The AICPA Just Published AI Audit Guidance. Finance Might Want to Check Who’s Responsible for the Numbers.

The AICPA has published new guidance on artificial intelligence in financial statement audits, which means Finance has officially entered the stage of AI adoption where someone asks to see the documentation.

I realize this may interrupt the celebration. We were having such a lovely time watching software write variance commentary, summarize contracts and produce forecasts in seconds. Now someone wants to know where the data came from, which assumptions changed and who reviewed the answer.

How unreasonable. Next they’ll ask whether the number is correct.

On October 13, 2026, the American Institute of CPAs announced its new Artificial Intelligence (AI) Considerations for Financial Statement Auditors practice aid. It addresses two sides of the audit: companies using AI in financial reporting or controls, and auditors using AI tools in their own procedures.

The guidance is nonauthoritative. It is not a new accounting standard, and it does not mean every AI-assisted forecast automatically becomes an audited financial statement. The AICPA also says further guidance is planned.

But I think the implications for finance leaders are already obvious. If AI is becoming part of how financial information is prepared, we need to be able to explain the process and defend the output.

Because when the numbers are wrong, the chatbot will not be attending the audit committee meeting.

This Is an Audit Story, but It Is Also a CFO Story

The AICPA’s announcement explains that auditors need to understand whether and how companies use AI in financial reporting, how that use affects risk assessment and which controls matter.

That sounds like an auditor’s problem until you consider who owns the processes being examined.

If Finance uses AI to categorize transactions, draft journal-entry support, estimate accruals or analyze exceptions, the output may influence the financial statements. If a sales system uses AI to classify customer arrangements, it could indirectly affect the information that flows into accounting.

The audit team cannot assess a process that management itself cannot describe. At least, not without creating the kind of suspense nobody wants during year-end close.

I would ask the CFO and controller a simple question: which material financial reporting processes now rely on AI, directly or indirectly?

If the answer is “we think a few teams are experimenting,” that’s not an inventory. That’s a rumor.

And if the answer is “our vendor handles it,” we need another conversation. Outsourcing a process does not outsource management’s responsibility for its financial reporting.

The AICPA Did Not Say the Robot Can Sign the Audit Opinion

The new practice aid also addresses how audit firms use AI in their engagements. The AICPA emphasizes planning, quality management, supervision, appropriate use of approved tools and professional judgment.

Jennifer Burns, the AICPA’s chief auditor, makes the central accountability point: the auditor remains responsible for the audit and its opinion.

That distinction matters. AI can help auditors identify anomalies, analyze documents or organize evidence. It does not transfer professional responsibility from the engagement team to a software vendor.

The same principle should guide corporate Finance. Technology may prepare the analysis, but an accountable person still needs to understand what was done and whether the result is reliable.

I’m enthusiastic about tools that remove repetitive work. I am considerably less enthusiastic about the sentence, “The system said it was fine.”

That’s not a control. It’s the opening line of a very expensive meeting.

First, Find the AI Before You Try to Control It

I would start with a practical inventory, not a policy presentation.

List the AI-assisted workflows touching the close, financial reporting, revenue processes, procurement, payroll, estimates, reconciliations and management reporting. Include tools embedded in existing software as well as standalone assistants.

For each workflow, document the business owner, technology owner, data sources, output, intended use, downstream systems, materiality and current review controls.

The important distinction is between a tool that helps someone draft an internal presentation and one whose output changes a journal entry, accounting estimate or financial disclosure. They don’t require identical controls.

I’d also ask where employees have built unofficial workflows. Not because everyone is doing something wrong, but because the most useful automation often starts with one analyst who got tired of doing the same task every Thursday.

Congratulations to that analyst. Also, please tell us where the workflow lives.

A good inventory helps us preserve the productivity benefit while understanding the risk. The objective isn’t to ban useful tools. It’s to stop being surprised by the tools we’re already using.

The Data Problem Arrives Before the Model Problem

The AICPA specifically highlights data quantity, quality, accuracy, completeness, relevance and diversity as factors affecting AI reliability.

I would put data lineage near the top of the control agenda. What source systems feed the tool? Are the fields defined consistently? Are records complete? When is the data refreshed? Who can modify it?

Suppose an AI system produces an accounts-receivable aging analysis. The explanation is coherent and the tables look excellent. But one subsidiary’s receivables were omitted because its export format changed.

The AI may produce a beautifully reasoned answer about an incomplete population. The grammar is not going to save us.

I’d require population checks, reconciliations to controlled totals and documented exception handling before relying on material outputs.

And I’d be especially careful when data from different departments uses the same term to mean different things. “Active customer” is a familiar offender. So is “bookings.” Revenue itself can be surprisingly creative once three systems and a sales compensation plan get involved.

AI can accelerate analysis. It cannot make inconsistent definitions magically agree merely because we ask politely.

A Confident Explanation Is Not Audit Evidence

Generative AI is particularly good at producing explanations that sound finished.

That creates a subtle risk for FP&A. An analyst asks why margin fell, receives a plausible narrative and inserts it into a management report. The paragraph may even include three convincing drivers.

But what if the model invented the causal relationship? What if it confused correlation with causation? What if the source data doesn’t reconcile?

For a material explanation, I’d require traceability to supporting records and a clear distinction between observed facts and hypotheses.

If the report says lower margin came from discounting, show the realized-price bridge. If it says freight costs increased, show the cost data. If it says volume caused the movement, reconcile the unit counts.

This isn’t an argument that every internal forecast note needs the same documentation as an audited disclosure. Controls should be proportionate to risk.

It is an argument that a polished paragraph should not outrank evidence.

The machine can be confident. Finance needs to be correct—or at least transparent about what it knows and what it is still testing.

Let’s Put a Dollar Value on One Bad Assumption

Consider a hypothetical business with $200 million in annual revenue and a 30% gross margin. Gross profit is $60 million.

Now imagine an AI-assisted classification process incorrectly treats $3 million of costs that belong in cost of revenue as operating expenses. Total operating profit may not change from that reclassification alone, but reported gross profit rises to $63 million and gross margin appears to improve from 30% to 31.5%.

That’s a 150-basis-point change in a metric executives, lenders and investors may watch closely.

The mistake can also distort product economics and management decisions. A business leader may believe unit margins are improving when the costs have simply moved to a different line.

This is an illustration, not a claim about a real company or a conclusion about materiality. Materiality depends on the circumstances, and classification consequences depend on the applicable reporting framework.

My point is simpler: an AI error doesn’t need to change total profit to matter.

Sometimes it only needs to put the right expense in the wrong place and wait for management to celebrate.

The Model Changed. Did Anyone Tell the Controller?

One challenge with AI-assisted workflows is change management. A vendor may update a model, a prompt may change, a retrieval source may be replaced or an employee may adjust a rule that influences outputs.

Traditional financial controls already recognize that changes to systems and calculations can affect reporting. AI introduces additional ways for behavior to change without an obvious formula edit.

I’d document which model or service is used, what the workflow is designed to do, which configurations matter and how changes are approved and tested.

For high-risk use cases, I would preserve test cases and expected outcomes. When something changes, rerun the tests. Keep a record of exceptions and sign-offs.

The control doesn’t have to be theatrical. We do not need a twelve-person steering committee to change a prompt that drafts a meeting summary.

But a workflow influencing a material accrual should not quietly change its behavior because someone decided the output sounded better with a different instruction.

In Finance, “it looked nicer” has never been a sufficient change-control memo.

Human Review Must Be More Than Clicking Approve

A common AI control proposal is to keep a human in the loop. That sounds reassuring, but it leaves out an important question: what is the human actually checking?

If an analyst reviews 800 AI-classified transactions in five minutes, the control may exist on paper without providing much protection.

I’d define the review objective. Are we checking completeness, accuracy, classification, unusual items, source reconciliation or the reasonableness of an estimate?

Then design the review to address that risk. Some outputs need full reconciliation. Others may justify risk-based sampling, thresholds, independent calculations or escalation of exceptions.

Reviewers need enough knowledge and time to challenge the result. They also need access to the underlying evidence.

A human who doesn’t understand the process is not an effective control simply because the workflow diagram contains a box labeled “Human Approval.”

That’s a very expensive decorative box.

FP&A Has a Different Risk Profile, but Not a Free Pass

Not every AI-assisted FP&A process affects audited financial statements. A scenario model used for internal planning is different from a system preparing financial statement amounts.

That distinction should remain clear. I don’t want to apply audit-level procedures to every exploratory analysis. We’d spend so much time documenting the work that we’d lose the benefit of automating it.

But FP&A outputs still influence important decisions: hiring, pricing, capital allocation, liquidity and investor communications.

For material management decisions, I’d want a proportionate governance framework: controlled source data, explicit assumptions, scenario validation, ownership and documented review.

If AI generates a forecast that drives a $10 million investment, the finance team should be able to explain its major drivers and limitations.

I made a related point in my discussion of AWS replacing an 18-tab pricing model with a conversational interface: a more convenient interface is not automatically a stronger control environment.

The standard of evidence may differ by use case. The need for judgment does not disappear.

The Vendor’s SOC Report Is Not a Magic Amulet

I would also review where third-party tools and service providers enter the process.

Does the vendor have access to sensitive financial data? Where is information stored? Which subprocessors are involved? What assurances are available about security, availability and relevant controls?

A SOC report can be useful, but it is not a blanket guarantee that every AI workflow is accurate or appropriate for our purpose. We need to understand its scope, period, exceptions and any controls the customer must operate.

If the vendor changes its product, we need to know whether the change affects our process. If data is retained or used in ways we haven’t approved, that creates a different kind of risk.

I’d involve IT, security, legal and accounting as appropriate, rather than asking an FP&A analyst to solve enterprise data governance alone.

The analyst already has enough on their plate. They were promised automation would reduce their workload, not make them the unofficial Chief Risk Officer of Prompt Engineering.

The Auditor’s Questions Are Worth Asking Before the Audit

The AICPA’s announcement is a useful prompt for management to ask questions before an audit team does.

Where does AI affect financial reporting? What risks does it introduce? What controls address those risks? Who has the skills to evaluate the system? How do we know the outputs are complete and accurate?

I’d translate those into a practical readiness exercise.

Choose a material AI-assisted process and walk it from source data to final output. Identify the owners, inputs, transformations, approvals and downstream uses. Show the evidence that the controls operated.

Then deliberately test exceptions. Missing data. A duplicated transaction. A source file with an unexpected format. A conflicting customer classification. An unsupported narrative.

If the process handles those cases correctly, wonderful. If it doesn’t, we’ve learned something while there is still time to fix it.

That’s much better than discovering the issue during the close, when everyone is already running on caffeine and the belief that the next reconciliation will be the last.

A 90-Day AI Control Plan I’d Actually Support

During the first 30 days, inventory AI use cases in Finance and adjacent processes. Rank them by their potential impact on financial reporting, cash decisions, sensitive information and control effectiveness.

Don’t start with an enterprise-wide ban. Start with visibility.

In days 31 through 60, select the highest-risk workflows for control mapping. Confirm data sources, access rights, validation, change management, reviewer responsibilities and evidence retention. Run tests using normal and exception cases.

Where controls are missing, establish compensating reviews or pause high-risk use until the process is ready. The response should be proportionate to the exposure.

In days 61 through 90, formalize ownership, training, escalation and periodic reassessment. Update policies where needed and involve internal audit or external advisers as appropriate.

I’d measure completion of the inventory, control gaps resolved, exceptions detected, reviewer competence and changes tested—not simply the number of employees who completed an AI awareness webinar.

A webinar is not a control. Neither is a slide with a shield icon.

I want a process that can explain how a material number was produced and why management believes it.

Don’t Confuse an AI Policy With an AI Operating Model

Many organizations can produce an AI policy relatively quickly. It says employees should use approved tools, protect confidential information and review outputs.

Fine. That’s a start.

But who approves a new finance use case? Who maintains the data definitions? Who validates the outputs? Who decides when a workflow has changed enough to require retesting? Who investigates an error?

Those are operating-model questions. They need named owners, not just a document on the intranet.

I’d give Finance accountability for the business use and financial consequences, IT responsibility for relevant technical controls, security responsibility for data protection and independent assurance functions appropriate roles in oversight.

The exact division depends on the organization. What matters is that responsibility is explicit and understood.

A policy that says “use AI responsibly” without defining the work is a bit like a budget that says “grow profitably.” Inspiring. Not terribly operational.

The Cost of Controls Belongs in the AI Business Case

There’s also an FP&A question here that I don’t want to lose: how much does responsible AI adoption actually cost?

A business case may include software subscriptions and the labor hours a tool is expected to save. It may omit implementation, data remediation, access controls, testing, review, monitoring, training and ongoing change management.

Those costs are not evidence that the project is bad. They are part of what it takes to operate it responsibly.

Imagine a hypothetical tool saves 4,000 analyst hours annually. At a loaded labor cost of $75 per hour, that’s $300,000 of theoretical capacity value.

Now suppose annual licensing and infrastructure cost $90,000, and controls, training and oversight consume another $80,000. The simple residual capacity value is $130,000 before implementation costs.

And that $130,000 is not automatically cash savings. If headcount doesn’t change, the benefit must come from redeploying time to productive work.

I want to see the full economics, including the control environment. Otherwise the business case has the familiar problem of being highly accurate about the costs it remembered to include.

We’ve all met that model. It usually has an impressive cover page.

Professional Skepticism Is a Skill We Still Have to Teach

The AICPA’s announcement mentions the need for audit teams to combine audit knowledge, AI skills, data capabilities, skepticism and specialist support.

I think Finance faces a parallel challenge. Junior analysts need to learn how to question an answer, not just how to produce one.

If the system reconciles the account, does the analyst understand what a valid reconciliation looks like? If it drafts the variance explanation, can they distinguish a supported cause from a plausible guess?

If the tool identifies an anomaly, can they decide whether it matters financially?

This connects to my concern about who trains the next generation of finance leaders. We can automate the tedious steps without removing the opportunity to learn how the business works.

In fact, we can create better assignments: investigate exceptions, validate model outputs, trace assumptions and explain competing interpretations.

What we can’t do is replace learning with a button labeled “Looks Good.”

That would produce a very efficient pipeline of people who can approve numbers they don’t understand.

The AICPA’s Guidance Is a Beginning, Not a Finish Line

It’s important not to overstate what was published. The October 2026 practice aid is nonauthoritative guidance for financial statement auditors, and the AICPA says it expects to expand parts of it, including material on risks of material misstatement and evaluating audit evidence.

It doesn’t prescribe one universal AI control checklist for every company. It doesn’t mean every finance workflow needs the same testing. And it doesn’t remove the need to apply existing professional standards and judgment.

I would use it as a signal to examine our own processes, not as an excuse to announce a new compliance regime that hasn’t actually been issued.

The central question is whether we can explain and support the information our systems produce.

That question was important before generative AI. It’s more urgent now because producing convincing analysis has become so much easier.

Speed is a wonderful capability. It is not a substitute for accountability.

When the Numbers Are Wrong, the Chatbot Won’t Be in the Room

I’m not interested in turning AI governance into an argument against automation. I want Finance to use better tools. I want analysts spending less time copying data and more time understanding the business.

But I also want to know who owns the workflow, what data it uses, how its output is validated and what happens when it fails.

I want a CFO who can explain the major assumptions behind a material number, a controller who can trace the reporting process and an audit team that can evaluate the evidence.

The AICPA’s new guidance is a timely reminder that better technology changes how we do the work. It doesn’t make responsibility disappear.

So by all means, let the AI draft the analysis, find anomalies and help prepare the support.

Just make sure someone can answer the follow-up questions.

Because the audit committee isn’t going to accept, “We asked the chatbot, and it seemed very confident.”

Not even if the answer was formatted beautifully.