AI in finance and accounting
Principle 13 is short, and its short name carries the whole of it: an organisation uses relevant, quality information to support the functioning of internal control. The moment a model-produced figure feeds a variance analysis, a provision, or a forecast a control depends on, that figure is control information — and nobody in the process has been asked where it came from.
§ 1In practice
Principle 13 sits in the Information and Communication component of COSO’s Internal Control — Integrated Framework. The Framework is a purchased document, and its principle text and points of focus are not reproduced here; the principle number and its short name are the citation, and the reasoning below is ours. What the principle establishes is that internal control runs on information, and that the information has to be relevant to the control and of sufficient quality for it. None of this binds anyone. COSO is a private-sector initiative sponsored by five accounting and auditing bodies, it enforces nothing, and departing from the Framework carries no consequence. It matters because it is the description of internal control that management, boards and auditors already share.
The difficulty a model introduces is that quality has always been assessed through provenance. A figure in the ledger traces to a posting, a posting to a document, a document to a transaction, and that chain is why anyone trusts the number. A model output has no such chain. It has an input set, a configuration and a version — a different thing, answering what produced this rather than what this is derived from. Where the output extracts or summarises documents the organisation holds, the chain can be rebuilt by pointing back at them. Where it is a generated estimate, it cannot, and the honest artefact is an assumption schedule separating what the model produced from what management set — which is what preparing information with AI assistance demands of the accountant whose name is on the analysis.
Relevance is the limb that fails quietly in planning and analysis work, and it fails in a way that looks like success. A model asked to explain a variance will produce an explanation; it will produce one whether or not the drivers are present in the data it was given, because producing a plausible account is what it does. The output is then relevant-looking information about something the organisation cares about, and it is unsourced. The test worth applying is blunt: for each assertion in the analysis, what would have to be true, and can that be seen in the underlying data. Anything failing it is commentary, and commentary that has entered a control is the specific harm this principle is about.
There is a second-order problem the Framework’s structure makes visible. Information used in internal control has to remain available for as long as the control is evidenced, and a model output means little without what produced it. Retaining the figure and discarding the input set, the configuration and the version leaves a number nobody can stand behind six months later. This is where the reliance determination does real work: where a person re-performed the analysis, the retained evidence is that person’s work and the model’s provenance matters less; where nobody did, the model’s provenance is the only evidence there is, and it is usually the part that was not kept.
§ 2What discharges it
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
What the model was given, not a description of it. A commentary kept without the pack it was produced from cannot be reproduced, and reproduction is the only test of provenance available.
02
Each figure in a model-produced analysis traced to a line in the underlying data, by the person whose name is on the analysis. Twenty minutes of work, and the artefact that most often does not exist.
03
For a forward-looking figure, what the model generated and what management set. Merged, the two acquire each other’s authority — judgement starts to look derived, and output starts to look decided.
04
Held with the working file rather than in a supplier log nobody can reach. Provenance stored somewhere else expires with the subscription.
05
For each assertion, what would have to be true and whether it is visible in the data supplied. Anything that fails should be labelled commentary rather than quietly deleted.
06
Confirmation that inputs, configuration and version are held as long as the control is evidenced. Outputs routinely outlive the material that made them defensible.
§ 3Who it binds
Any model-produced figure, estimate, summary or explanation entering a process the organisation treats as a control — management accounts, variance analysis, provisioning, or forecasting that feeds a disclosure or a covenant calculation. The Framework binds nobody: it is voluntary, carries no penalty, and departure has no consequence. It reaches this work as the shared description of internal control management and auditors already use.
§ 4Worked example
A planning team uses a model to produce the monthly commentary on gross margin. It is given the management pack, the prior three months’ commentary, and a prompt asking for the three largest drivers of the movement with quantification. The output goes into the board pack under the analyst’s name. The board uses it to decide whether to release part of a pricing contingency.
Is this information of sufficient quality to support the decision it is supporting?
Not on the evidence retained, and the decision is what raises the stakes. The commentary quantifies three drivers; the pack contains data from which some of that quantification could be derived and some of it could not, and nothing in the file distinguishes the two. The analyst’s name asserts that a person stands behind it, which may well be true — but the artefact that would show it, a note reconciling each quantified driver to a line in the underlying data, does not exist. Two remedies, and they are not the same size. The small one is retention: keep the input set, the prompt and the version alongside the commentary, so the output can at least be reproduced. The real one is the reconciliation note, because it converts the commentary from information of unknown quality into an analysis a person performed with a tool. It also takes about twenty minutes, and it is the artefact an assessor asks for first.
§ 5What a weak answer looks like
The analyst’s name treated as the provenance. A model-produced commentary goes into the pack under a person’s name, and the organisation reasonably reads that as a person having checked it — the convention for everything else in the pack, and the reason nobody asks. What the name actually records is who is accountable, not what was done. The two coincide for work a person performed and separate the moment they do not, and nothing in the file distinguishes an analysis that was reconciled from one that was read and passed on.
§ 6When it applies
1 January 2013
The publication year of COSO’s Internal Control — Integrated Framework, carried as the start of that year because the day is not asserted here. An edition marker rather than a commencement date: the Framework imposes no deadline on anyone.
1 January 2026
The publication year of COSO’s Achieving Effective Internal Control Over Generative AI (GenAI), likewise carried as the start of the year. Commissioned thought leadership, not a Framework amendment, and it creates no obligation.
§ 7Elsewhere
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
Finance and accounting standards
The ethics code places the preparation duty on the accountant: represent the facts accurately and completely, and avoid undue reliance on technology. This principle places the quality question on the organisation whose control uses the figure.
Article 10 governs the data a high-risk system is built on, which is provenance at the design end. Principle 13 concerns provenance at the point of use, where an output becomes information a control depends on.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 8Where this is assessed
Examined in 2 credentials, in the domains named on each card.
AI in analysis, forecasting and FP&A · 25% of the paper
For finance and accounting professionals who use AI in analysis, close and reporting work — and verify the output before the numbers are relied on.
AI inside internal control and the close · 20% of the paper
For senior finance and accounting professionals who set the terms on which AI is used across a finance function — and answer for the estimates, controls and disclosures it touches.
§ 9provenance
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
§ 10Also read
Certification
What this page sets out is examined, on work the candidate has not seen, in the credentials beside it. Every paper is machine marked against its key and every result is reviewed and released by a named person, and every credential is on the public register.
AIAC-FNAF
Certified AI in Finance & Accounting, Fundamentals2 hours · remote, proctored · valid 2 years
AIAC-FNAP
Certified AI in Finance & Accounting, Professional2 hours · remote, proctored · valid 2 years
Ten questions on using AI at work. About two minutes, free. You finish as one of six types, with a card to share.
SHARE BY 31 DECEMBER, US$199 FEE WAIVED
A free quiz from the AI Assurance Council. Not a certification.