AI in finance and accounting
A prompt is a configuration setting. So is a matching threshold, and so is the connector deciding which documents a tool retrieves. Principle 11 asks an organisation to develop general controls over the technology supporting its other controls, and COSO’s 2026 paper puts those three inside that boundary. Finance functions treat them as working practice, and change them without a ticket.
§ 1Who it binds
Any AI tool used inside a close, reconciliation or reporting process where a person can change its behaviour without changing code — prompt text, thresholds, tolerances, retrieval sources, model selection. Principle 11 imposes no duty on anyone: COSO’s Framework is voluntary and departure carries no consequence. It reaches this work through the control frameworks management has already built from it.
§ 2In practice
Principle 11 is the Framework’s information-technology limb: an organisation selects and develops general controls over technology to support the achievement of its objectives. In a finance function that has always meant access, change management and operations over the ledger, the consolidation system and the reporting layer. Nothing about it binds anyone — COSO publishes a voluntary framework, imposes no obligation and enforces nothing — and the reason it governs this ground anyway is that it is the settled description of technology control that a US registrant’s management typically identifies as the framework it evaluated against, and from which a UK board’s internal control framework is usually built.
What the 2026 paper adds is a set of things finance teams do not currently treat as controlled settings. A prompt is versioned text determining what the tool does; a threshold decides which items clear without a person; a retrieval connector decides what corpus an answer is drawn from. Change any of them and the control behaves differently, which is the definition of a change to a controlled system setting. The paper’s position is that these belong under the same change control as any other configuration element — and it is worth being blunt that this is not how the work happens today. A prompt gets edited in an afternoon by whoever noticed the tool missing a case, with no request, no approver and no record of what it said before. The judgement the ethics code asks for about the appropriateness of inputs, including decisions people take while using the technology, reaches exactly that edit.
Access is the other limb, and the one where these tools break the finance function’s usual assumptions. General controls over technology have always asked who can change a system; a tool with a low barrier to entry — one of the five characteristics the 2026 paper builds on — means the population able to change how a control behaves is no longer the population with system administrator rights. Anyone who can write into the prompt, adjust a threshold or point the tool at a different folder is changing the control. Access here is therefore about who may build, deploy and interact with the tool rather than about database privileges, and the inventory question has to be answered first, because a tool nobody catalogued has no access model at all — which is where the reliance determination starts too.
§ 3What discharges it
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
Prompt text, thresholds and tolerances, retrieval sources and model selection, held as a versioned record rather than as whatever currently sits in the tool. Without a baseline there is nothing for a change to be a change from.
02
A requester, an approver who is not the requester, the prior and new values, and the date. The test of whether this exists is simple: ask who approved the last prompt edit, and watch how long the answer takes.
03
Not system administrators — the people who can edit a prompt, move a tolerance or repoint a connector. These are usually finance staff, and usually absent from the technology access review.
04
Proof that a tolerance change did what was intended and nothing else. Most change records establish that the new behaviour works and say nothing about what stopped working.
§ 4Worked example
A group’s bank reconciliation runs through an AI matching tool. Items match automatically where the tool’s confidence exceeds a threshold; everything else goes to a queue. In August the treasury analyst, tired of a recurring queue of legitimate rounding differences on foreign-currency items, raises the tolerance and adds a line to the prompt telling the tool to treat differences below a stated amount as matched. The change works. Nobody is asked and nothing is recorded.
Has a control changed, and who should have known?
Yes, twice over, and the second change is the larger one. Raising a tolerance moves a boundary the control was designed around; adding an instruction to the prompt changes what the tool does with a class of item that previously reached a person. Both are changes to a control’s configuration, and Principle 11 as the 2026 paper applies it puts both inside change control — meaning a request, an approver who is not the requester, a record of the prior state, and a test that the tool still behaves as expected on items outside the changed class. None of that is heavy. What makes it necessary is that the analyst’s change is invisible: the reconciliation still balances, the queue is shorter, and the control’s description in the inventory still says items clear on confidence. Six months later nobody can say when the tolerance moved, and the year-end evidence describes a configuration that stopped being true in August.
§ 5What a weak answer looks like
The technology general controls memorandum that covers the platform and not the tool. Access, change and operations are documented for the ledger, the consolidation system and the reporting layer, all reviewed annually, all sound. The AI tool sits on top of them as a subscription somebody in finance administers, and none of the three disciplines reaches the settings that actually determine what it does. The memorandum is accurate about everything it describes and silent about the part that moved this year.
§ 6Elsewhere
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
ISO/IEC 42001
Clause 7.5 governs the creation, control and retention of documented information within an AI management system. Where one exists, prompts and configuration already sit inside a controlled-document regime.
The auditor’s file meets the same problem from the other side: a paper naming a tool as its source records nothing unless the version, prompt and settings in service at the time are recorded with it.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 7When it applies
1 January 2013
The publication year of COSO’s Internal Control — Integrated Framework, carried as the start of that year because the day is not asserted here. It marks which edition is current. Nothing commences on it: the Framework is voluntary and imposes no deadline.
1 January 2026
The publication year of COSO’s Achieving Effective Internal Control Over Generative AI (GenAI), again carried as the start of the year. The paper is commissioned thought leadership, not an amendment to the Framework, and creates no obligation.
§ 8Where this is assessed
Examined in 2 credentials, in the domains named on each card.
Close and reconciliation support · 20% of the paper
For finance and accounting professionals who use AI in analysis, close and reporting work — and verify the output before the numbers are relied on.
AI inside internal control and the close · 20% of the paper
For senior finance and accounting professionals who set the terms on which AI is used across a finance function — and answer for the estimates, controls and disclosures it touches.
§ 9provenance
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
§ 10Also read
Certification
What this page sets out is examined, on work the candidate has not seen, in the credentials beside it. Every paper is machine marked against its key and every result is reviewed and released by a named person, and every credential is on the public register.
AIAC-FNAF
Certified AI in Finance & Accounting, Fundamentals2 hours · remote, proctored · valid 2 years
AIAC-FNAP
Certified AI in Finance & Accounting, Professional2 hours · remote, proctored · valid 2 years
Ten questions on using AI at work. About two minutes, free. You finish as one of six types, with a card to share.
SHARE BY 31 DECEMBER, US$199 FEE WAIVED
A free quiz from the AI Assurance Council. Not a certification.