AI in accounting means software that reads, sorts, matches or drafts finance records using a trained model. Each use has a different failure mode, so each needs a different control. The controls matter most where the AI output feeds the books or the audit file.
Last reviewed: 17 October 2026. Facts checked. We ran a web search on AI use cases in accounting (invoice processing, reconciliation, controls and risks). Most results were vendor pages, so we treat their performance claims as unverified and cite none. We opened OWASP's LLM06 page on excessive agency and NIST's AI Risk Management Framework page. We did not open ICAI or other regulator guidance for this post.
What "AI in accounting" covers
It is a broad phrase. It can mean a model that reads invoices, a rule engine with a prediction layer, or an assistant that drafts a note to a client. Each behaves differently. Start by naming the specific job.
Use cases and the control each needs
| Use case | What can go wrong | Control to put in place |
|---|---|---|
| Invoice capture (reading fields from documents) | Wrong amount, tax or vendor read from a poor scan | Keep the source document linked to the entry. Sample-check against source |
| Coding and classification of expenses | Misclassification repeats at scale | Review a sample each month. Track error rate by category |
| Matching and reconciliation (bank, vendor, intercompany) | False matches hide real differences | Review all unmatched items and a sample of matched. Keep the match rule log |
| Duplicate and anomaly detection | Misses unusual cases, or flags too many | Treat flags as leads. Record how each was resolved |
| Approval routing | Approval happens outside the system, with no trail | Keep the approval record in the ERP, with who and when |
| Drafting client emails and notes | Wrong figure or tone sent | A person reads before sending |
| Summarising contracts or minutes | Missed clause, invented term | Reviewer checks against the source |
| Forecasting and variance commentary | Plausible but unsupported reasons | Ask for the data behind each reason |
| Posting entries automatically | Wrong entry reaches the ledger | Approval gate before posting. Limit amounts and accounts |
Search results highlighted the same cautions repeatedly: audit trail, data quality and human review. One warning stood out. A coded invoice can move forward without its source document, which removes the evidence an auditor needs.
Three controls that apply to almost every use
1. Keep the source. Every AI output should point back to the document, row or cell it came from. If it cannot, a reviewer cannot check it.
2. Limit what the AI can do. OWASP calls the problem of an AI taking harmful actions "excessive agency", and lists excessive functionality, permissions and autonomy as causes. Its suggested mitigations include minimising tools, using read-only access where possible and requiring a person to approve high-impact actions. A tool that can only read and suggest is safer than one that can also post.
3. Log it. Record the input, the output, the model and version, the reviewer and the decision. Without a log, you cannot reconstruct what happened.
Who owns the risk
NIST's AI Risk Management Framework is described on its page as voluntary. It groups work under functions it calls Govern, Map, Measure and Manage. You do not need to adopt it formally. It gives a firm a way to ask who is accountable, what is in scope, how it is measured and how it is handled when it fails.
For a finance team, a simple version is:
- A named owner for each AI use.
- A risk register entry (see our risk register template).
- A review frequency.
- A rule for what must never be sent to an outside tool.
What it means for audit evidence
When the client uses AI in its finance process, the auditor needs to understand it as part of the control environment. Questions to ask:
- Which processes use AI, and which models?
- Who reviews output, and is that review evidenced?
- Has the model or prompt changed during the period?
- Where are the logs?
When your own firm uses AI in the audit, the same questions apply to your working papers. See our guide on how to audit AI agents.
Start small
- Pick one repeatable task with a known right answer.
- Run AI and manual side by side for a month.
- Count differences.
- Add controls where the differences appear.
- Expand only after review shows the error rate is acceptable.
Our AI readiness assessment helps you judge where to begin, and the AI use policy template gives a starting policy.
Frequently Asked Questions
What is AI used for in accounting?
Mostly for reading documents, matching records, flagging anomalies and drafting text. Each use needs its own checks.
Can AI post entries without review?
Technically some tools can. A review gate before posting is a sensible control, especially for high-value or unusual entries.
Does AI replace bookkeepers?
We do not make that claim. It changes the work, and the review step becomes more important.
What should an auditor ask a client using AI?
Which processes use it, who reviews output, how changes are controlled and where logs are kept.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error