Generative AI in Finance: 10 Internal Controls Every Financial Controller Should Implement

Generative AI is moving into finance workflows quickly. Teams are using copilots to summarize contracts, explain variances, draft journal narratives, extract invoice details, investigate reconciliation breaks and prepare management commentary. These uses can improve speed, but they also introduce a control question that finance leaders cannot delegate to the technology team: how do we know AI-assisted work is complete, accurate, authorized and traceable before it affects financial reporting?

The answer is not to ban useful tools or to treat every AI output as inherently unreliable. It is to apply risk-based controls to the specific task, data and decision. In February 2026, COSO released Achieving Effective Internal Control Over Generative AI, translating its Internal Control–Integrated Framework into practical guidance for GenAI. The publication highlights risks such as hallucinations, prompt-based manipulation, opaque reasoning, model drift and frequent configuration changes. This gives controllers a timely basis for strengthening finance controls without creating a disconnected “AI-only” control universe.

1. Start with the financial-reporting use case, not the AI brand

Build an inventory of AI-enabled activities across controllership, FP&A, tax, treasury, procurement and shared services. Record the process owner, tool, model or service provider, data used, output produced, downstream system and whether a person approves the result.

Classify use cases by what they can do in the data-to-decision lifecycle. A tool that summarizes a policy document is different from an agent that prepares a journal entry, changes a vendor record or posts an adjustment. Risk rises when an AI workflow can transform source data, initiate transactions, make judgments, or trigger actions in enterprise systems.

For example, an AI assistant that drafts a variance explanation for a controller to edit may be lower risk than an autonomous workflow that interprets an invoice, selects a GL account, creates a journal and posts it without independent review.

2. Define permitted use and prohibited data

Publish a finance-specific acceptable-use standard. It should identify approved tools and accounts, permitted use cases, prohibited data, retention expectations, required human review and escalation routes. Do not assume that a consumer chatbot has the same confidentiality, retention, access or contractual protections as an enterprise service.

Finance teams routinely handle payroll details, bank information, customer contracts, acquisition data, forecasts, pricing, tax positions and unpublished financial results. Classify these information types and specify which tools may process them. Where an enterprise tool is approved, confirm the relevant contractual terms, access controls, data-use settings, retention and deletion arrangements with legal, privacy, procurement and information security teams.

3. Keep source data complete, authorized and traceable

AI outputs are only as dependable as the information supplied to them. Establish approved data sources for financial analysis and restrict access to relevant entities, periods and business units. Preserve source extracts, report parameters, timestamps and transformation steps for material outputs used in the close or external reporting.

When a model retrieves information from a document repository or data warehouse, confirm that permissions are enforced at retrieval time. A user who cannot access a confidential acquisition file in the source system should not gain access to it through an AI assistant. Test for leakage across legal entities, departments and user roles.

4. Require human approval for accounting judgments and postings

AI can help identify unusual transactions or draft accounting analysis, but it should not replace the accountable preparer or reviewer. Establish clear boundaries for decisions involving accounting policy, estimates, reserves, journal entries, revenue recognition, impairment, consolidation adjustments and disclosures.

For AI-generated journal support, require the preparer to verify the underlying transaction, accounting rationale, period, entity, account, dimensions, amount and supporting evidence. The normal journal approval matrix should still apply. Where an AI tool creates a proposed posting, separate the ability to prepare from the authority to approve and post.

A practical rule is: AI may recommend; an authorized employee owns the conclusion. If the output cannot be traced to reliable evidence or explained in ordinary accounting terms, it should not be used as support for a material reporting decision.

5. Test accuracy with finance-specific scenarios

Generic demonstrations are not adequate validation. Before deployment, build a test set that reflects the finance process: routine transactions, unusual entries, missing documents, conflicting instructions, different currencies, intercompany activity, close cut-off scenarios and deliberately misleading prompts.

Define acceptance criteria before testing. Examples include extraction accuracy, false-positive and false-negative rates, completeness of exception identification, correct entity and period classification, and the percentage of outputs requiring material correction. Test the same cases after model, prompt, connector, workflow or source-data changes.

For a reconciliation assistant, test whether it correctly distinguishes timing differences from genuine errors, flags duplicate transactions, avoids inventing explanations and links each proposed match to source records. Record failed cases and remediation, not just the successful demonstration.

6. Protect workflows against prompt injection and unauthorized actions

Prompt injection can occur when an AI system processes untrusted text that attempts to override its instructions. In finance, this could be text embedded in an invoice, email, spreadsheet or retrieved document. Treat external content as data, not as instructions to the agent.

Limit agent permissions to the minimum needed. Use read-only access by default; require explicit authorization for write actions; restrict payment, vendor-master, journal-posting and user-administration capabilities; and log tool calls. High-impact actions should require an independent human confirmation in the system of record, not merely a conversational “yes.”

7. Monitor model drift, changes and exceptions

AI workflows can change when a vendor updates a model, a prompt is edited, source documents change, a connector is added or a business process is redesigned. Maintain an owner and change log for each material use case. Reassess risk and perform regression testing after significant changes.

Monitor both operational and control indicators. Useful measures include override rates, output correction rates, unsupported-citation rates, exception volumes, unauthorized access attempts, failed workflow runs, stale data incidents and the number of outputs escalated to a human. Establish thresholds that trigger investigation rather than relying on a generic vendor confidence score.

8. Align AI governance with COSO, SOX and the Canadian control environment

COSO’s 2026 GenAI guidance is designed to apply established internal-control thinking to AI use. Controllers can map AI risks into the familiar control environment, risk assessment, control activities, information and communication, and monitoring components rather than maintaining an isolated checklist that never connects to the ICFR program.

For US public companies subject to SOX Section 404, determine whether an AI-enabled process affects a relevant financial-reporting risk or control. If it does, document the process, relevant assertions, control owner, evidence, system dependencies and testing approach. The technology itself does not automatically become a material weakness; the question is whether the design and operation of controls adequately address the risk of material misstatement.

Canadian entities should assess the requirements applicable to their reporting status, regulators, lenders and governance obligations. Do not assume that every US SOX requirement applies identically to every Canadian private enterprise. The underlying discipline—clear accountability, reliable evidence, access restriction, monitoring and documented review—remains useful across both markets.

9. Make AI outputs auditable

For material finance use cases, retain enough evidence for another qualified person to reconstruct what happened. Depending on the process, this may include the user, date and time, model or service version where available, prompt or workflow version, source data references, output, human edits, approval, exception handling and downstream transaction ID.

Do not rely on a screenshot of a chat window as the only audit trail. Store the final approved analysis and link it to the source records and system-of-record transaction. Apply retention and access policies consistent with the underlying finance records.

10. A controller’s implementation checklist

Inventory AI tools, agents and embedded copilots used in finance.
Assign a business owner and risk tier to every material use case.
Approve permitted tools, data classifications and prohibited use.
Map each use case to financial-reporting processes and relevant assertions.
Validate source-data access, completeness and lineage.
Keep human review and segregation of duties for judgments and postings.
Test normal, unusual, incomplete and adversarial scenarios before release.
Restrict agent permissions and require confirmation for consequential actions.
Monitor output quality, exceptions, access and changes after deployment.
Retain evidence that supports review, audit and incident investigation.

Conclusion: automate the work, not accountability

Generative AI can help finance teams spend less time assembling information and more time evaluating risk and advising the business. But speed does not establish accuracy, and a fluent explanation is not evidence. Controllers should make AI governance part of the existing internal-control system: define the use case, protect the data, test the output, restrict actions, require accountable review and preserve an audit trail. That approach allows responsible experimentation while protecting the integrity of the close and financial reporting.

Informational disclaimer: This article is general educational content, not legal, accounting, cybersecurity or regulatory advice. Organizations should assess applicable requirements and obtain appropriate professional advice for their circumstances.

SOX and ICFR Scoping: 10 Risk-Based Steps for Financial Controllers

SAP S/4HANA Finance Cutover: 10 Controls for Opening Balances and Data Reconciliation