AI in finance and accounting
Rule 13a-15(d) requires management to evaluate, each fiscal quarter, any change in internal control over financial reporting that has materially affected or is reasonably likely to materially affect it. Turning on an AI reconciliation or close tool is capable of being exactly that change, and Regulation S-K Item 308(c) puts the answer in the periodic report.
§ 1When it applies
14 August 2003
Rule 13a-15 in the structure that carries the quarterly change evaluation at paragraph (d), alongside the annual evaluation at paragraph (c).
15 November 2004
Accelerated filers: the first fiscal year ending on or after this date for which the internal control over financial reporting requirements applied. The change evaluation and its disclosure run from the point the filer entered that regime, not from the adoption of the rule.
15 December 2007
Non-accelerated filers, whose management report obligation began three years later. Which date governs is therefore a function of the class the registrant is in.
§ 2In practice
The evaluation is quarterly and the standard is prospective. The rule reaches any change occurring during the quarter that "has materially affected, or is reasonably likely to materially affect" internal control over financial reporting, and the second limb is the one that catches a newly deployed tool: a change whose consequences are not yet known satisfies it precisely because they are not yet known. Waiting for the first exception, the first missed match or the first restatement inverts the test. By the time a tool has demonstrably moved the ledger, the quarter in which somebody should have weighed it has closed.
The harder case is the change the registrant did not make. A supplier that retrains a model, adjusts a filter or repoints a retrieval connector has altered how a control behaves, and the rule asks about changes to the issuer's control rather than about changes the issuer authored. Supervisory practice in other regimes already treats a movement after go-live as an event carrying its own assessment — see post-deployment monitoring and model change — but the Exchange Act confers no right to be told. That right comes from the contract, which is what makes a change-notification clause a control rather than a procurement detail.
The disclosure itself is widely treated as though it were reserved for remediation. Item 308(c) copy is routinely drafted as an assertion that nothing altered except the fixing of a previously reported weakness, and few functions put a new tool through the determination they would apply to a new sub-ledger or a shared-services migration. Nothing in the text supports the narrower reading. Something either happened in the period or it did not, and whether it made the control better, worse or merely different is beside the point.
This is where the collection's central mismatch is at its plainest. Management weighs the position at four fixed moments in the year; a model moves whenever it is retrained, reconfigured or reprompted. More frequent evaluation does not close that gap — knowing when the system moved does, and that is a record somebody has to keep. The ethics code arrives at the same problem from the other direction, making an organisation's oversight of a technology across its lifecycle one of the factors bearing on whether its output may be relied on at all: see using the output of technology.
§ 3Who it binds
United States registrants only. Rule 13a-15 reaches every issuer with a class of securities registered under section 12 of the Exchange Act, other than asset-backed issuers, small business investment companies registered on Form N-5, and unit investment trusts. The duty falls on the entity, discharged through its management; the resulting disclosure travels into the periodic report the issuer files for the quarter.
§ 4What discharges it
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
Name the tool, the version or model identifier, what it now does that a person previously did, and who approved the switch. A record reconstructed afterwards from supplier emails cannot repair the period it belonged to.
02
Not a verdict but a reasoning: what the deployment touched, why a material effect was or was not reasonably likely, and whose judgement it was. An empty disclosure with no paper behind it evidences nothing at all.
03
The clause establishes a right to be told before a model moves; the log establishes that the right was used. A clause with an empty log usually means notices reached procurement and stopped there.
04
Thresholds, prompts, connectors and the population the tool sees. Without that baseline there is nothing for a later version to be measured against, and no way to say whether an update was significant.
05
Shows the conclusion reached the people who draft the filing rather than stopping inside finance. Where no such committee exists, the equivalent minute of whoever signs the report off.
§ 5Worked example
A group controller replaces a spreadsheet-driven bank reconciliation with a vendor tool that proposes matches and auto-clears items below a set threshold. It goes live in the second week of the third quarter. The team documents the configuration, runs the old process alongside it for three weeks, finds no differences and stands the parallel run down. Nobody raises it with the disclosure committee, on the view that nothing changed because the reconciliation still reconciles.
Is the deployment a change that Rule 13a-15(d) requires management to evaluate for that quarter?
Yes, and the parallel run is material for the determination rather than a substitute for making it. What moved is who performs the matching, what the auto-clear threshold lets past without a human seeing it, and what the process now depends on — a supplier's model and its settings. Three weeks of agreement establishes that the tool reproduced the old outcome on that period's population; it says nothing about a population containing the items the threshold was set to pass. The judgement owed is whether the change is reasonably likely to have a material effect, and management may perfectly well conclude that it is not. That conclusion, dated and reasoned, is a complete answer. Never having asked is not, and it is where the record stops in most functions. If the judgement runs the other way, Item 308(c) requires it in the report for the period in which the tool went live, not the one in which somebody noticed.
§ 6What a weak answer looks like
"No changes to report." It is the commonest form of the answer, and it is usually true of last period's material weaknesses and silent about everything else. Asked what was introduced, upgraded or reconfigured, the function produces invoices and a go-live email; asked who weighed the effect and concluded it was immaterial, it produces nobody. The rule does not require the conclusion to be interesting. It requires there to have been one.
§ 7Exposure
No fixed maximum — Commission enforcement, with the remedy set case by case
Rule 13a-15 is made under section 13(a) of the Securities Exchange Act of 1934. A failure to evaluate, or to disclose a change the evaluation should have surfaced, is pursued by the Securities and Exchange Commission through an administrative cease-and-desist proceeding or a civil action, with undertakings, a civil penalty, or neither, according to the facts. The Commission has accepted a settled disclosure-controls finding with no civil penalty where the respondent cooperated and remediated.
§ 8Elsewhere
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
The MAS material treats a change after go-live as a supervised event with its own assessment and approval path. Rule 13a-15(d) reaches the same event as a question about the registrant's control and its periodic report.
Clause 9.1 sets what an AI management system monitors, when, and by what method. Where an organisation runs one, that output is the material a quarterly determination under this rule draws on.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 9Where this is assessed
Examined in 2 credentials, in the domains named on each card.
Close and reconciliation support · 20% of the paper
For finance and accounting professionals who use AI in analysis, close and reporting work — and verify the output before the numbers are relied on.
AI inside internal control and the close · 20% of the paper
For senior finance and accounting professionals who set the terms on which AI is used across a finance function — and answer for the estimates, controls and disclosures it touches.
§ 10provenance
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
§ 11Also read
Certification
What this page sets out is examined, on work the candidate has not seen, in the credentials beside it. Every paper is machine marked against its key and every result is reviewed and released by a named person, and every credential is on the public register.
AIAC-FNAF
Certified AI in Finance & Accounting, Fundamentals2 hours · remote, proctored · valid 2 years
AIAC-FNAP
Certified AI in Finance & Accounting, Professional2 hours · remote, proctored · valid 2 years
Ten questions on using AI at work. About two minutes, free. You finish as one of six types, with a card to share.
SHARE BY 31 DECEMBER, US$199 FEE WAIVED
A free quiz from the AI Assurance Council. Not a certification.