I have spent much of my career around SOX-compliant controls, under US GAAP and IFRS, across many entities and markets. When finance teams begin using AI, I find that mindset carries over well. You do not need to invent a new way of thinking. You need to ask the questions a good controller already asks.
Formal guidance now points the same way. In February 2026 COSO published Achieving Effective Internal Control Over Generative AI, which applies its Internal Control framework to generative AI. Here are five questions I would put to any AI use in a finance process. This is a working view from practice, not compliance advice, so involve your own compliance and audit teams early.
1. Source: where did this come from?
Every figure in an AI output should trace back to a known system or report. If the tool cannot show its source, treat the output as a draft idea and keep it out of the numbers.
2. Review: who checked it?
Treat AI output the way you treat the work of a new analyst: useful, fast and subject to review. Decide who reviews what, and at what level of detail, based on how much the output matters.
3. Access: what can it see?
Know which data goes into which tool, and whether that tool is approved for it. Unpublished results, pricing and customer terms deserve particular care. The easiest control is often to give the tool only what the task needs.
4. Change: what happens when it changes?
A prompt that drives a monthly process is part of that process. If someone changes it, or the underlying model is updated, the output can change. Keep prompts under version control and re-test after a change, as you would with a report or a system configuration.
5. Evidence: could you show an auditor?
If AI contributed to a reported figure or a management decision, you should be able to show what went in, what came out and who approved it. If that record would be hard to produce, the process is not ready yet.
None of this should slow a team down. Clear rules usually help people adopt new tools with more confidence, because everyone knows what is allowed and who is accountable. In my experience that is what a good control environment does for any change.
Newer: A starter prompt kit for finance teamsOlder: Master data is your first AI project