{"id":3605,"date":"2026-07-14T20:42:33","date_gmt":"2026-07-14T12:42:33","guid":{"rendered":"http:\/\/ehluar.com\/main\/?p=3605"},"modified":"2026-07-15T20:57:50","modified_gmt":"2026-07-15T12:57:50","slug":"agentic-ai-financial-reporting-control-and-governance-considerations","status":"publish","type":"post","link":"http:\/\/ehluar.com\/main\/2026\/07\/14\/agentic-ai-financial-reporting-control-and-governance-considerations\/","title":{"rendered":"Agentic AI: Financial Reporting, Control and Governance Considerations"},"content":{"rendered":"<p class=\"PDq2pG_selectionAnchorContainer\" data-start=\"86\" data-end=\"302\">The development of agentic artificial intelligence is expanding the role of AI from generating content and analysis to initiating transactions, accessing multiple systems and completing multi-step business processes.<\/p>\n<p data-start=\"304\" data-end=\"692\">For finance functions, this creates opportunities to improve efficiency, reporting and exception management. It also introduces new risks relating to data quality, internal controls, auditability, regulatory compliance and accountability. Organisations should therefore treat agentic AI as a business-process and control transformation rather than a stand-alone technology implementation.<\/p>\n<h3 data-section-id=\"t045up\" data-start=\"694\" data-end=\"712\">Key development<\/h3>\n<p data-start=\"714\" data-end=\"929\">Earlier forms of enterprise AI were largely used for prediction, classification and analysis. Generative AI subsequently enabled users to draft, summarise and research information, generally subject to human review.<\/p>\n<p data-start=\"931\" data-end=\"983\">Agentic AI goes further. An AI agent may be able to:<\/p>\n<ul data-start=\"985\" data-end=\"1234\">\n<li data-section-id=\"1tm0g29\" data-start=\"985\" data-end=\"1030\">Interpret an instruction or business event.<\/li>\n<li data-section-id=\"1wcg5nh\" data-start=\"1031\" data-end=\"1063\">Develop a sequence of actions.<\/li>\n<li data-section-id=\"1mua17l\" data-start=\"1064\" data-end=\"1110\">Retrieve information from different systems.<\/li>\n<li data-section-id=\"2vkgrr\" data-start=\"1111\" data-end=\"1149\">Use approved tools and applications.<\/li>\n<li data-section-id=\"1d5wdvq\" data-start=\"1150\" data-end=\"1186\">Initiate or complete transactions.<\/li>\n<li data-section-id=\"11cmm63\" data-start=\"1187\" data-end=\"1234\">Escalate decisions or exceptions to a person.<\/li>\n<\/ul>\n<p data-start=\"1236\" data-end=\"1507\">This increased autonomy changes the risk profile. An inaccurate draft may be corrected before use, whereas an agent that posts an incorrect journal, creates an unauthorised payment request or changes master data may cause immediate financial and operational consequences.<\/p>\n<h3 data-section-id=\"1tvty5r\" data-start=\"1509\" data-end=\"1563\">Implications for financial reporting and accounting<\/h3>\n<h4 data-section-id=\"1y8yq4p\" data-start=\"1565\" data-end=\"1591\"><em>Transaction processing<\/em><\/h4>\n<p data-start=\"1593\" data-end=\"1634\">Agentic AI may support processes such as:<\/p>\n<ul data-start=\"1636\" data-end=\"1901\">\n<li data-section-id=\"smxcgt\" data-start=\"1636\" data-end=\"1697\">Extracting data from invoices, contracts or correspondence.<\/li>\n<li data-section-id=\"2ujhpn\" data-start=\"1698\" data-end=\"1747\">Creating purchase requisitions or sales orders.<\/li>\n<li data-section-id=\"6tsvv5\" data-start=\"1748\" data-end=\"1776\">Preparing journal entries.<\/li>\n<li data-section-id=\"g3ba9t\" data-start=\"1777\" data-end=\"1817\">Updating customer or supplier records.<\/li>\n<li data-section-id=\"9a5nd7\" data-start=\"1818\" data-end=\"1864\">Initiating billing or collection activities.<\/li>\n<li data-section-id=\"1rl58b5\" data-start=\"1865\" data-end=\"1901\">Routing transactions for approval.<\/li>\n<\/ul>\n<p data-start=\"1903\" data-end=\"2135\">These applications may reduce manual processing and improve turnaround times. However, the organisation remains responsible for ensuring that transactions are valid, complete, accurate, authorised and recorded in the correct period.<\/p>\n<p data-start=\"2137\" data-end=\"2457\">AI interpretation is inherently probabilistic. Core financial execution should therefore remain governed by deterministic rules. An agent may interpret a document or classify a request, but established controls should determine the account coding, approval route, transaction limit, tax treatment and posting conditions.<\/p>\n<h4 data-section-id=\"bszsbd\" data-start=\"2459\" data-end=\"2497\"><em>Financial and management reporting<\/em><\/h4>\n<p data-start=\"2499\" data-end=\"2653\">AI may improve reporting by consolidating information from multiple systems and identifying trends, anomalies or exceptions across large data populations.<\/p>\n<p data-start=\"2655\" data-end=\"2686\">Potential applications include:<\/p>\n<ul data-start=\"2688\" data-end=\"2961\">\n<li data-section-id=\"1vv65sh\" data-start=\"2688\" data-end=\"2708\">Variance analysis.<\/li>\n<li data-section-id=\"io45d6\" data-start=\"2709\" data-end=\"2745\">Forecasting and scenario analysis.<\/li>\n<li data-section-id=\"ii2hok\" data-start=\"2746\" data-end=\"2775\">Working-capital monitoring.<\/li>\n<li data-section-id=\"lvsvc4\" data-start=\"2776\" data-end=\"2822\">Customer and product profitability analysis.<\/li>\n<li data-section-id=\"cka2pj\" data-start=\"2823\" data-end=\"2864\">Identification of unusual transactions.<\/li>\n<li data-section-id=\"1md27t\" data-start=\"2865\" data-end=\"2900\">Analysis of accounting estimates.<\/li>\n<li data-section-id=\"1k6u8j1\" data-start=\"2901\" data-end=\"2961\">Root-cause analysis of operational or financial variances.<\/li>\n<\/ul>\n<p data-start=\"2963\" data-end=\"3209\">The reliability of the output depends on the quality and consistency of the underlying information. Where systems contain duplicate records, inconsistent definitions or delayed data transfers, AI may produce a plausible but misleading conclusion.<\/p>\n<p data-start=\"3211\" data-end=\"3360\">Finance teams should therefore verify the source data, transformations, assumptions and reconciliation status before relying on AI-generated reports.<\/p>\n<h4 data-section-id=\"s4gvih\" data-start=\"3362\" data-end=\"3413\"><em>Accounting estimates and professional judgement<\/em><\/h4>\n<p data-start=\"3415\" data-end=\"3635\">AI may assist with complex accounting matters by analysing historical information, contracts and external data. Possible areas include impairment assessments, provisions, expected credit losses and useful-life estimates.<\/p>\n<p data-start=\"3637\" data-end=\"3831\">Management should not treat the AI output as a substitute for professional judgement. The basis of significant estimates should remain explainable, documented and supported by relevant evidence.<\/p>\n<p data-start=\"3833\" data-end=\"3900\">Where AI contributes to an estimate, organisations should consider:<\/p>\n<ul data-start=\"3902\" data-end=\"4188\">\n<li data-section-id=\"q23040\" data-start=\"3902\" data-end=\"3952\">The completeness and relevance of the data used.<\/li>\n<li data-section-id=\"exola6\" data-start=\"3953\" data-end=\"3994\">Whether the methodology is appropriate.<\/li>\n<li data-section-id=\"1glssri\" data-start=\"3995\" data-end=\"4032\">The degree of management oversight.<\/li>\n<li data-section-id=\"1m4lx30\" data-start=\"4033\" data-end=\"4065\">How assumptions were selected.<\/li>\n<li data-section-id=\"17ntwx2\" data-start=\"4066\" data-end=\"4119\">Whether the model has been independently validated.<\/li>\n<li data-section-id=\"y55k2k\" data-start=\"4120\" data-end=\"4188\">Whether changes in the model affect comparability between periods.<\/li>\n<\/ul>\n<h3 data-section-id=\"sd6l95\" data-start=\"4190\" data-end=\"4222\">Internal control implications<\/h3>\n<h4 data-section-id=\"1rm5r7f\" data-start=\"4224\" data-end=\"4252\"><em>Access and authorisation<\/em><\/h4>\n<p data-start=\"4254\" data-end=\"4407\">AI agents may require access to several applications to complete a process. This creates a risk that the agent receives broader access than is necessary.<\/p>\n<p data-start=\"4409\" data-end=\"4440\">Access controls should address:<\/p>\n<ul data-start=\"4442\" data-end=\"4714\">\n<li data-section-id=\"1xv9nj7\" data-start=\"4442\" data-end=\"4486\">The systems and data the agent may access.<\/li>\n<li data-section-id=\"8pt6wc\" data-start=\"4487\" data-end=\"4540\">The transactions the agent may initiate or approve.<\/li>\n<li data-section-id=\"1k2y68k\" data-start=\"4541\" data-end=\"4570\">Monetary and volume limits.<\/li>\n<li data-section-id=\"1y9uuxt\" data-start=\"4571\" data-end=\"4617\">Restricted fields and sensitive information.<\/li>\n<li data-section-id=\"qr2b9s\" data-start=\"4618\" data-end=\"4674\">The circumstances in which human approval is required.<\/li>\n<li data-section-id=\"qxcl2z\" data-start=\"4675\" data-end=\"4714\">Periodic review of agent permissions.<\/li>\n<\/ul>\n<p data-start=\"4716\" data-end=\"4838\">The principle of least privilege should apply to agents in the same way that it applies to employees and service accounts.<\/p>\n<h4 data-section-id=\"1wyte6h\" data-start=\"4840\" data-end=\"4865\"><em>Segregation of duties<\/em><\/h4>\n<p data-start=\"4867\" data-end=\"4977\">An agent should not be permitted to perform incompatible activities without appropriate compensating controls.<\/p>\n<p data-start=\"4979\" data-end=\"5219\">For example, an agent that creates a supplier record should not also be able to approve the supplier and initiate payment. Similarly, an agent that prepares a journal should not ordinarily have unrestricted authority to approve and post it.<\/p>\n<p data-start=\"5221\" data-end=\"5357\">Organisations should update their segregation-of-duties matrices to include AI agents, automated workflows and technical administrators.<\/p>\n<h4 data-section-id=\"yb70jg\" data-start=\"5359\" data-end=\"5381\"><em>Human intervention<\/em><\/h4>\n<p data-start=\"5383\" data-end=\"5463\">Clear human decision points should be built into the process. These may include:<\/p>\n<ul data-start=\"5465\" data-end=\"5706\">\n<li data-section-id=\"y1oel3\" data-start=\"5465\" data-end=\"5503\">Approval of high-value transactions.<\/li>\n<li data-section-id=\"1cz8h24\" data-start=\"5504\" data-end=\"5550\">Review of unusual or low-confidence outputs.<\/li>\n<li data-section-id=\"dnovqd\" data-start=\"5551\" data-end=\"5578\">Resolution of exceptions.<\/li>\n<li data-section-id=\"195j0og\" data-start=\"5579\" data-end=\"5622\">Approval of changes to models or prompts.<\/li>\n<li data-section-id=\"1iwtxvl\" data-start=\"5623\" data-end=\"5659\">Investigation of control breaches.<\/li>\n<li data-section-id=\"1stex9e\" data-start=\"5660\" data-end=\"5706\">Authority to suspend or terminate the agent.<\/li>\n<\/ul>\n<p data-start=\"5708\" data-end=\"5900\">Human review should be meaningful. A nominal approval step will not be effective if the reviewer lacks sufficient information or routinely accepts the agent\u2019s recommendation without challenge.<\/p>\n<h4 data-section-id=\"wsf7i4\" data-start=\"5902\" data-end=\"5934\"><em>Monitoring and observability<\/em><\/h4>\n<p data-start=\"5936\" data-end=\"6184\">Traditional system monitoring generally confirms whether an application is operating and whether errors have occurred. This may not be sufficient for agentic AI because an agent can function as designed while still making an inappropriate decision.<\/p>\n<p data-start=\"6186\" data-end=\"6270\">Organisations should establish observability over the agent\u2019s activities, including:<\/p>\n<ul data-start=\"6272\" data-end=\"6516\">\n<li data-section-id=\"yxbdt4\" data-start=\"6272\" data-end=\"6299\">The instruction received.<\/li>\n<li data-section-id=\"fdoglg\" data-start=\"6300\" data-end=\"6328\">The data sources accessed.<\/li>\n<li data-section-id=\"1ajf27i\" data-start=\"6329\" data-end=\"6358\">The tools and systems used.<\/li>\n<li data-section-id=\"1uevufl\" data-start=\"6359\" data-end=\"6380\">The decisions made.<\/li>\n<li data-section-id=\"1l0f2r3\" data-start=\"6381\" data-end=\"6410\">The transactions initiated.<\/li>\n<li data-section-id=\"1d46kyt\" data-start=\"6411\" data-end=\"6440\">The exceptions encountered.<\/li>\n<li data-section-id=\"nzg9fu\" data-start=\"6441\" data-end=\"6472\">The human approvals obtained.<\/li>\n<li data-section-id=\"d5702s\" data-start=\"6473\" data-end=\"6516\">Any changes to the agent\u2019s configuration.<\/li>\n<\/ul>\n<p data-start=\"6518\" data-end=\"6632\">Audit trails should be complete, retained for an appropriate period and protected against unauthorised alteration.<\/p>\n<p data-start=\"6634\" data-end=\"6773\">Controls should also identify abnormal behaviour, repeated loops, unexpected data access and activity outside the agent\u2019s approved purpose.<\/p>\n<h3 data-section-id=\"znbjrh\" data-start=\"6775\" data-end=\"6798\">Audit considerations<\/h3>\n<p data-start=\"6800\" data-end=\"6864\">Agentic AI may affect the nature and extent of audit procedures.<\/p>\n<p data-start=\"6866\" data-end=\"6896\">Auditors may need to evaluate:<\/p>\n<ul data-start=\"6898\" data-end=\"7411\">\n<li data-section-id=\"1scc78b\" data-start=\"6898\" data-end=\"6977\">Whether AI-related controls have been appropriately designed and implemented.<\/li>\n<li data-section-id=\"ai7pcl\" data-start=\"6978\" data-end=\"7046\">Whether agent-generated transactions can be separately identified.<\/li>\n<li data-section-id=\"8cygju\" data-start=\"7047\" data-end=\"7098\">Whether logs are complete, accurate and retained.<\/li>\n<li data-section-id=\"h8axdk\" data-start=\"7099\" data-end=\"7166\">How model, prompt and workflow changes are authorised and tested.<\/li>\n<li data-section-id=\"afeqh2\" data-start=\"7167\" data-end=\"7243\">Whether management can explain material decisions made with AI assistance.<\/li>\n<li data-section-id=\"t2mp1c\" data-start=\"7244\" data-end=\"7326\">Whether third-party AI and integration providers affect the control environment.<\/li>\n<li data-section-id=\"1hr5521\" data-start=\"7327\" data-end=\"7411\">Whether the organisation has adequate incident-management and rollback procedures.<\/li>\n<\/ul>\n<p data-start=\"7413\" data-end=\"7632\">Where an agent interacts with several systems, the audit scope may extend beyond the accounting application to include integration tools, data pipelines, access-management systems, cloud services and external providers.<\/p>\n<p data-start=\"7634\" data-end=\"7791\">The use of AI does not reduce management\u2019s responsibility for the financial statements or the auditor\u2019s need to obtain sufficient appropriate audit evidence.<\/p>\n<h3 data-section-id=\"r0h4se\" data-start=\"7793\" data-end=\"7829\">Tax and regulatory considerations<\/h3>\n<p data-start=\"7831\" data-end=\"8031\">AI may assist with tax classification, data extraction, reconciliation and return preparation. However, tax outcomes often depend on facts, legal interpretation and jurisdiction-specific requirements.<\/p>\n<p data-start=\"8033\" data-end=\"8056\">Relevant risks include:<\/p>\n<ul data-start=\"8058\" data-end=\"8369\">\n<li data-section-id=\"hxhfyv\" data-start=\"8058\" data-end=\"8103\">Application of outdated tax rules or rates.<\/li>\n<li data-section-id=\"1wg5cbb\" data-start=\"8104\" data-end=\"8147\">Incorrect classification of transactions.<\/li>\n<li data-section-id=\"9hk7nk\" data-start=\"8148\" data-end=\"8196\">Incomplete consideration of contractual terms.<\/li>\n<li data-section-id=\"wztivb\" data-start=\"8197\" data-end=\"8238\">Inconsistent treatment across entities.<\/li>\n<li data-section-id=\"jd6sji\" data-start=\"8239\" data-end=\"8305\">Processing of confidential data in an unauthorised jurisdiction.<\/li>\n<li data-section-id=\"ox5kxc\" data-start=\"8306\" data-end=\"8369\">Insufficient evidence supporting an automated tax conclusion.<\/li>\n<\/ul>\n<p data-start=\"8371\" data-end=\"8482\">Tax-sensitive activities should remain subject to documented rules, review thresholds and exception procedures.<\/p>\n<p data-start=\"8484\" data-end=\"8670\">Organisations should also assess whether automated decisions are subject to sector-specific regulation, privacy requirements, record-retention obligations or explainability requirements.<\/p>\n<h3 data-section-id=\"1lhefcu\" data-start=\"8672\" data-end=\"8705\">Data and system considerations<\/h3>\n<h4 data-section-id=\"82rn4r\" data-start=\"8707\" data-end=\"8723\"><em>Data quality<\/em><\/h4>\n<p data-start=\"8725\" data-end=\"8795\">AI output will only be as reliable as the data available to the agent.<\/p>\n<p data-start=\"8797\" data-end=\"8848\">Before implementation, organisations should assess:<\/p>\n<ul data-start=\"8850\" data-end=\"9135\">\n<li data-section-id=\"1pclsb6\" data-start=\"8850\" data-end=\"8878\">Accuracy and completeness.<\/li>\n<li data-section-id=\"1ggumqt\" data-start=\"8879\" data-end=\"8929\">Duplicate customer, supplier or product records.<\/li>\n<li data-section-id=\"1apcgxn\" data-start=\"8930\" data-end=\"8975\">Consistency of definitions between systems.<\/li>\n<li data-section-id=\"1m6n1ie\" data-start=\"8976\" data-end=\"9005\">Timeliness of data updates.<\/li>\n<li data-section-id=\"ou2ww\" data-start=\"9006\" data-end=\"9033\">Ownership of master data.<\/li>\n<li data-section-id=\"vy1qry\" data-start=\"9034\" data-end=\"9075\">Availability of historical information.<\/li>\n<li data-section-id=\"10f2nw4\" data-start=\"9076\" data-end=\"9135\">Restrictions on the use of personal or confidential data.<\/li>\n<\/ul>\n<p data-start=\"9137\" data-end=\"9223\">Prompt engineering will not correct underlying data-quality or integration weaknesses.<\/p>\n<h4 data-section-id=\"1szb53x\" data-start=\"9225\" data-end=\"9247\"><em>System integration<\/em><\/h4>\n<p data-start=\"9249\" data-end=\"9404\">Many organisations operate multiple finance, operational, customer and reporting systems connected through manual transfers or project-specific interfaces.<\/p>\n<p data-start=\"9406\" data-end=\"9428\">Common issues include:<\/p>\n<ul data-start=\"9430\" data-end=\"9703\">\n<li data-section-id=\"1y57o28\" data-start=\"9430\" data-end=\"9466\">Spreadsheet-based reconciliations.<\/li>\n<li data-section-id=\"1wa3xri\" data-start=\"9467\" data-end=\"9496\">Repeated manual data entry.<\/li>\n<li data-section-id=\"1x2jg5l\" data-start=\"9497\" data-end=\"9553\">Overnight data copies rather than current information.<\/li>\n<li data-section-id=\"7lkc9x\" data-start=\"9554\" data-end=\"9580\">Undocumented interfaces.<\/li>\n<li data-section-id=\"1yb824j\" data-start=\"9581\" data-end=\"9614\">Inconsistent security controls.<\/li>\n<li data-section-id=\"1thmnf0\" data-start=\"9615\" data-end=\"9660\">Different versions of the same master data.<\/li>\n<li data-section-id=\"3vpyce\" data-start=\"9661\" data-end=\"9703\">High dependency on individual employees.<\/li>\n<\/ul>\n<p data-start=\"9705\" data-end=\"9798\">Introducing AI into this environment may accelerate existing errors rather than resolve them.<\/p>\n<p data-start=\"9800\" data-end=\"10021\">A governed integration layer may allow the agent to access approved information and services without requiring every system to be replaced. The design should ensure that data remains traceable to the authoritative source.<\/p>\n<h4 data-section-id=\"1g81q2b\" data-start=\"10023\" data-end=\"10061\"><em>Data residency and confidentiality<\/em><\/h4>\n<p data-start=\"10063\" data-end=\"10157\">Data residency should be assessed across the complete technology chain, not only the AI model.<\/p>\n<p data-start=\"10159\" data-end=\"10191\">Relevant components may include:<\/p>\n<ul data-start=\"10193\" data-end=\"10384\">\n<li data-section-id=\"1rsnauw\" data-start=\"10193\" data-end=\"10208\">The AI model.<\/li>\n<li data-section-id=\"ajdlee\" data-start=\"10209\" data-end=\"10232\">Integration services.<\/li>\n<li data-section-id=\"1mq9pa3\" data-start=\"10233\" data-end=\"10260\">Databases and data lakes.<\/li>\n<li data-section-id=\"1kwiut4\" data-start=\"10261\" data-end=\"10278\">Cloud runtimes.<\/li>\n<li data-section-id=\"7rq9sc\" data-start=\"10279\" data-end=\"10313\">Logging and monitoring services.<\/li>\n<li data-section-id=\"e44q5m\" data-start=\"10314\" data-end=\"10348\">Backup and support environments.<\/li>\n<li data-section-id=\"8gs8cs\" data-start=\"10349\" data-end=\"10384\">External tools used by the agent.<\/li>\n<\/ul>\n<p data-start=\"10386\" data-end=\"10551\">Accounting firms and other professional advisers should pay particular attention to client confidentiality, contractual restrictions and cross-border data transfers.<\/p>\n<h3 data-section-id=\"1rsxlb9\" data-start=\"10553\" data-end=\"10594\">Practical issues<\/h3>\n<h4 data-section-id=\"1s9uxii\" data-start=\"10596\" data-end=\"10628\"><em>Establishing a business case<\/em><\/h4>\n<p data-start=\"10630\" data-end=\"10716\">AI initiatives should begin with a specific business problem and measurable objective.<\/p>\n<p data-start=\"10718\" data-end=\"10762\">Possible finance-related indicators include:<\/p>\n<ul data-start=\"10764\" data-end=\"11046\">\n<li data-section-id=\"1l2od38\" data-start=\"10764\" data-end=\"10790\">Invoice-processing time.<\/li>\n<li data-section-id=\"1t6ttla\" data-start=\"10791\" data-end=\"10814\">Cost per transaction.<\/li>\n<li data-section-id=\"5i3wha\" data-start=\"10815\" data-end=\"10837\">Journal error rates.<\/li>\n<li data-section-id=\"19eucha\" data-start=\"10838\" data-end=\"10886\">Time required to complete the financial close.<\/li>\n<li data-section-id=\"1abmw6l\" data-start=\"10887\" data-end=\"10911\">Reconciliation effort.<\/li>\n<li data-section-id=\"nz9g1h\" data-start=\"10912\" data-end=\"10946\">Number of compliance exceptions.<\/li>\n<li data-section-id=\"p8izye\" data-start=\"10947\" data-end=\"10968\">Collection periods.<\/li>\n<li data-section-id=\"1p7rk00\" data-start=\"10969\" data-end=\"10989\">Forecast accuracy.<\/li>\n<li data-section-id=\"ju6lwl\" data-start=\"10990\" data-end=\"11007\">Audit coverage.<\/li>\n<li data-section-id=\"bcspq0\" data-start=\"11008\" data-end=\"11046\">Staff time spent on repetitive work.<\/li>\n<\/ul>\n<p data-start=\"11048\" data-end=\"11172\">Implementation, integration, licensing, control and monitoring costs should be included when evaluating the expected return.<\/p>\n<h4 data-section-id=\"1evsb4z\" data-start=\"11174\" data-end=\"11208\"><em>Mapping the end-to-end process<\/em><\/h4>\n<p data-start=\"11210\" data-end=\"11321\">Organisations should examine the complete process rather than only the activities within the accounting system.<\/p>\n<p data-start=\"11323\" data-end=\"11596\">For example, an order-to-cash process may operate efficiently after an order is entered into the enterprise resource planning system. The actual weakness may arise earlier, where orders are received through email or messaging platforms and manually re-entered by employees.<\/p>\n<p data-start=\"11598\" data-end=\"11632\">Process discovery should identify:<\/p>\n<ul data-start=\"11634\" data-end=\"11917\">\n<li data-section-id=\"eaei25\" data-start=\"11634\" data-end=\"11684\">Where information first enters the organisation.<\/li>\n<li data-section-id=\"1aioh8m\" data-start=\"11685\" data-end=\"11752\">Which manual steps occur before and after the system transaction.<\/li>\n<li data-section-id=\"1b39jf6\" data-start=\"11753\" data-end=\"11780\">Where data is re-entered.<\/li>\n<li data-section-id=\"61eulr\" data-start=\"11781\" data-end=\"11828\">Where approvals occur outside formal systems.<\/li>\n<li data-section-id=\"1ubpzzo\" data-start=\"11829\" data-end=\"11880\">Which controls are embedded in manual procedures.<\/li>\n<li data-section-id=\"1m3fbta\" data-start=\"11881\" data-end=\"11917\">Where exceptions and delays arise.<\/li>\n<\/ul>\n<p data-start=\"11919\" data-end=\"12054\">Not every manual step should be automated. Some activities preserve segregation of duties, independent review or regulatory compliance.<\/p>\n<h4 data-section-id=\"cwfihc\" data-start=\"12056\" data-end=\"12085\"><em>Testing before deployment<\/em><\/h4>\n<p data-start=\"12087\" data-end=\"12166\">Testing should cover more than whether the agent produces an acceptable answer.<\/p>\n<p data-start=\"12168\" data-end=\"12200\">Relevant procedures may include:<\/p>\n<ul data-start=\"12202\" data-end=\"12611\">\n<li data-section-id=\"y1q411\" data-start=\"12202\" data-end=\"12256\">Testing representative and exceptional transactions.<\/li>\n<li data-section-id=\"139nspv\" data-start=\"12257\" data-end=\"12306\">Assessing low-quality or incomplete input data.<\/li>\n<li data-section-id=\"98k4hj\" data-start=\"12307\" data-end=\"12340\">Confirming access restrictions.<\/li>\n<li data-section-id=\"1lmx0c2\" data-start=\"12341\" data-end=\"12373\">Verifying approval thresholds.<\/li>\n<li data-section-id=\"1eh9k6i\" data-start=\"12374\" data-end=\"12419\">Testing duplicate and invalid transactions.<\/li>\n<li data-section-id=\"1jpdv4s\" data-start=\"12420\" data-end=\"12470\">Confirming logging and audit-trail completeness.<\/li>\n<li data-section-id=\"1fwjyi2\" data-start=\"12471\" data-end=\"12517\">Testing the suspension and rollback process.<\/li>\n<li data-section-id=\"135l38m\" data-start=\"12518\" data-end=\"12568\">Assessing the effect of model or prompt changes.<\/li>\n<li data-section-id=\"ffff3u\" data-start=\"12569\" data-end=\"12611\">Performing security and privacy testing.<\/li>\n<\/ul>\n<p data-start=\"12613\" data-end=\"12718\">Testing should be repeated when a model, workflow, system interface or significant business rule changes.<\/p>\n<h4 data-section-id=\"xiqyvs\" data-start=\"12720\" data-end=\"12746\"><em>Managing model changes<\/em><\/h4>\n<p data-start=\"12748\" data-end=\"12823\">Different AI models may behave differently when given the same instruction.<\/p>\n<p data-start=\"12825\" data-end=\"12862\">A model change may therefore require:<\/p>\n<ul data-start=\"12864\" data-end=\"13133\">\n<li data-section-id=\"12vqwtg\" data-start=\"12864\" data-end=\"12907\">Revalidation of prompts and instructions.<\/li>\n<li data-section-id=\"cmehcl\" data-start=\"12908\" data-end=\"12947\">Retesting of controls and thresholds.<\/li>\n<li data-section-id=\"1orft5r\" data-start=\"12948\" data-end=\"12996\">Comparison of outputs with the previous model.<\/li>\n<li data-section-id=\"qiz7pb\" data-start=\"12997\" data-end=\"13045\">Review of changed data-residency arrangements.<\/li>\n<li data-section-id=\"1nfyqgy\" data-start=\"13046\" data-end=\"13070\">Updated user training.<\/li>\n<li data-section-id=\"1mrgc1a\" data-start=\"13071\" data-end=\"13114\">Documentation and approval of the change.<\/li>\n<li data-section-id=\"ol0j42\" data-start=\"13115\" data-end=\"13133\">A rollback plan.<\/li>\n<\/ul>\n<p data-start=\"13135\" data-end=\"13271\">A modular architecture may reduce the technical effort required to replace a model, but it does not remove the need for control testing.<\/p>\n<h4 data-section-id=\"10qpqv0\" data-start=\"13273\" data-end=\"13309\"><em>Documentation and accountability<\/em><\/h4>\n<p data-start=\"13311\" data-end=\"13364\">Organisations should maintain documentation covering:<\/p>\n<ul data-start=\"13366\" data-end=\"13766\">\n<li data-section-id=\"djqepb\" data-start=\"13366\" data-end=\"13409\">The purpose and scope of the AI use case.<\/li>\n<li data-section-id=\"1t2a0zl\" data-start=\"13410\" data-end=\"13451\">The business owner and technical owner.<\/li>\n<li data-section-id=\"2iv61a\" data-start=\"13452\" data-end=\"13480\">Systems and data accessed.<\/li>\n<li data-section-id=\"16ra9yo\" data-start=\"13481\" data-end=\"13516\">Permitted and prohibited actions.<\/li>\n<li data-section-id=\"1fg420w\" data-start=\"13517\" data-end=\"13548\">Approval and exception rules.<\/li>\n<li data-section-id=\"1ds80hb\" data-start=\"13549\" data-end=\"13577\">Model and prompt versions.<\/li>\n<li data-section-id=\"eadfs0\" data-start=\"13578\" data-end=\"13598\">Testing performed.<\/li>\n<li data-section-id=\"14sa1d3\" data-start=\"13599\" data-end=\"13625\">Monitoring arrangements.<\/li>\n<li data-section-id=\"1qf4mps\" data-start=\"13626\" data-end=\"13657\">Incident-response procedures.<\/li>\n<li data-section-id=\"xfnfbk\" data-start=\"13658\" data-end=\"13702\">Data-retention and residency requirements.<\/li>\n<li data-section-id=\"1plx3lh\" data-start=\"13703\" data-end=\"13726\">Performance measures.<\/li>\n<li data-section-id=\"dh4d7a\" data-start=\"13727\" data-end=\"13766\">Control deficiencies and remediation.<\/li>\n<\/ul>\n<p data-start=\"13768\" data-end=\"13911\">Responsibility for the process should remain clearly assigned. Accountability should not be transferred to the AI provider or the agent itself.<\/p>\n<h3 data-section-id=\"1yoyjht\" data-start=\"13913\" data-end=\"13941\">Action points<\/h3>\n<p data-start=\"13943\" data-end=\"13987\">Organisations considering agentic AI should:<\/p>\n<ol data-start=\"13989\" data-end=\"14895\">\n<li data-section-id=\"opgvt2\" data-start=\"13989\" data-end=\"14067\">Identify a specific finance or business process with a measurable baseline.<\/li>\n<li data-section-id=\"1k1ikda\" data-start=\"14068\" data-end=\"14149\">Map the end-to-end process, including manual activities and system interfaces.<\/li>\n<li data-section-id=\"fgptjk\" data-start=\"14150\" data-end=\"14219\">Assess data quality, ownership, confidentiality and permitted use.<\/li>\n<li data-section-id=\"1frd0vt\" data-start=\"14220\" data-end=\"14299\">Separate probabilistic interpretation from controlled transaction execution.<\/li>\n<li data-section-id=\"10ffu1l\" data-start=\"14300\" data-end=\"14376\">Define agent access rights, transaction limits and human approval points.<\/li>\n<li data-section-id=\"juihl4\" data-start=\"14377\" data-end=\"14421\">Update segregation-of-duties assessments.<\/li>\n<li data-section-id=\"18w85ou\" data-start=\"14422\" data-end=\"14475\">Establish complete audit trails and observability.<\/li>\n<li data-section-id=\"vh1y9c\" data-start=\"14476\" data-end=\"14543\">Implement suspension, rollback and incident-response procedures.<\/li>\n<li data-section-id=\"16fuvyn\" data-start=\"14544\" data-end=\"14629\">Begin with a contained implementation involving limited data, users and authority.<\/li>\n<li data-section-id=\"1w7pea\" data-start=\"14630\" data-end=\"14702\">Test the process before deployment and after any significant change.<\/li>\n<li data-section-id=\"1w2ylmf\" data-start=\"14703\" data-end=\"14782\">Measure actual benefits against financial, operational and risk indicators.<\/li>\n<li data-section-id=\"cz40tm\" data-start=\"14783\" data-end=\"14895\">Involve finance, IT, risk, legal, internal audit and relevant business owners throughout the implementation.<\/li>\n<\/ol>\n<h3 data-section-id=\"8dtpi\" data-start=\"14897\" data-end=\"14910\">Conclusion<\/h3>\n<p data-start=\"14912\" data-end=\"15116\">Agentic AI may improve transaction processing, financial analysis and operational efficiency, but greater autonomy also increases the potential for financial loss, control failure and regulatory exposure.<\/p>\n<p data-start=\"15118\" data-end=\"15475\" data-is-last-node=\"\" data-is-only-node=\"\">Effective implementation will depend on reliable data, integrated systems, deterministic workflows, appropriate human oversight and a clear audit trail. Finance leaders should therefore assess agentic AI within the organisation\u2019s existing governance, risk-management and internal-control frameworks rather than treating it solely as a technology initiative.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The development of agentic artificial intelligence is expanding the role of AI from generating content and analysis to initiating transactions, accessing multiple systems and completing multi-step business processes. For finance functions, this creates opportunities to improve efficiency, reporting and exception management. It also introduces new risks relating to data quality, internal controls, auditability, regulatory compliance [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":3607,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"nf_dc_page":"","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[7,23,6],"tags":[],"class_list":["post-3605","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-accounting","category-artificial-intelligence-ai","category-techupdates"],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/ehluar.com\/main\/wp-content\/uploads\/2026\/07\/ChatGPT-Image-Jul-15-2026-08_55_56-PM-e1784120236157.png?fit=1000%2C667","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"http:\/\/ehluar.com\/main\/wp-json\/wp\/v2\/posts\/3605","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/ehluar.com\/main\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/ehluar.com\/main\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/ehluar.com\/main\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/ehluar.com\/main\/wp-json\/wp\/v2\/comments?post=3605"}],"version-history":[{"count":1,"href":"http:\/\/ehluar.com\/main\/wp-json\/wp\/v2\/posts\/3605\/revisions"}],"predecessor-version":[{"id":3608,"href":"http:\/\/ehluar.com\/main\/wp-json\/wp\/v2\/posts\/3605\/revisions\/3608"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/ehluar.com\/main\/wp-json\/wp\/v2\/media\/3607"}],"wp:attachment":[{"href":"http:\/\/ehluar.com\/main\/wp-json\/wp\/v2\/media?parent=3605"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/ehluar.com\/main\/wp-json\/wp\/v2\/categories?post=3605"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/ehluar.com\/main\/wp-json\/wp\/v2\/tags?post=3605"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}