COSO puts generative AI inside the control system

Control the information path, not just model access

A finance review should follow the complete path from approved source records to retrieval, instructions, generated output, human edits, financial systems, management reporting, and retained evidence. Identity and access controls matter, but they do not show whether the model used the right period, entity, account definition, policy, or planning assumption. Name the owner at each handoff and the control that prevents an unverified explanation from becoming an approved forecast, disclosure, journal proposal, or payment instruction.

Keep financial judgment outside generated output

A generated variance explanation or scenario narrative can help a reviewer navigate evidence. It cannot establish materiality, accounting treatment, forecast probability, control effectiveness, or transaction authority. Define which outputs are drafts, which require reconciliation, who can approve them, and where segregation of duties applies. The control conclusion should be tied to the actual finance process and configuration rather than a general statement that the organization follows a framework.

Make change and monitoring visible

Controls can weaken when a model, retrieval source, integration, prompt template, approval route, user population, or business process changes. Require an inventory of those dependencies, a named change owner, representative regression tests, exception monitoring, and a trigger for reopening the control assessment. Monitoring should distinguish usage from reliability: more generated output does not show that reviewers detected errors, resolved exceptions, or preserved a reconstructable decision record.

Write a CFO control conclusion

For each material use, record the financial objective, source systems, affected assertions or decisions, model and vendor dependencies, preventive and detective controls, reviewers, evidence retained, unresolved limitations, and next reassessment date. Label which facts come from COSO, which are internal design choices, and which were observed in testing. That record lets finance support a bounded use while refusing the broader claim that a policy, framework reference, or product feature proves operating effectiveness.

Turn this source into a reviewable decision

For AI for CFOs, use this briefing as a dated decision record rather than a substitute for the source. Preserve Committee of Sponsoring Organizations of the Treadway Commission, the exact URL, the July 24, 2026 review date, the supported facts above, the editorial interpretation, the limitations, and any buyer-specific evidence. Link that record to the decisions most directly affected: Internal control and audit evidence; Management reporting and external disclosure support; Planning and scenario analysis. State whether the source changes the scope, evidence requirement, control, sequence, or only the language used to describe the decision.

Before action, name the accountable owner, affected population and workflow, exact offering or configuration, source data and rights, human decision point, exception and appeal path, complete cost, expected benefit, failure and stop conditions, retained evidence, and next review date. Keep official facts, provider statements, buyer observations, representative tests, measured outcomes, editorial inferences, and unknowns visibly separate. Reopen the record when the source, offer, model, integration, data, policy, population, responsible person, or measured result changes.