AI Governance: A 6-Step Audit Checklist for CFOs

That is the question that safeguards the reputation of the CFO because AI does not announce itself when it starts making calls on your behalf. It slips into the workflow quietly. A rule that flags an invoice. A model that forecasts cash. A tool that categorises a transaction and closes the loop before a human ever looks. None of it feels like a decision at the time. All of it becomes your responsibility the moment someone asks you to explain the number. Plenty of finance functions have impressive AI, which is great to see, but can we explain and defend what it is doing? So here is the audit I would run. Not a strategy exercise. A finance-function audit. Six questions, each with what good looks like and the red flag to watch for. Ask them of every AI tool already touching your ledgers, your reporting, and your cash. 

1. Where is AI making decisions in month-end, and who signs those off? 

Month-end is where AI quietly earns its keep. Reconciliations, accruals, matching, journal suggestions. All fair game. The risk is that AI moves from suggesting to deciding without anyone noticing the line was crossed. 

• What good looks like: Every AI-assisted step in month-end has a named human owner and a documented sign-off. You can point to where the machine proposed and where a person approved. 
• Red flag: Nobody can tell you which parts of the close were touched by AI, or a journal posted itself and no one can say who approved it. 

2. Can you produce the audit trail for an AI-generated number on demand? 

If your auditor, your board, or the FCA asks how a figure was reached, "the system did it" is not an answer. Governed AI leaves a trail. You should be able to reconstruct the logic, the inputs, and the moment of human review. 

• What good looks like: Every AI-influenced output has a traceable record. Inputs, model action, exception handling, and human approval are all logged and retrievable.
• Red flag: The reasoning lives inside a tool you cannot inspect, and the trail stops at "the AI worked it out." 

3. What happens when the AI gets it wrong? 

This is the question most vendors gloss over. AI will make mistakes. The test of a real implementation is not whether it errs, it is what happens next. A misclassified transaction, a duplicate payment, a forecast that drifts. Where does the exception go? 

• What good looks like: A live exception queue. Anything the AI is not confident about, or gets wrong, routes to a person before it lands in the numbers. Someone owns that queue.
• Red flag: Errors surface weeks later in a reconciliation break, or worse, in the audit. There is no queue and no owner. 

4. Who has access to the financial data your AI tools touch, and where does it live? 

AI in finance runs on your most sensitive data. Ledgers, payroll, customer records, forecasts. Access and residency are not IT footnotes. They are your exposure. 

• What good looks like: Role-based access you can list on request. You know which country your data sits in, whether it is used to train anyone else's model, and that the vendor holds SOC 2 or the appropriate standard for your industry. 
• Red flag: Anyone with a login can see everything, or nobody can tell you where the data is processed or whether it feeds a shared model. 

5. Is AP or AR making payment or credit decisions without a human in the loop? 

This is where the stakes get real. AI that approves payments, sets credit limits, or chases debt is acting on money moving in and out of the business. Automation here is genuinely valuable. Ungoverned automation here is how fraud and error scale. 

• What good looks like: Clear thresholds. Below a defined limit and within defined rules, AI can act. Above it, or outside the rules, a human decides. Every automated action is logged and reversible.
• Red flag: Payments release or credit terms change on the AI's say-so alone, with no threshold and no reviewable log. 

6. Can you explain your AI-assisted reporting to the board without the vendor in the room? 

If you cannot explain how a board pack number was produced, you do not control that number. You are presenting someone else's black box and putting your name on it. 

• What good looks like: You understand the AI's role in your reporting well enough to defend it in a board meeting, unaided. Board-ready means you can stand behind every figure.
• Red flag: The only person who can explain the output works for the software company. 

The Spine of All Six 

Every one of these questions points at the same thing: Can you explain and defend what your AI is doing on your behalf?That is not a brake on AI. The point is the opposite of caution. Governance is what makes the implementation last.

Get the foundations right, then automation and AI, in that order, and it holds up under pressure. Skip them, and the first hard question brings the whole thing down. So stop counting how much AI you use. Start mapping where it makes decisions you would have to defend tomorrow. 

Not Sure Where to Start?

Most finance leaders we speak to cannot answer all six questions cleanly on the first pass. That is normal, and it is fixable. This is exactly the work our one-day finance AI diagnostic is built for. We map where AI already sits in your finance function, where the decisions are being made, and where the governance gaps are. You come away with a clear picture and a prioritised list, not a sales pitch. If you are unsure where to start, that is where we can help. And if you would rather work through it alongside other finance leaders first, come into the FIN community. We run drop-in clinics for exactly these questions, and you will find you are not the only one asking them. Which of the six would you struggle to answer today? That is usually the best place to begin.