What does COSO's generative AI guidance require of finance teams?

It applies the existing COSO 2013 internal control components to generative AI rather than creating a separate framework. For finance teams that means scoping AI-assisted outputs into ICFR, assessing AI-specific risks such as fabricated figures and undisclosed model change, designing preventive and detective controls at the point the number is produced, retaining traceable evidence, and monitoring exceptions, overrides, changes, and access.

Are AI prompts and model versions subject to SOX change management?

Treat them as such. A prompt, model, mapping, or driver change alters how a control operates, so it belongs under change management with approval, effective dating, and retained history. Without effective dating you cannot reproduce a prior period under the logic that was live at the time, and reperformance testing fails.

What must model lineage contain to satisfy an auditor?

Source system and object key with extraction timestamp, validation results, the declared formula and calculation trace, model and prompt versions, effective-dated mapping and driver versions, the assumption snapshot, exceptions raised and their disposition, and the reviewer's identity, decision, and timestamp — enough to reproduce a figure selected months later without consulting the people involved.

Can generative AI steps be relied on as automated controls?

No, because they are non-deterministic and reperformance is the basis of that reliance. Keep arithmetic in a deterministic calculation layer that can be tested as an application control, and treat generated narrative as a preparer's draft subject to a management review control.

How do we scope AI-assisted processes into ICFR?

Scope by output rather than by tool. If an output feeds a journal entry, an account balance, a disclosure, or a management review control, it is in scope regardless of what the tool is called. Maintain a workflow register recording the accounts and assertions affected, the systems involved, the accountable owner, and the permitted use of each output.

COSO's GenAI Guidance in Practice: Controls, Lineage, and Audit Trail

Home Technology Telecommunications Insurance Finance Silent Margin Killers in Insurance Careers Security Blog Pricing About Interview AI Analyst Agile Financial Planning AI Digital Workers Detect Problems FP&A Trends 2026 CFOs Replacing Headcount Hidden Cost of Manual BVA Shared Spaces and Collaboration Security by Design Building a Culture of Privacy What Is Customer Service Autonomous Month-End Close AI Governance in Finance Rolling Forecasts vs Static Budgets Business Case for AI in FP&A AI Agents in Finance Octopus AI in Calcalist Introducing Workflow Builder MCP Security Risks CFO Guide Workflow Builder for Insurance OpenAI Industrial Policy CFO Guide Agentic AI Finance Adoption Gap For FP&A Leaders For Accounting Leaders For CFOs Partners Newsletter Trust Center Book a Demo LinkedIn Privacy Policy Terms of Service Cookie Policy Acceptable Use Policy Disclaimer