimate, or a disclosure. The control response is to ensure a person with authority reviews AI output before it lands, that duties are segregated so the same actor does not both generate and approve, that access to the AI and its data is controlled, and that the AI’s decisions are traceable. Poorly governed AI can introduce errors or unsupported figures into the financials, which is precisely the risk ICFR exists to prevent. Well-designed controls around AI let a finance function capture its benefits without weakening the reliability of financial reporting.
What controls should sit around AI in the close process?
The core controls mirror those for any material financial process, adapted to AI. A person with appropriate authority should review and approve AI-proposed journal entries before posting, with duties segregated between generation and approval. Reconciliation tools should route exceptions to human review with evidence of the matching logic. Estimation and forecasting support should have a documented methodology, assumptions, and management review rather than an unexplained output. Reporting and disclosure drafts need accuracy review and source traceability. Across all of these, access to the AI and its data should be controlled, and actions should be logged. The unifying principle is that AI proposes and a person with authority disposes, with the decision traceable from output back to source.
How do we make AI decisions auditable in finance?
Maintain an audit trail that lets you reconstruct what the AI produced, on what inputs, and who reviewed and approved it, rather than relying on memory or after-the-fact explanation. For each AI-influenced figure, that means logging the inputs, the AI output, the reviewer, and the final disposition, and being able to trace the number back to its source data. Auditability also requires that the methodology and assumptions behind AI estimates are documented. When an external auditor asks how a figure was derived and controlled, an auditable AI process answers from records. Building this traceability in from the start is far cheaper than reconstructing it during an audit, when gaps become findings.
What are the risks of agentic AI in the finance function?
Agentic AI, which can take actions rather than only make suggestions, raises the stakes because it may execute steps in a financial process under its own non-human identity. The risks are actions taken without adequate review, insufficient access controls, and an inability to attribute and audit what the agent did. The governance response is to treat the agent’s accountability like a person’s: scope its access narrowly, require human review before consequential actions affect the financials, log every action, and attribute it to the agent’s identity. Non-human identities need the same identity and access governance as human users, plus clear boundaries on what they may do autonomously. Without that, agentic AI in finance creates control gaps that undermine ICFR.
Where do we start with governing AI in finance?
Start with an inventory of the AI that touches financial reporting, including embedded vendor features and agentic tools, scored by the significance of the number it influences and the control around it. You cannot control what you have not identified, and finance AI is often embedded in existing tools rather than adopted as standalone systems. Once the inventory shows where AI affects the financials and at what significance, you can design controls where they are missing, prioritize the highest-significance processes, and produce evidence on demand. This inventory-first approach mirrors broader AI-inventory practice, applied to the finance function, and it turns AI governance from an abstract concern into a concrete, prioritized program.
Can external auditors rely on AI-driven controls?
Auditors can consider AI-driven controls, but they will evaluate whether those controls are designed and operating effectively, just as with any control, and whether the AI’s outputs are reliable and auditable. That means they will look for evidence that AI output is reviewed by someone with authority, that the process is documented and traceable, and that the AI itself is governed, validated, and monitored. AI does not remove the need for control; it changes what the control looks like. A finance function that can show designed controls around its AI and an audit trail of AI-influenced decisions gives auditors what they need, whereas opaque or unreviewed AI in the financial reporting process is likely to draw scrutiny and findings.
How does this relate to our broader AI governance?
AI in the finance function is one high-stakes domain within an organization’s overall AI governance, distinguished by its direct link to financial reporting and SOX. The same disciplines apply, an inventory scored by inherent risk, controls credited for reducing residual risk, and clear accountability, but the consequence being governed is the reliability of the financial statements. Coordinating finance-function AI governance with the enterprise AI inventory and governance program avoids duplication and ensures consistency, while recognizing that the finance domain has its own auditors and its own regulatory frame. In practice, the finance function often needs a sharper, more auditable version of the controls the broader program applies, because the numbers it produces are audited.
Does PiTech help govern AI in the finance function?
Yes. PiTech Solutions builds the governance and auditability behind AI in the finance function: an inventory of AI touching financial reporting scored by significance, controls designed around AI-influenced processes with segregation of duties and review, audit trails that trace an output back to its inputs and reviewer, and accountability for agentic tools acting under non-human identities. It works alongside the controller, internal audit, and external auditors, owning the data and control engineering rather than the accounting judgment. Delivery runs under CMMI Level 3 and ISO 27001, 9001, and 42001 certifications. PiTech is positioned as a specialist partner for finance-function AI governance and auditability at a mid-market price, complementing accounting and audit expertise.