NIST's GenAI profile turns hallucination into a control-design problem

Translate risk into workflow

A finance control should not merely state that outputs may be wrong. It should specify which output, who reviews it, against what source, before which decision, and what happens when evidence conflicts.

Grounding is not approval

Retrieval from a policy library or ledger can reduce some errors but does not establish that the selected source is complete, effective-dated, or applicable to the transaction.

Measure the right population

Testing should sample realistic periods, entities, currencies, exceptions, and access roles. A polished demonstration on hand-selected questions is not an operating assessment.

Record the residual risk

After controls, document which mistakes remain possible, who can detect them, and whether the financial consequence fits the organization's risk appetite.

Turn this source into a reviewable decision

For AI for CFOs, use this briefing as a dated decision record rather than a substitute for the source. Preserve National Institute of Standards and Technology, the exact URL, the July 20, 2026 review date, the supported facts above, the editorial interpretation, the limitations, and any buyer-specific evidence. Link that record to the decisions most directly affected: Planning and scenario analysis; Close, reconciliation, and variance investigation; Cash visibility and liquidity decisions; Working-capital exception management. State whether the source changes the scope, evidence requirement, control, sequence, or only the language used to describe the decision.

Before action, name the accountable owner, affected population and workflow, exact offering or configuration, source data and rights, human decision point, exception and appeal path, complete cost, expected benefit, failure and stop conditions, retained evidence, and next review date. Keep official facts, provider statements, buyer observations, representative tests, measured outcomes, editorial inferences, and unknowns visibly separate. Reopen the record when the source, offer, model, integration, data, policy, population, responsible person, or measured result changes.