AI in the Finance Team: A Controller's Questions

Ask your team, informally, whether anyone has used ChatGPT or Claude to explain a variance, draft month-end commentary, write an Excel formula or tidy a reconciliation. In most finance departments the answer is yes, and it happened without anyone deciding it should. That's normal: spreadsheets, email and mobile banking all came into finance the same way. Now the controller has to answer for it.

This post is for the controller who is not trying to stop AI, just trying to make sure it doesn't undermine the close, the audit or the firm's data. It sits alongside our IT-side guide: Staff already use ChatGPT or Claude? What IT does first.

Four questions to ask this month

1. Where does AI already touch our numbers?

Build an inventory before a policy. For each person on the team, note the tool, the account (personal or company), and the task. Then sort the tasks by how close they sit to the financial statements:

• Low: rewording an email, explaining an accounting standard, writing a formula you then test.
• Medium: drafting variance or flux commentary, summarizing a contract for revenue recognition.
• High: anything whose output becomes a number, a reconciling item, a disclosure or a journal entry.

COSO's February 2026 guidance takes a similar approach. Its release says generative AI use cases are organized "into eight capability types—ingestion, transformation, posting, orchestration, judgment, monitoring, regulatory intelligence, and human‑AI interaction," each with its own control considerations. "Posting" and "judgment" are the ones that matter most for the close.

2. Whose account is the data going into?

A personal ChatGPT or Claude account is a contract between your employee and the vendor. The firm cannot see it, retain it, or delete it when the person leaves. Consumer plans also handle training differently: OpenAI says data sharing for training is on by default for ChatGPT Free, Plus and Pro, and Anthropic made training a user setting for Claude's consumer plans in 2025. Customer lists, payroll, pricing and unreleased results should not be in any of them.

The fix is to move the team onto a business tier the firm controls, with single sign-on and an admin. Which vendor matters less than whether people will actually use it. Claude Team or Enterprise, ChatGPT Business or Enterprise, and Microsoft Copilot all qualify. Many Microsoft 365 firms also have Copilot Chat available without an extra license; staff have to sign in with their work account for Microsoft's enterprise data protection to apply.

One quick signal sits in your own ledger: personal ChatGPT Plus or Claude Pro subscriptions coming through expense reports. They show you where AI is in use, and you can stop reimbursing them once the company tool is live.

3. How do we know a person reviewed it?

This is the internal-control question that matters most. Generative AI can produce a plausible reconciliation explanation that is simply wrong. COSO's chair put it this way in the guidance's release: "GenAI can be confidently wrong, easily manipulated, or deployed outside formal oversight channels."

PCAOB staff made a related point in their July 2024 Spotlight on generative AI: the preparers they spoke with stressed that people still need to supervise how generative AI is used and review what it produces. Some firms told staff that preparer use of generative AI could amplify existing IT risks, including segregation of duties. That is a staff publication of observations, not a standard, but it is the question your auditors will ask.

Practical controls that don't need new software:

• For high-tier tasks, the preparer notes on the workpaper that AI was used and for what.
• The reviewer re-performs or traces AI-assisted figures to source, the same as any other preparer's work.
• AI is never the approver. A person signs off, and that person is not the one who prompted the AI.
• Prompts and outputs that support a material figure are kept with the workpaper. That's easier on a business tier with admin retention than on a personal account.

4. What will our auditors and regulators expect?

There are no AI-specific rules for financial reporting to point to yet. According to Thomson Reuters' report of a June 4, 2026 conference, Michal Dusza, a deputy chief accountant in the SEC's Office of the Chief Accountant, said it would be hard to create "something that is prescriptive or definitive" given the pace of change, and that the office might issue reminders. He also raised the issue this post is about: "That lower barrier to entry, and this sort of citizen-led innovation, how frequently do we update our risk assessment? How much do we understand about AI that may be proliferating throughout our business and financial reporting processes?"

So expect auditors to ask what you know about AI in your processes, not to apply a rulebook. A controller who has the inventory from question 1 and the review evidence from question 3 can answer. For how COSO separates AI reliance from review, and what evidence each needs, see AI in the month-end close: is it reliance or not?

What to hand IT

Finance decides which tasks AI may touch and how its output is reviewed. IT makes the tool and the boundaries real: discovery of what's in use, a sanctioned tool with single sign-on, and data-loss controls that stop financial data going into unsanctioned AI sites. The technical steps are in our IT-side guide.

Our AI usage review covers both halves: what is in use, what data is exposed, the written rules, and the setup of whichever tool your team prefers. We work alongside your auditors and counsel. If the firm has no one in a security-leadership role to own AI risk alongside you, our virtual CISO engagement covers that on a fixed scope. This is operational and technical guidance, not accounting, audit or legal advice.