Council Post: Your AI Is Now An Internal Control. Your Auditor Will Test It Like One

Posted on October 16, 2026 in business-finance

Jacqueline DeStefano-Tangorra is the President and CTO of DataOps.

The first thing I learned as an auditor when I worked in Big 4 had nothing to do with whether a number was right. It was a question I asked hundreds of times over six years: Where did this report come from, and how do you know it’s complete?

That question is about to land on a new target. Finance teams spent 2026 putting AI into the close. Agents now match reconciliations, draft journal entries, suggest accrual estimates and write the variance commentary that goes to the audit committee. For many public companies, this year-end will be the first time an external auditor walks into a close process where software, and not only people, is making judgment calls.

Most of the finance leaders I talk to want to know whether a new AI audit rule is coming. The less comfortable answer is that auditors don’t need one.

The PCAOB does not currently have an auditing standard written specifically for AI. Its work on AI remains focused primarily on research and potential staff guidance on how companies’ and auditors’ use of AI affects audits. Existing standards such as AS 2201, which governs audits of internal control over financial reporting, are not AI-specific and already require auditors to consider IT involvement and automated controls when evaluating financial-reporting processes.

Two dates raise the stakes this cycle. The PCAOB’s amendments addressing auditors’ use of technology-assisted analysis apply to audits of financial statements for fiscal years beginning on or after December 15, 2025. For calendar-year companies, that means the 2026 audit is the first audit subject to those amendments.

Then, on December 15, 2026, the PCAOB’s new quality control standard, QC 1000, takes effect and puts audit firms’ own use of technology under a brighter light. Firms that are tightening how they govern their own tools are unlikely to relax their expectations of yours.

Four Questions Your Auditor May Ask

1. What data did the AI act on, and was it complete and accurate? Auditors have tested system-generated reports for decades because a control is only as reliable as the information it runs on. An AI summary of an aging report is a report about a report. If the underlying extract dropped a subsidiary, the agent’s polished commentary will be confidently wrong, and the auditor will trace it back to the source.

2. Can you reproduce the result? A control that produces a different answer on Tuesday than it did on Monday is hard to rely on. Expect requests for the inputs, the output, the model version and the prompt or configuration in use at the time. If your team can’t reconstruct what the agent saw and did in March, the auditor can’t either.

3. What did the human reviewer actually review? Most companies put a person at the end of the AI workflow and call it oversight. Auditors have long challenged management review controls where the sign-off proves someone looked but says nothing about what they looked for. A reviewer who approves 40 AI-drafted entries in 10 minutes has produced a signature. The auditor will ask for evidence of the review itself: the threshold used, the items investigated and what changed as a result.

4. Who, or what, can change what? This is where my fraud examiner training kicks in. An agent that can both draft and post a journal entry has the same segregation-of-duties problem as a clerk who can do both. A prompt edit is also a change to a control. If anyone on the team can rewrite the instructions an agent follows, you have a change management gap, and auditors already know how to find those.

Look closely at those four questions and you’ll notice that none of them is about the model. Each one resolves to something a mature data governance program already provides: lineage that shows where data came from, quality checks at the point of ingestion, named owners for critical data and controlled change management.

That’s why I tell clients the audit test and the AI readiness test are the same test. In my work with companies in aerospace, healthcare and manufacturing, AI projects rarely stall because the model is weak. They stall because nobody can say with confidence which source system is authoritative or who approved the last change to a definition. Put an agent on top of that environment and you haven’t automated the close. You’ve automated the gaps and made them run faster.

What To Do Before Year-End

There is still time before fieldwork begins. Here’s where I would start:

1. Inventory every AI touchpoint in financial reporting. Include the informal ones. An analyst using a chatbot to draft accrual support is using AI in your close process, whether or not it shows up on a system list.

2. Classify each use. Does the AI perform a control, support a control or produce information a control relies on? Each answer carries different testing expectations, and your SOX team and your auditor should agree on the classification before January.

3. Log what matters. Capture inputs, outputs, model and prompt versions and the reviewer’s evidence. Logs reconstructed after the fact are hard to defend.

4. Put prompts and agent configurations under change management. Treat them the way you treat code or a change to a key spreadsheet: versioned, approved and tested.

5. Apply segregation of duties to agents. Give each agent the narrowest access its role requires, and never let one identity, human or machine, prepare and approve the same transaction.

6. Talk to your auditor now. A walkthrough of your AI-enabled processes in November costs far less than a control deficiency in February.

The finance organizations that come through their first AI-era audit cleanly will be the ones that treated their AI the way they would treat a new hire in accounting: a defined role, limited access, real supervision and a documented trail of the work. That discipline is what makes AI auditable, and auditable AI is the only kind a board will let you scale.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?