AI in finance and accounting
The Code names automation bias. It is the second of eight biases listed at 120.12 A2, defined as a tendency to favour output generated from automated systems even where human reasoning or contradictory information raises questions about reliability. It was not added in answer to generative AI; it was in the Code before the current tools existed.
§ 1 — Who it binds
Every professional accountant applying the conceptual framework — which is all of them, in business and in public practice alike. The threat is live wherever a judgement is informed by output from an automated system, and that now includes ranked variances, drafted commentary, matched transactions and generated estimates. Section 120 is Part 1 of the Code and takes effect through each member body’s adoption; US CPAs are governed by a separate instrument this page does not characterise.
§ 2 — In practice
120.12 A2 sits in Section 120, the conceptual framework — the machinery every professional accountant applies when identifying, evaluating and addressing threats to the fundamental principles. The preceding paragraph states the problem it belongs to: conscious or unconscious bias affects the exercise of professional judgement at each of those steps. The list that follows names eight, and automation bias is the second, defined as “a tendency to favour output generated from automated systems, even when human reasoning or contradictory information raises questions as to whether such output is reliable or fit for purpose”. The other seven are anchoring, availability, confirmation, groupthink, overconfidence, representation and selective perception, and the company it keeps is part of the point: this is treated as an ordinary failure of judgement, not as a technology problem.
Naming a bias in a code of ethics does something a research literature cannot. It converts “the model said so” from a weak excuse into an identified and foreseeable threat that every professional accountant is on notice of, because the conceptual framework requires threats to be identified and addressed rather than merely regretted afterwards. That shifts what a disciplinary panel is able to conclude: the question stops being whether this accountant was careless and becomes whether they applied the framework to a threat the Code had already named for them. The Code then supplies the responses it contemplates — seeking the advice of an expert, consulting others so the judgement is challenged, and bias-identification training as part of continuing professional development, which is a recorded competence item of the kind clause 7.2 treats as evidence rather than as intent.
The provenance is where practitioner commentary has it backwards. This paragraph did not arrive with the Code’s technology revisions. It came in with the Role and Mindset revisions, which predate the release of the tools now being written about — the profession named automation bias as an ethical threat before there was a chatbot to apply it to. So the prevailing framing, that ethics standards have not caught up with AI, is wrong on the two provisions that matter most: this one, and the objectivity definition it sits alongside. What has not caught up is practice. A tendency the Code treats as a named, addressable threat is handled in most finance functions as a matter of individual temperament, which is the gap a design-side duty such as Article 14 tries to close from the other direction.
§ 3 — What a weak answer looks like
Scepticism asserted as a control. The function’s answer is that its accountants are experienced professionals who take nothing on trust, and the reviewer is offered a run of review sign-offs as proof. A sign-off records that output was accepted, which is precisely the behaviour the named tendency predicts, so the file is consistent with the threat rather than evidence against it. What would be evidence is the opposite record: the occasions on which the output was contradicted, and what happened next.
§ 4 — What discharges it
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
Automation bias recorded as live for the specific judgements this function makes with machine support, with the chosen responses beside it. A register whose entry reads “AI risk” has identified a technology, not a threat to a fundamental principle.
02
Who challenged, what they put, and what changed. Consulting others is one of the responses the Code contemplates, and a consultation leaving no trace is indistinguishable from agreement.
03
Named in the Code as part of continuing professional development, which makes it a recorded item rather than an attitude. A generic session on how large language models work does not evidence it.
04
Cases where a person disagreed with the system and set out why. They are the only positive proof that the tendency is being addressed rather than merely described in a policy.
§ 5 — Worked example
A management accountant runs a monthly AI-assisted flux analysis; the tool ranks variances and drafts explanations. In one month it attributes a large distribution-cost variance to a rate increase from a haulier. The accountant knows the haulage contract was renegotiated downward that same month and that volumes rose sharply — but the tool has been reliable for a year, so the explanation is accepted and the commentary goes into the board pack unchanged.
Which threat went unaddressed, and what did the Code require?
This is the paragraph’s own definition arriving in a finance function. The accountant held contradictory information — a rate that went down against volumes that went up — and favoured the automated output regardless, which is the named threat rather than a lapse of care. The conceptual framework required it to be identified and addressed at the point of judgement, and two of the Code’s own responses cost almost nothing here: consult a colleague to challenge the explanation, or simply apply what the accountant already knew about the contract as the challenge. What makes the case awkward is that a year of reliability is a genuine reason to trust the tool and is not a reason to disregard evidence sitting in front of you. The line the Code draws is between relying on a system and preferring its output to contradictory information, and only the second is what it names.
§ 6 — Elsewhere
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
Article 14 puts a design duty on the provider so that people are able to oversee a high-risk system. 120.12 A2 puts the corresponding tendency on the person doing the overseeing, and gives it a name.
Finance and accounting standards
R220.8 asks what steps a use of technology output needs. This paragraph names the tendency that makes “none” feel like a sufficient answer.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 7 — When it applies
29 August 2024
Publication date of the 2024 edition of the IESBA Handbook, used as an edition marker. 120.12 A2 came in with the Role and Mindset revisions, whose IESBA commencement date has not been verified on an IESBA source. It is not a compliance deadline.
§ 8 — Exposure
No Code fine; a framework failure is pursued by the adopting member body
Section 120 is applied by every professional accountant, and failing to identify and address a threat the Code has already named is a matter for the body that adopted it — investigation, then reprimand, fine, conditions on practice, or withdrawal of membership and the practising certificate. No regulator enforces the conceptual framework, and it does not reach a person who is not a member of an adopting body.
§ 9 — Where this is assessed
Examined in one credential, in the domains named on each card.
Verifying AI output before reliance · 20% of the paper
For finance and accounting professionals who use AI in analysis, close and reporting work — and verify the output before the numbers are relied on.
§ 10 — provenance
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
§ 11 — Also read
Certification
What this page sets out is examined, on work the candidate has not seen, in the credential beside it. Every paper is machine marked against its key and every result is reviewed and released by a named person, and every credential is on the public register.
AIAC-FNAF
Certified AI in Finance & Accounting — Fundamentals2 hours · remote, proctored · valid 2 years
Ten questions on using AI at work. About two minutes, free. You finish as one of six types, with a card to share.
A free quiz from the AI Assurance Council. Not a certification.