Rob Steele, CFO, iplicit
AI is changing how finance teams produce numbers. But it also raises questions around data accuracy, data security, accountability, third-party reliance and the end-to-end control environment. Rob Steele, CFO of iplicit, with a career in finance spanning over three decades, says leaders adopting AI should press ahead, but without losing the transparency auditors expect.
Finance teams are right to be excited about AI. So often, we are asked to do more with less: streamline manual data entry, reduce headcount and speed up reporting processes. iplicit research found that almost half (45%) of mid-market CFOs still point to manual work as a drain on their time, so it’s unsurprising that 92% have adopted AI tools in some form within their finance function. Optimising business processes is a collective responsibility. Risk appetite should set the direction on where AI can be used in an organisation.
Amid the hype, auditors and regulators are watching closely. While AI, when used correctly, has the potential to turn days of work into hours or minutes, compliance and regulation are going nowhere. Auditors still need to understand where figures have come from, how they were produced, and how they were handled from origin to the accounts. Every number must be explainable, defendable, and based on accurate data. This has been the standard for as long as audits have existed; AI has simply changed how we find the answers.
Some of the noise around AI suggests it might eventually replace finance teams or leaders, and more than half (51%) of those we surveyed already see it as a threat to their roles. But for high-stakes processes such as the month-end close, financial reporting, and audit preparation, responsibility still lies with finance leaders – who need to understand both what AI can do well and the significance of its limitations.
Auditors are asking the same questions
Auditing has always come down to the same test – can teams explain the process behind their accounting and show that it can be relied on? This means that, wherever AI has played a part in producing, analysing, or verifying a figure, auditors will likely focus on a familiar set of concerns:
- Who is accountable for using the AI, and was the tool approved for financial data?
- What data did it draw on, and how is that data protected?
- Can the output be traced back to the source transactions?
- Who reviewed it before it reached the accounts, and is that review documented?
- Do your third parties use AI in your outsourced processes, and what assurance have you obtained that their controls are operating in line with your risk appetite?
The challenge with AI is keeping a clear line between what the technology does and where people remain responsible.
Auditors (and customers) expect accuracy
It’s an auditor’s job to scrutinise your finances, so the figures in your VAT return or your statutory accounts have to be accurate every time, with a full record behind them.
The catch with using AI in finance is that it’s probabilistic, not deterministic. It predicts the most likely answer rather than calculating a certain one, which makes it powerful for flagging anomalies and patterns across thousands of data entries for your finance team to review. But in finance, you can’t afford to get your calculations wrong, whether that’s your trial balance, VAT, or consolidated numbers, so “most likely right” isn’t a standard anyone can accept.
Penrose Labs, an AI research firm, tested this directly with a benchmark called AccountingBench. Leading AI models were set the task of closing a year of a real company’s books against the work of a qualified accountant. The best-performing models started out strong, staying within around 1% of the accountant’s figures after the first month’s close. But as the year went on, they drifted, with errors compounding period on period until balances had diverged by more than 15% (roughly half a million dollars) by year-end.
That’s why AI output always needs a thorough human review, at every stage. AI is there to support your team’s human judgement and foundational knowledge, not replace it. Human first, technology thereafter.
Clean data first, AI implementation next
Where AI sits in your tech stack determines how quickly your team can trace a number back through an unbroken chain to its source, and how complete that picture is. AI embedded in the same system as your ledger keeps that chain intact. AI bolted on as a separate tool breaks it, and that gap is the first thing an auditor will interrogate. What follows is manual, time-consuming reconciliation, the very work AI was meant to remove.
Implementing AI properly is a staged process:
- Start with clean master data
AI is only as useful as the data it works from. If the foundational data is flawed, the output will be too. Review data hygiene processes and aim for standardised, aggregated data from verified sources. Otherwise, the team will be facing a “garbage in, garbage out” situation that will cause problems with auditors down the line. - Built in, not bolted on
When AI runs inside the same platform as your ledger, every output carries a traceable line back to the source transaction. Bolt-on tools can disrupt this, and each break in the line is a point where you have to reconcile two systems by hand and prove to an auditor that nothing was lost in between. To avoid this, choose a unified finance system where AI is layered onto a deterministic cloud core, not bolted on as a separate tool. - Establish clear AI protocols and avoid “shadow AI”
The moment official AI tools feel slow or restrictive, team members might turn to unauthorised alternatives. This “shadow AI” leaves no record an auditor can follow, and financial data entered into an unsanctioned tool is data you no longer control or account for. Make sure teams know what tools can and cannot be used.
High-risk activities, such as changing supplier bank details, posting material journals or releasing payments, should require approval from finance and, where appropriate, risk teams. AI should not automatically inherit broad permissions simply because a human user has them.
Human-led AI is a decision, not just a principle
AI can do a great deal, but the finance team stays accountable for the outcome. In practice, this means establishing robust oversight, requiring human sign-off on all AI outputs, and using clean master data within a secure, unified system.
This extends to any outsourced processes managed by third parties. Finance teams and organisations should be thinking about third parties’ use of IT, the assurance available, and alignment with their own risk appetite.
Stephen Mills, an Audit Partner with more than 35 years’ experience and the COO of Audit at Forvis Mazars, said: “Human judgement remains fundamental: AI should support finance teams, not replace their accountability, and its outputs require human-led review throughout the process. Similar to previous evolutions of technology and risk management concepts, organisations can outsource their processes to AI; however, accountability remains with the organisation. Therefore, finance teams must ensure appropriate controls, transparency, and assurance over the use of AI are in place across the entirety of the control environment supporting business processes.”
The appetite for that control is already there. 58% of finance leaders say they’re concerned about the security and compliance risks of adopting AI without clear governance. This isn’t a framework finance teams need to build from scratch. ISO/IEC 42001, the international standard for managing AI responsibly, is something to look for in the platforms you choose. Using a system certified to it means your finance team can demonstrate documented ownership, review processes, and a record of how AI is used.
If your third parties use AI in the processes you outsource or rely on, you will need specific controls within your own environment, known as complementary user entity controls (CUECs), to gain assurance that controls at those third parties are performing as expected.
Starting the conversation earlier with your auditor makes the process more efficient. Ask your auditors what they will expect to see once AI has played a part in the process, and explore how new AI tools enable teams to trace and explain the numbers they produce. Make these the first steps, not the fallback under scrutiny, and you keep the benefit of AI without losing what auditors have always required: evidence.
While traceability and accountability are the overarching considerations, it is essential to demonstrate an effective control environment through access management, change control, interface reconciliations, and exception monitoring.
Finance, IT, and risk teams should work together to ensure AI operates within a secure, controlled environment, with clear ownership, appropriate access restrictions and a traceable audit trail from source data to final output. Controls must also extend beyond implementation, with ongoing monitoring, testing and contingency plans to identify errors, respond to incidents and maintain critical finance processes.
Ultimately, the objective is not simply to automate the finance function, but to optimise processes in the most efficient way without compromising the integrity, transparency or resilience of financial reporting.
