AI in finance and accounting
Instruction 2 to Item 308 requires a registrant to maintain evidential matter, including documentation, providing reasonable support for management's assessment of internal control over financial reporting. Where a control relies on a model, that support has to answer what produced the output — a harder question than who signed the review.
§ 1In practice
Item 308(a) sets out what the annual report must carry: a statement of management's responsibility for establishing and maintaining adequate internal control over financial reporting, identification of the framework used, management's assessment of effectiveness as of the end of the most recent fiscal year, and disclosure of any material weakness. It then closes off the evasion the rest of the item would otherwise invite: "Management is not permitted to conclude that the registrant's internal control over financial reporting is effective if there are one or more material weaknesses." There is no partial verdict available, and no threshold below which a known weakness can be carried quietly.
Instruction 2 is where an AI-assisted control becomes a documentation problem. "The registrant must maintain evidential matter, including documentation, to provide reasonable support for management's assessment of the effectiveness of the registrant's internal control over financial reporting." For a control a person operates, the supporting matter is largely a by-product of operating it — the reviewed schedule, the initialled exception. For a control a model operates, the by-product is a result with no visible derivation, and the support has to be constructed deliberately: which model version was in force, how it was configured and prompted, on what basis items were sampled, and how exceptions were resolved. COSO's 2026 paper on internal control over generative AI reaches the same list from the control side, describing the evidence expectations that follow once management depends on an AI-produced output; here they are the practical content of a filing requirement.
The item is also the point at which management's file meets somebody else's judgement. What Instruction 2 obliges the registrant to hold is what an auditor will later have to reach a conclusion from — see evidence sufficiency for AI controls, which states the problem from the other side of the table. The two are not the same duty and neither discharges the other: a registrant whose file is thin has failed Instruction 2 whether or not anyone has yet tried to audit it.
The usable test is self-sufficiency. Evidential matter provides reasonable support if it supports the assessment without recourse to the person who did the work, because that person may be unavailable, may have moved on, and in any event is not what the instruction asks for. Applied to AI-assisted controls this is unforgiving: a great deal of what finance functions know about their tools lives in the head of the analyst who configured them. Writing it down is most of the compliance, and it is the same discipline the year-end evaluation itself depends on — see an AI tool inside a control you must evaluate.
§ 2What discharges it
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
One tool may sit inside several controls with different settings and different populations. Filing by tool produces a folder that supports no particular assessment.
02
The version in force on the day the conclusion is drawn, plus the settings that governed behaviour. Without it the assessment names a date and describes an unidentified system.
03
Why these items were examined and not others, and what happened to each item that failed. An exception log with no dispositions records that something was noticed.
04
Named in the report itself, and supported in the file by the mapping from that framework to the controls actually evaluated, including the automated ones.
05
Since no effective conclusion is available where a material weakness exists, the paper showing deficiencies were aggregated and judged is part of the support for the conclusion reached.
06
Hosted services overwrite. Where the evidence of how an output arose sits only in a supplier environment, retention is a contractual term rather than a records policy.
§ 3Who it binds
United States registrants required to provide management's annual report on internal control over financial reporting under Item 308(a). The duty to maintain evidential matter falls on the registrant as an entity and is continuous rather than annual: it attaches to the support for an assessment, so material that was never captured while the control operated cannot be created at the year end.
§ 4Worked example
A registrant uses a generative tool to draft the variance commentary that supports its quarterly flux analysis, a control identified as relevant to financial reporting. The analyst prompts the tool with the trial balance movement and the prior commentary, edits the result, and files the finished note. The tool is a hosted service that has been upgraded twice during the year. Prompts are typed fresh each time and not retained.
Does the file provide reasonable support for management's assessment of this control?
No, and the missing piece is not the commentary but everything around it. The finished note exists, which shows the control produced an output; it does not show how, on what input, under which version, or what the analyst changed. Because prompts are not retained, the single most influential input to the result is irrecoverable, and two upgrades during the year mean the control that operated in the first quarter and the control that operated in the fourth are not demonstrably the same control. A defensible position here is cheap: retain the prompt with the working, record the service version in force at each period end, and keep the pre-edit draft alongside the filed note so the human contribution is visible. None of that requires the tool to be better. It requires the registrant to be able to say what happened, which is what Instruction 2 asks and the only part of it that cannot be produced later.
§ 5What a weak answer looks like
Screenshots. A folder of dashboard captures showing green tiles and a match rate, offered as the support for an effectiveness conclusion. They establish that somebody looked at a screen on an unrecorded date, in a system whose version is not named, showing a metric whose calculation is not documented. Nothing in them permits a reader to re-derive anything, and re-derivability is precisely what "reasonable support" means when the thing being supported is a judgement about a control nobody watched operate.
§ 6When it applies
15 November 2004
Accelerated filers: management's annual report under Item 308(a), for the first fiscal year ending on or after this date. Instruction 2 attaches to that report and therefore begins with it.
15 December 2007
Non-accelerated filers. The gap matters for a registrant reading guidance written in the intervening period, when the item existed but did not yet apply to it.
§ 7Exposure
No fixed maximum — Commission enforcement of the reporting requirement
Item 308 is a Regulation S-K disclosure requirement given effect through the annual report filed under section 13(a) of the Exchange Act. A report that does not carry what the item requires, or an assessment without the evidential matter Instruction 2 obliges the registrant to maintain, is pursued by the Securities and Exchange Commission as a reporting failure. Remedies are set case by case and the item fixes no ceiling.
§ 8Elsewhere
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
Instruction 2 states what management must be able to hand over. The audit row states what an auditor must be able to conclude from it. The relationship is between two sides of one file, not between two standards of proof.
ISO/IEC 42001
Clause 7.5 governs how documented information is created, identified, controlled and retained within an AI management system. Where one is in place, it is the mechanism by which the material this instruction requires survives a model upgrade.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 9Where this is assessed
Examined in 2 credentials, in the domains named on each card.
Verifying AI output before reliance · 20% of the paper
For finance and accounting professionals who use AI in analysis, close and reporting work — and verify the output before the numbers are relied on.
Accountability to auditors, committees and regulators · 15% of the paper
For senior finance and accounting professionals who set the terms on which AI is used across a finance function — and answer for the estimates, controls and disclosures it touches.
§ 10provenance
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
§ 11Also read
Certification
What this page sets out is examined, on work the candidate has not seen, in the credentials beside it. Every paper is machine marked against its key and every result is reviewed and released by a named person, and every credential is on the public register.
AIAC-FNAF
Certified AI in Finance & Accounting, Fundamentals2 hours · remote, proctored · valid 2 years
AIAC-FNAP
Certified AI in Finance & Accounting, Professional2 hours · remote, proctored · valid 2 years
Ten questions on using AI at work. About two minutes, free. You finish as one of six types, with a card to share.
SHARE BY 31 DECEMBER, US$199 FEE WAIVED
A free quiz from the AI Assurance Council. Not a certification.