AI in the SOX 404 Control Environment: What Your Auditor Is Likely to Ask

The finance team has a new tool. It matches invoices to purchase orders, suggests accrual estimates and drafts the reconciliation notes. Month-end closes earlier. Everyone is pleased.

Then the external auditors arrive for the interim review. They ask which controls the tool performs, who reviews what it produces, how a change to it is approved, and whether the team can show that it worked the same way in March as in September.

The finance team has good answers for the spreadsheet it replaced. It has none yet for the tool.

The paradox: The AI step made the close faster, and made the controls around it harder to evidence.

What We Found

Before we recommend anything to a finance team about AI in its close, we read the rules its internal controls answer to. For this article we read the US Securities and Exchange Commission’s definition of internal control over financial reporting (Rule 13a-15 under the Securities Exchange Act) and its disclosure requirement (Item 308 of Regulation S-K), as published on eCFR.

Four findings stand out.

Internal control over financial reporting is a process, and it covers records and transactions. Rule 13a-15(f) defines it as “a process designed by, or under the supervision of, the issuer’s principal executive and principal financial officers … to provide reasonable assurance regarding the reliability of financial reporting”. It includes policies and procedures that “pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the issuer”, and that provide reasonable assurance “that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles”.

Management reports on it every year, and a material weakness rules out “effective”. Item 308(a) requires management’s report to include “a statement of management’s responsibility”, the framework used, and management’s assessment of effectiveness. “Management is not permitted to conclude that the registrant’s internal control over financial reporting is effective if there are one or more material weaknesses”.

Larger filers also need the auditor’s attestation. Under Item 308(b), an accelerated filer or large accelerated filer, other than an emerging growth company, must include “the registered public accounting firm’s attestation report on the registrant’s internal control over financial reporting”. Smaller companies outside those categories are not required to include it.

Changes to the controls are disclosed. Item 308(c) requires disclosure of “any change in the registrant’s internal control over financial reporting … that occurred during the registrant’s last fiscal quarter … that has materially affected, or is reasonably likely to materially affect” those controls.

What our review does not show: We read the SEC’s rules, not the auditing standards auditors work to, the SEC’s interpretive guidance for management, or any company’s control documentation, and nothing here is legal or audit advice. Neither rule mentions artificial intelligence or automation. Whether a particular AI step is part of a company’s internal control over financial reporting, and whether changing it is a change to be disclosed, are judgements for management, its auditor and counsel.

What an Auditor Is Likely to Ask About an AI Step

Our reading is that the rules do not need to mention AI for AI to fall inside them. If a step in the close produces or checks figures that reach the financial statements, it is part of the process the definition describes, whatever technology performs it.

From the rules’ own terms, the questions we would expect an auditor to ask about such a step are these:

• What does it do in the process? Which records or transactions it touches, and whether it performs a control or only assists a person who does.
• Who reviews its output, and how? If a person relies on the output, what that person checks, and the evidence they checked it.
• How is it changed? A new model version, a revised prompt or a provider update is a change to the process. Who approves it, how it is tested, and whether it could “materially affect” the controls.
• Can you show it operated as designed? Evidence across the period, not a demonstration on the day.
• Can you reproduce a result? If the same inputs can produce a different output on a different day, the evidence that it worked in March says little about September.

These are our reading of what follows from the rules. They are not a list published by any regulator or auditor.

The gap we see: finance teams are adding AI to the close faster than they are adding it to their control documentation. Teams that keep generative steps in an assisting role, run the posting and matching decisions on fixed logic they can version and test, and record each change, can bring an AI-assisted close into the annual assessment without a late surprise.

This is our reading of the rules. It is not legal or audit advice and not a measured market figure.

Four Ways to Bring an AI Step Into the Close, Weighed

Option	When it fits	What it risks
Let the AI step post or match directly, and test it like any system	Low-risk accounts, with strong change control	Outputs that vary between runs are hard to evidence over a period; every model update is a change to assess
AI suggests, a person reviews and posts	Judgement-heavy work such as accrual estimates	The review becomes the control; it must be real, documented and not a rubber stamp
AI reads documents; matching and posting run on fixed, versioned logic; people review exceptions	High-volume matching and reconciliations	The matching rules have to be written down and maintained
Keep AI out of the close and use it elsewhere	The company is close to its assessment date, or control documentation is thin	Delay, which should be a stated choice

Our recommendation: for any step whose output reaches the financial statements, keep AI to reading and suggesting, run the decision on fixed logic you can version and test, put a documented review where judgement is involved, and record every change to the AI step as you would any change to the process. Agree the treatment with your auditor before the period you want it to cover.

Where You Are Now, and Where You Should Be

Measure	Typical starting point	Where it should be	How it is checked
AI steps in the close, listed	Known to the finance team only	Each listed, with what it does and whether it performs or assists a control	The control documentation
Review of AI output	Informal	Documented, with what the reviewer checks	Review evidence for the period
Changes to AI steps	Not tracked as control changes	Approved, tested and recorded like any process change	The change log
Evidence of operation	A demonstration	Records across the period	Sample testing
Reproducibility of results	Not tested	The same inputs give the same result where the step decides	A rerun test on period data

The starting points above are what we expect to find. In an engagement they are replaced by your own figures, taken in the first review. The targets are what we would work towards with you. They are not results we have already achieved for a client.

How We Work With You

1. We listen: a free Reliability Review. A first conversation about where AI sits in your close and what your auditors have asked. You leave with a short written note of what we found.
2. We research. We research your sector, the regulator’s position and what the public record says about firms in your situation. This article is an example of that work.
3. We diagnose: the Workflow Diagnostic. It sorts each step of the workflow into compile, keep on an AI model, or don’t automate, and includes a 100-rerun consistency test of your current pilot, a policy-to-rules map, the evidence gaps, the cost per case today against projected, and a change plan. It may recommend another firm or tool, or not automating at all. We take no referral fees on model or platform recommendations.
4. If you approve, we prove it: a Proof Sprint. One workflow, on your own cases, measured for consistency and for accuracy against your own experts. You keep the code.
5. We review against the benchmark. Before work starts we set the benchmark. At each stage we show you where each measure stands, and the filled-in benchmark is yours at the end.

The Review is free. Every paid step is fixed price, agreed at scoping. Stop after any step. The findings are yours. The Diagnostic fee is credited against a Proof Sprint within 90 days.

IOanyT’s own AI management system is certified to ISO/IEC 42001. That certifies how we run our own AI work, not any client’s system or deliverable, and it is not an opinion on anyone’s internal control.

What changes for the business:

Role	What they gain
CRO or Head of Compliance	Every AI step in the close is listed, reviewed and change-controlled before the auditor asks.
CFO	A faster close that still stands up in the annual assessment, with no late finding on an AI step.
CTO or CIO	A clear split: AI reads and suggests, versioned logic decides, and every change is recorded.
Head of AI or Data	AI in finance processes that the controls team can sign off, instead of a pilot kept outside the close.
CEO	Speed in finance without risking the statement that internal control is effective.

The cases in this article, and what IOanyT does about that kind of problem:

The case	What IOanyT does
This article names no organisation as a case. It quotes the SEC’s rules.	The Workflow Diagnostic maps each step of a finance workflow, including where AI touches records, and sets out the evidence gaps for the company’s controls team and auditor.

IOanyT is a consultancy with its own engineering team: we study the problem, recommend, and prove it by building only what you approve. We do not give audit opinions; your auditor does.

Book a free Reliability Review →

Get a fixed quote →

See the Workflow Diagnostic →