Points to Settle Before Using AI in Accounting

01The operating team does not make this call

Internal control is evaluated on both design and operation. The question is not only whether transactions are processed correctly, but whether the mechanism was designed appropriately and is operating as intended. That assessment sits with the audit firm or internal audit function; it is not something an operating team can conclude on its own.

For that reason, satisfying the points below does not establish that a given design is acceptable. They are simply the areas most often examined. What is actually permitted depends on your overall control environment and on your auditors' judgment.

The value of settling these points early shows up in what the actual deficiencies look like. Tokyo Shoko Research's survey of disclosed internal control deficiencies among all listed Japanese companies for FY2025 (published 14 May 2026) counted 41 companies and 42 cases. Fifteen of those 41 named a shortage of staff, or insufficient knowledge among the people assigned, as a cause. When a team is already short-handed, the strain tends to surface on the control side first.

02Decide where approval sits

Decide who approves the AI output before operation begins. Starting without a named approver means reconstructing accountability afterwards, which slows the review considerably. A practical rule is to look at who finalised the transaction before AI was involved. The person with authority to post the entry is usually the natural approver for the AI's proposal as well.

Be explicit about what is being approved. Accepting a suggestion as-is and accepting it after correction carry different meanings. Keeping both in the record makes the history traceable. Deleting rejected proposals has the same effect as overwriting, so keep those too.

• Name the approver before go-live, down to role and person
• Distinguish acceptance from acceptance-after-correction
• Keep rejected proposals with a reason
• Keep the fact of approval in the record

03Whether approval happens in substance

A record of approval may still be assessed as not functioning if the approver could not actually examine what they were approving. Check whether the basis for the conclusion is visible to the person signing off.

If an AI proposes an account classification, for example, what the approver can verify differs depending on whether the underlying transaction detail and comparable prior treatments are presented alongside the suggestion.

Adding more approvals does not automatically make the process safer. In a study where 27 radiologists read 50 mammography cases with AI suggestions attached (Dratsch T et al., Radiology, 2 May 2023, DOI 10.1148/radiol.222176), accuracy among the least experienced group fell from 79.7% to 19.8% when the AI suggestion was wrong. Even the most experienced group, averaging 10.8 years, fell from 82.3% to 45.5%. It is a clinical experiment and does not transfer directly to accounting work. Still, the pattern is worth holding in mind when designing approvals: as the number of items to check grows, each individual check gets thinner.

In practice, check whether the volume fits inside the time an approver actually has, with room to open the basis of each item. If it does not, consider varying the depth of review by amount or by supplier, and make that split itself a topic for the auditors.

Whether the information is sufficient is best confirmed with the person who will actually approve. Their read is usually more accurate than what the design assumes. The table below is a quick way to review the approval and record design.

04Why controls fail even with an AI policy

An approval step can exist while approvers sign off without reviewing the content. The same pattern appears in AI use. A company may have an AI policy, yet not everyone knows which information must not be entered into AI tools. When the policy is revised, teams lack the time to catch up.

Reactions then split. Some people enter information that should never go into an AI tool. Others avoid AI altogether because they fear the risk. Still others use AI tools the company has not approved, which is known as shadow AI. Each reaction shows that a policy that exists only as a document does not create control.

The strength of controls also needs balance. Controls that are too strict slow the work down and end up being bypassed. A practical approach is to put operational efficiency and improvement first, and add only the minimum controls needed to ensure the accuracy, completeness, and validity that disclosure rules and regulations require.

05Whether it can be reconstructed later

Being able to reconstruct the basis of a decision is a frequent point of examination. Check whether it is possible to follow, in sequence, what data was referenced, what the system produced, and how a person judged it.

If the AI output is overwritten on save, the original suggestion disappears. Holding the before and after separately makes the reasoning far easier to explain. Splitting the record into four parts (input data, AI output, the human decision, and the corrected content with its reason) also makes it easier to walk the auditors through.

Records matter because noticing in the moment is not something to rely on. In a study where over 100 participants worked alongside an AI agent for roughly five hours (Ye J et al., arXiv:2606.05647, 4 June 2026), 94% failed to detect problems the agent had deliberately introduced. Even when given a monitoring tool, 56% ignored its warnings and accepted the output anyway. A record you can trace afterwards is the only handle you have when nobody caught it at the time.

• Hold referenced data, output, and human judgment separately
• Do not overwrite; keep both states
• Record who decided and when
• Make the sequence followable

06Whether behavioural change is visible

AI behaviour can shift when a model is updated or a setting is changed. If the fact and timing of such changes are not recorded, it becomes impossible to explain why results differ from a certain point onward. Rewriting the instructions given to the AI counts as a change too.

Managing these changes usually maps onto existing system change control. Where an internal precedent exists, aligning with it is the faster route. Decide as well how you will compare results before and after a change. Fixing a set of sample items drawn from past processing, and rerunning them whenever something changes, gives the team a routine way to notice a shift in behaviour.

07A worksheet you can copy

This template puts the four points on a single page you can take into the conversation. Any field you cannot fill becomes a question for the auditors. Leaving it blank and asking is faster than filling it with a guess.

Cover one process per sheet. Approvers and record locations differ between processes, and combining them makes the entries vague.

08Filled example: invoice account classification

The following is a fictional example. It assumes an AI proposes the account and tax category for incoming supplier invoices, and an accounting supervisor approves before the entry is posted. The volumes and sample sizes only illustrate how to fill the sheet; they are not figures from any real company.

Note that the sheet states what the AI does not do before anything else, and that rejected proposals are kept rather than deleted. Section 5 lists only the points the operating team cannot decide alone.

09How to bring it to the conversation

With those four points settled, take it to your audit firm or internal audit function. Asking whether AI is permitted tends to stall. Presenting a specific scope, a defined approval point, and a stated record-keeping approach moves the review forward.

The design may well be adjusted as a result. Adjusting before go-live costs far less than being told after the process is running. Where AI adoption stalls on control grounds, the cause is usually not risk. It is that the material needed for a decision was never assembled.

Which areas draw the most scrutiny can be inferred from how disclosed deficiencies break down. In the Tokyo Shoko Research survey cited above, 21 of the 42 cases (50.0%) concerned the closing and financial reporting process, followed by 19 cases (45.2%) of company-level internal control. Deficiencies in business processes accounted for 2 cases (4.8%). If your change touches the closing process, preparing material with that distribution in mind moves the conversation along faster.

You can hand the completed worksheet to an AI to draft the memo. If you do, keep any language that judges control adequacy out of it. If you first need to decide how to carve out the process itself, see how to run a business process inventory and the roadmap for reducing key-person dependency in accounting.

You are assisting a person responsible for internal control in the accounting function of a listed company.
Using the "AI use: control worksheet" below, draft a memo to send to our audit firm or internal audit function.

Requirements:
- In the first three lines, state the target process, what the AI does, and what we want to discuss
- Use three headings: approval, records, change control. Use only what is written in the worksheet
- Do not fill gaps. Mark anything missing as "not entered" and list those items at the end
- Do not use language that judges control adequacy (e.g. "no issue", "appropriate")
- Keep it to roughly one A4 page

Worksheet:
(paste the completed worksheet here)