AI in the Month-End Close: Is It Reliance or Not?

Somewhere in your close, AI is probably already helping: matching a bank rec, explaining a flux, drafting the variance commentary, pulling fields out of vendor invoices. Usually nobody decided that; someone just tried it. The question your auditors will ask is not whether you use AI. It's whether anyone relied on it.

COSO's February 2026 publication, Achieving Effective Internal Control Over Generative AI, gives controllers a working definition to sort that out. It is guidance, not a mandate, but COSO's framework is the one most ICFR programs are built on, so its framing is a good indication of how this will be discussed in your next audit.

The line COSO draws

COSO adopts this definition: "reliance occurs when management depends on outputs generated by an AI system as part of the evidence supporting an ICFR control's design or operating effectiveness." It gives a pair of examples that every controller should read:

• Reliance: "AI automatically matches journal entries to supporting documentation, and management reviews and approves the posting using only the AI output."
• Non-reliance: "AI suggests matches, but a control owner re-performs the match on all or a sample of items and documents their review and approval."

The difference isn't the tool. It's whether a person's independent work, rather than the AI's output, is the evidence the control rests on.

If it's reliance, the evidence bar is ICFR's

COSO says that when reliance exists, AI control patterns "should meet the same evidence standards expected for ICFR," including:

• "Documented prompt, configuration, and model version"
• "Clear sampling rationale and exception resolution"
• "Retention of sufficient evidence to support the design and operation of controls"

For non-reliance cases, COSO says "evidence expectations may be proportionately lower." That gives most mid-market finance teams a practical choice for each task: either keep it non-reliance by re-performing and documenting the review, or treat it as reliance and capture the prompt, the model version and the output as evidence.

The second option is close to impossible on a personal ChatGPT or Claude account. The firm has no admin console, no retention setting and no way to produce the record later. That's the finance argument for moving the team onto a business tier, even before the data-protection argument. See what IT does first.

Sorting your close tasks

The last row comes from COSO's focus areas. For "Judgment, forecasting and insight generation," it says to "Require citations for all material outputs" and to "perform hindsight analysis of forecasts against actual results."

Start with the inventory, including shadow AI

COSO's implementation steps begin with an inventory of generative AI use cases, and it is explicit that this "includes periodic scans or surveys to detect 'shadow AI' use." For each use case it wants a capability type, an owner, and attributes such as data sources, the model used and criticality.

For a finance team, that's a one-afternoon exercise: a short survey of who uses which AI tool for which close task, on which account. IT can add the discovery data (which AI sites are visited from finance devices), and your expense reports will show any personal AI subscriptions being reimbursed. Put the results in the table above and you have the start of a defensible position.

Ownership and segregation of duties

COSO's control-environment section is direct: "Clear ownership of AI systems is essential." Each tool or use case needs a named owner. PCAOB staff raised a related point in a July 2024 Spotlight: some firms told them that generative AI used by preparers could amplify existing IT risks, including those related to segregation of duties. That is a staff publication of observations, not a standard. In practice, the person who prompts the AI shouldn't be the person who approves what it produced.

What to do this quarter

1. Run the inventory: tasks, tools, accounts, owners.
2. Label each task reliance or non-reliance, and decide which ones you want to keep non-reliance.
3. For non-reliance tasks, make sure the reviewer's re-performance is documented on the workpaper.
4. For any reliance task, move it onto a business-tier tool where prompts, outputs and versions can be retained.
5. Share the list with your auditors before they ask.

Our first controller post covers the broader questions about data and accounts. If you want the inventory and the tool setup done with you, that's our AI usage review. For firms without anyone in a security-leadership role to own AI risk, see our virtual CISO engagement. This is operational and technical guidance, not accounting, audit or legal advice.