Sooner or later this audit season, someone is going to say those words to your team, about a number an agent produced.
Funnily enough, the same worry arrives from the other side of the table all year round. Every room I present in, the first hand up on AI in finance asks, ‘what about the controls?’ Sometimes it’s the CFO. More often it’s the financial controller near the back, arms folded, who’s lived through a systems project before and can smell another one coming.
She and your auditor are circling the same thing: evidence. And they’re right to. Finance doesn’t get to shrug at a wrong number. So this issue is my honest answer to both of them, because I’ve come to believe the AI controls argument runs in exactly the opposite direction to the one most finance teams assume.
Walk one invoice down the line
Take a process every finance team on earth runs: purchase to pay. Break it into its actual steps and you’ll land somewhere around seven… requisition, purchase order, goods receipt, invoice capture, matching, approval, payment.
Now watch one invoice travel that line. At every step it passes through human hands. Keyed by a person. Matched by a person. Chased by a person. Approved by a person with forty unread emails and a board pack due Friday.
Seven steps, seven chances to be wrong. And the errors don’t wait politely at their own step. A mistyped PO at step two surfaces as a payment query at step seven, weeks later, with the trail gone cold. The risk compounds as the invoice moves down the chain.
We’ve collectively agreed to call that ‘strong controls’, because the hands are human and there’s a signature at the end.
The version that checks itself
Now run the same invoice through a properly built agentic process.
The agent does the step, then validates its own output before passing it on. It reconciles at every stage. It keeps a record of exactly what it checked, what it’s certain of and, the part I find most reassuring, what it’s not certain of. Anything below full confidence gets flagged and routed to a person. And at the end of the chain sits a named human, ruling on the exceptions and signing the lot off.
If you compare the two… One chain relies on seven busy people not having a bad Tuesday. The other validates every hand-off, writes down its workings as it goes, and hands a human a short exceptions list instead of a haystack.
When done right, the risks are actually lower and the controls are better. Which is the opposite of what most people think, but it only holds for the version built properly. More on that in a moment.
KPMG measured this in May
KPMG surveyed just over 1,000 senior finance leaders for their Global AI in Finance report, published 11 May. Active use of AI in finance has more than doubled in two years, from 30% to 75%. So the adoption argument is over. The interesting numbers are a few lines down…
Fewer than half of organisations, 42%, are fully assurance-ready for their AI-enabled finance processes… meaning they can produce audit evidence and explain how an output was produced. And only 29% track where their AI fails.
The gap shows up in results… Assurance-ready organisations report improvements in error reduction at more than five times the rate of everyone else, 33% against 6%, and they’re three times as confident about scaling what they’ve built, 42% against 14%.
These are bigger businesses than most of the mid-market, worth saying. But the pattern travels. The teams that built the evidence layer first are the teams getting the results.
What the auditor will actually ask
For UK finance teams this stops being theoretical about now. Year-end planning meetings. Interim testing. The audit partner asking what’s changed in the control environment since last year.
If you’ve automated anything in 2026, the question at the top of this page is coming.
A well-built agentic process answers it better than the manual one ever could. Every step logged. Every check recorded. Every exception traced to the human who ruled on it. Your auditor gets a complete trail instead of a sample and a prayer.
A badly built one… a bot taped over an undocumented process, no validation, no log, nobody’s name on the final layer… is precisely what the financial controller with the folded arms was worried about. She was right to ask. She was just aiming the worry at the technology, when the real variable is the build quality and the governance around it.
What stays human
The final layer is a person, with their name on it. The judgement calls on the exceptions the system wasn’t sure about. The conversation with the audit partner. The moment in the board meeting when someone challenges a number and the CFO stands behind it with evidence rather than optimism.
None of that is going anywhere. If anything the machine makes it more visible, because when the mechanical checking is handled, the human signature actually means something again.
‘No surprises’ is still the whole job.
What this means in practice
Four things to think about before year end…
Map one process end to end and count the human touchpoints. Purchase to pay is the classic. Most teams have never written theirs down, and the count is always higher than anyone guessed.
Put the audit question into every automation decision. Before anything goes live: could we show the auditor how this number was produced? If the answer’s no, it isn’t ready, however clever it is.
Name the human owner of the final layer before you build, not after. Validation at every stage, traceability throughout, and one person whose job is the exceptions list.
Start a failure log. Only 29% of organisations track where their AI goes wrong, which means most are flying without the one report that would earn an auditor’s trust fastest. Every flagged exception is evidence the controls are working.
Where this leaves you
The controls question deserves a better answer than reassurance. So the next time it comes up… from your FC, your audit partner, or the voice in the back of your own head… try answering with a walk-through. One invoice, every step, who touched it, what checked it, where the trail lives.
If the walk-through feels uncomfortable, its probably better to discover that now than in the year-end audit.
• •
If you’d like to think out loud about what properly controlled automation looks like in your finance team… which process to start with, what your auditor will want to see… drop me a note at [email protected].
We’ve built an expert team to help CFOs with their AI-enabled finance transformation (both the people and the machine underneath them), and I’m always happy to compare notes.
Thanks for reading,
Leo Hewett
