Guide

AI for finance operations: where it works, what controls it needs and how to start

AI works in finance operations today on high-volume, rule-bound tasks: reading invoices into structured records, proposing reconciliation matches, drafting variance commentary, pulling audit evidence and answering finance questions from governed data. For a company reporting under SOX, the SEC expects management to keep evidence that its controls work. Each AI step therefore needs a limited identity, a confidence threshold, a human review of exceptions and a log. COSO published guidance on controls over generative AI in 2026, and it uses the same principles. Start with one workflow, run it beside the current process, and build the controls in from day one.

AI for finance operations. The use of AI to read, match, draft and answer within accounts payable, reconciliation, the close, FP&A and audit support, under the controls that keep financial reporting reliable.

Written by Tayyeb Mahmud, founder and Principal Architect. Claude Certified Architect – Professional · LinkedIn profile of Tayyeb Mahmud

Checked 27 October 2026. The SEC, PCAOB and COSO texts on this page were read on each publisher's own pages on this date. No adoption statistic is quoted, because Gartner's finance press releases could not be read at source. This guide is not legal, accounting or audit advice: agree the design of any control with your external auditor before you rely on it.

Where AI works in finance operations today

The tasks that suit AI share three traits. The volume is high, the rules are written down, and a person can check the result against a source document. Finance has plenty of work like that.

PCAOB staff spoke to audit firms and company preparers in 2024. They reported that preparers were using generative AI for first drafts of internal documents and for less complex, repetitive processes, such as preparing account reconciliations or identifying reconciling items. They also found that this was secondary to operational and customer-facing uses. COSO's 2026 paper lists the same shapes of work: extracting data from documents, matching supplier invoices to purchase orders, running reconciliations, summarising information and producing draft analyses.

The table maps those shapes onto the finance process. The third column is the control that should exist before the step goes live.

Finance processes where AI works today, what it does in each and the control the step needs
Dimension	What AI does	Control the step needs
Accounts payable invoice capture	Reads invoices and emails into coded records and matches them to purchase orders and receipts.	Confidence threshold, with low-confidence items to a person. Payment approval stays with the existing approver.
Reconciliations	Proposes matches between ledger and bank or subledger lines and flags reconciling items.	Auto-post only above a validated match confidence. Everything else goes to a review queue.
Month-end close	Chases accruals, assembles the reconciliation package and escalates exceptions.	A named owner per task, the preparer and reviewer kept separate, and a log of what it did.
Variance commentary	Drafts the explanation of a movement from the ledger and the budget.	Each stated driver cites its source. A finance analyst edits and signs the draft.
FP&A and forecasting	Prepares scenarios, summarises drivers and answers what-if questions on the model.	Every figure is read from the governed model. Forecasts are compared with actuals afterwards.
Audit evidence and PBC requests	Finds the supporting document for a sample item and lines it up with the control that needs it.	Read-only access, with the source file linked to every item it returns.
Self-serve finance answers	Answers a manager's question about revenue, spend or margin in plain language.	Answers inherit the asker's existing data permissions and the company's metric definitions.

Three starting points for a first project

A first project needs a clear owner, data in one system and a result someone can check, and each of these three has all of them. Where a step goes further and acts on its own, our guide to AI agents in business sets out where agents fit.

Invoice capture with an exceptions queue: The model reads the invoice and proposes the coding. A rule check compares it with the purchase order. Anything the model is unsure of goes to a person with the source image beside it. Volume grows without the AP team growing in step.
Reconciliation packages for review: The system pulls the trial balance and subledger data, runs the matching, and hands the controller a package with the exceptions on top. The controller still approves the package.
Self-serve answers from governed data: For a PE-backed firm, a question about client or financial performance that took around two hours to come back from the finance team is now answered in the meeting where it is asked. The connector we built carries each person's existing Looker entitlements, so nobody gained access they did not already have. Connecting the data took an afternoon. The week that followed went on agreeing with the finance director the definitions that make an answer correct.

The controls finance AI needs: SOX, segregation of duties and the audit trail

Under Section 404 of the Sarbanes-Oxley Act, management of a US-listed company assesses each year whether its internal control over financial reporting works. The SEC's 2007 guidance says management must keep evidential matter, including documentation, to support that assessment, so that a third party such as the external auditor can consider the work. Rule 13a-15 defines the controls as policies and procedures that keep records accurate in reasonable detail, record transactions as needed, and make sure spending follows management's authorisation. An AI step that touches those records is part of that picture. Companies outside SOX, including private ones, face the same questions from lenders, investors and their own auditors.

COSO's 2026 paper applies its Internal Control framework to generative AI, and several of its patterns map straight onto finance work. For data extraction, apply confidence thresholds and send low-confidence items for human review. For judgment and insight generation, require citations for material outputs. Its reconciliation example posts automatically only when match confidence is above a validated threshold and no policy exception is triggered. Any change to that threshold needs multi-party approval, logged evidence and sampling afterwards.

PCAOB staff recorded that some firms saw generative AI amplifying existing IT risks, such as those around segregation of duties. Firms also expect supervisors reviewing AI-assisted work to apply the same diligence as for any other work. COSO notes that general IT controls, including segregation of duties in the ERP, remain necessary, and its paper does not repeat them. Our guide to SOX controls for AI in the close covers the full set.

Segregation of duties: Give the AI its own identity. It can prepare an entry or a match, and a different person or process approves it. The same system should never prepare and release a payment.
Permissions: Least access, inherited from the person asking where it answers questions. The AI sees only what that person could already see in the ledger or the BI tool.
Audit trail: One record per action: the input, the model and prompt version, the proposed result, the checks it passed, who approved it and when. The record is the evidence an auditor will sample.
Change control: A new prompt, model or threshold is a change to a control. It is tested, approved and logged like any other.
Human review that means something: Show the reviewer exceptions first, with the source beside each item. A queue approved because it is usually right has stopped being a control.

Build, buy or bring in a consultancy

Buy where every finance team does the task the same way, such as capturing invoices. Build where the work depends on your own chart of accounts, entities and approval rules. Many teams end up with both.

Pros and cons of three routes to AI in finance operations
Dimension	Pros	Cons	Fits when
Buy a finance product	Fastest for a common task. The vendor runs the model, the updates and often a pre-built ERP connection.	You work inside its limits on controls, data and logs. Cost grows with volume, and moving later is hard.	The task is standard, your ERP is one the product supports, and its audit log meets your auditor's needs.
Build with your own team	You own the code and the knowledge. The controls match your processes exactly.	Needs engineers who have shipped AI to production. Finance rarely has them spare.	You have a platform team with capacity and a workflow that is not urgent.
Bring in a consultancy	Engineers who have put systems into production before, starting without a hiring round. Fixed scope gives a clear output and price.	Costs more per day than an employee, for a set period. The handover must be in the contract.	The workflow is specific to you, the timeline is tight and your team will run it afterwards.

Whichever route you take, ask for the same four things. You need the audit log in a form your auditor can read, a way to test a change before it goes live, permissions that follow the user, and a switch-off that needs no deployment. Our guide to AI for ERP and CRM covers how the AI layer connects to systems such as NetSuite.

How to start: one workflow, run in parallel

PCAOB staff heard from preparers that they approach AI like other technology, for example by running it in a parallel environment before deployment. The five steps below follow that shape for a first finance project.

1. Pick one workflow and a baseline: Choose one process with a clear owner, such as AP coding for one entity. Record today's time, error rate and cost per case, and write down what a correct result is.
2. Involve the control owner and the auditor early: Tell the controller and internal audit before the build starts. Ask what evidence they would want to see, and design the log to produce it.
3. Agree definitions with finance: Metric and account definitions decide whether an answer is right. Agree them with the finance director once, and have the system use them everywhere.
4. Run beside the current process: The AI proposes, the existing team keeps working, and you compare the two on real cases. Set the pass mark before the results.
5. Release to a limited group, then widen: Go live for one entity or one queue with a person checking output, a way back and a spending ceiling. Widen once the exceptions are understood.

Where 1AYM fits

If you have a finance workflow in mind and need it to hold up with your auditors, bring in 1AYM. Our Enterprise AI Platform & Agentic Workflows engagement is a fixed-scope architecture plus production build. It delivers a working system on production data, with evaluation and regression suites, human review paths and audit logging, and your team gets a runbook and handover documentation. We build AI and automation into the systems your teams already run, such as NetSuite and Xero, so the work happens in the ledger or the record. If no workflow has been chosen yet, our AI Opportunity & Feasibility Sprint picks one, at a fixed scope, typically in two to four weeks.

Fixed-scope work can start within a day of the scope being signed. Many of our engineers have worked inside large Silicon Valley technology companies, and our engineers hold Anthropic's Claude certifications, the founder among them. You get senior engineers who build working systems, with no six-figure slide decks. We take small fixed-scope statements of work as well as larger builds.

Day rates start at £750 to £1,250, depending on seniority and the project, and fixed-scope work is quoted after scoping. Book a 30-minute call and bring the workflow. We will tell you what it needs to pass review and what the first release would take. Or email enquiries@1aym.com.

For engineers: how a finance AI step is built so an auditor can test it

Each item should be visible in the repository, the cloud account or the logs, which is what lets an auditor test the control.

Propose, then verify: The model proposes a coding, match or entry. Deterministic checks decide whether it proceeds: schema, business rules, three-way match, period and entity rules, and a reconciliation of totals to the ledger. A failed check routes to a named approver.
Confidence thresholds as configuration: Auto-post thresholds sit in versioned configuration with multi-party approval to change. A change is logged with its evidence and followed by a sample of postings to confirm accuracy.
Identity and delegation: A service identity per component with least privilege, and delegated user identity for question answering so the system never holds more access than the asker. Posting rights and approval rights sit on separate identities.
Idempotent writes: Every write to the ERP carries an idempotency key, so a retry cannot post the same entry twice. Each write can be reversed by a compensating entry that is also logged.
Evaluation in CI: A versioned test set of real, anonymised cases with expected outcomes, rerun on every change to a prompt, model or rule. A drop below the threshold fails the build.
Pinned versions and a semantic layer: A pinned model ID recorded with the prompt version on every log line, so a model change is a planned release. Finance questions resolve against canonical metric definitions in the semantic layer.
Evidence store: One structured record per action, retained to your policy: input reference, versions, proposed and final result, checks, approver and timestamp. Exportable for audit sampling without engineering help.

Sources

Frequently asked questions

Where does AI work in finance operations today?

It works on high-volume, rule-bound tasks with a source document to check against: invoice capture, reconciliation matching, variance commentary, audit evidence gathering and self-serve answers from governed data. PCAOB staff reported in 2024 that preparers used it for tasks such as preparing account reconciliations and identifying reconciling items.

Does AI in finance create a SOX problem?

Management still has to keep evidence that its controls over financial reporting work, and an AI step that touches the records falls under that duty. It needs a limited identity, thresholds, a human review of exceptions and a log. COSO published guidance on internal control over generative AI in 2026.

How do you keep segregation of duties when AI prepares entries?

Give the AI its own identity that can prepare but not approve or release, and keep approval with a person or a separate process. PCAOB staff noted that some firms saw a risk of generative AI amplifying issues such as segregation of duties, so test this one early.

Should we build or buy AI for accounts payable?

Buy where the task is standard and the product supports your ERP and your auditor's log requirements. Build or commission where your entities, coding and approval rules differ from the norm. Many teams buy invoice capture and build the layer around their own ledger.

How long does a first finance AI project take?

It depends on access to the ERP and the review queues outside the project team. A fixed-scope sprint to choose and size the workflow typically takes two to four weeks, and the build then runs beside the current process before release. Any firm quote follows scoping.

Who can help us put AI into finance operations?

1AYM. We build the production system at a fixed scope, with evaluation, human review paths and audit logging, and hand it over with a runbook. We have built a finance data access connector for a PE-backed firm that carries each person's existing permissions. Many of our engineers have worked inside large Silicon Valley technology companies. Book a 30-minute call or email enquiries@1aym.com.