AI in the close: a control checklist
The control points to put around any AI touching your month-end, forecast, or reporting workflow.
AI is already in your close, whether you sanctioned it or not. Someone on your team has pasted a reconciliation into a chatbot. A ban won’t fix that — it just pushes the tools underground. Control will: knowing where AI touches your numbers, and being able to sign your name to the result.
This is the checklist I’d walk before letting any AI near a month-end, a forecast, or anything a board, lender, or auditor will see.
↓ Download the PDF checklistPrint it. Walk it with your team.
01Know where it is
- Inventory every place AI touches the close, the forecast, or reporting — including the unofficial ones. A browser tab counts.
- Name one owner for each use. If nobody owns it, nobody controls it.
- Classify each use by where the output lands: the general ledger, the forecast, or something the board, a lender, or an auditor will read. Rigor scales with the landing spot.
02Control the inputs
- Document exactly what data each tool can read, and confirm it can't read more.
- No confidential financial data in consumer AI tools until data-retention and training settings are verified in writing.
- Reconcile source data before AI touches it. Bad data doesn't get better at machine speed — it multiplies.
03Draw the line between drafting and deciding
- AI drafts. A named human decides. Nothing posts to the general ledger without human approval.
- Keep the judgment calls human: estimates, accruals, reserves, revenue recognition, anything headed for a disclosure.
- The reviewer must be able to explain the number without the tool. If they can't, they're rubber-stamping.
04Review it like a new junior
- Every AI-produced output gets a named reviewer of record.
- Tie outputs back to source: reconciliations to the sub-ledger, forecast drivers to actuals.
- Keep sample-testing after trust builds. Models change underneath you, quietly.
05Keep the evidence
- Retain the prompt and the output for anything that lands in the financials.
- Log who ran it, who reviewed it, and what changed between draft and final.
- The test: if your auditor asked tomorrow how this number was produced, you can answer in one page.
06Separate the duties
- For material items, the person who runs the AI is not the person who approves the output.
- Treat AI-tool access like system access: provisioned, reviewed, and revoked when someone leaves.
07Manage the change
- Test model, prompt, or tool changes before they touch live close work.
- Re-validate after every vendor update. Behavior drifts, and vendors don't always announce it.
08Plan for wrong
- Set a materiality threshold for AI-assisted outputs, and a rule for what gets a second human check.
- Define the escalation path when an output looks off.
- Keep a fallback. The close still has to run the month the tool goes down.
One more thing
COSO published guidance in 2026 on internal control over the use of generative AI. If your company is heading toward a raise, a sale, or an audit, read it. The companies that put these controls in early will look institutional when someone finally looks closely. The rest will look improvised.
Controls are what let you move fast and still sign your name to the result.
Need this brought into your finance team or audit committee? Book a conversation or browse more from the library.
Companion pieces: An AI policy your audit committee can sign — the board-level template these controls sit inside — and The industrial-tech CFO primer.