What changes in your controls when an agent can post to the ledger. · VANDAM

This page as Markdown llms.txt llms-full.txt services.json sitemap.xml
# What changes in your controls when an agent can post to the ledger. · VANDAM

> How AI agents in AP and the close change SOX controls: segregation of duties, change management, audit trails, sign-off, and a 10-point checklist.

URL: https://vandam.ai/notes/agents-and-internal-controls  
Contact: hendrik@vibelab.be

# What changes in your controls when an agent can post to the ledger.

Once an AI agent posts entries, approves invoices or touches vendor records, it needs a place in the access matrix, a change process and a human who signs for it. What COSO, the PCAOB and the audit firms actually say, and the checklist we use for an agent in accounts payable.

Hendrik De Winne 25 October 2026 8 min read

On page 13 of its February guidance on generative AI, COSO describes a reconciliation agent that posts entries by itself. It posts only when its match confidence clears a validated threshold and no policy exception fires. Everything else goes to a queue for a person, with enough context to decide. Any change to that threshold needs approval from more than one person, logged evidence, sampling after the change and ongoing monitoring of how the model behaves. The paper, [Achieving Effective Internal Control Over Generative AI](https://www.coso.org/generative-ai), came out on 23 February 2026, written by a team led by David Wood of Brigham Young University with authors from EY and Meta.

That short example holds most of what changes when an agent stops drafting and starts acting in your ledger. The controls themselves are familiar. What moves is where they sit and who owns them: the agent becomes a user that needs its own access rights, its configuration becomes something you change-manage, and somebody with a name has to answer for what it posted. This note covers what the guidance actually says, what regulators have and have not said, and the checklist we use for an agent in accounts payable.

- **74%**
  Share of US organizations hit by business email compromise in 2025, per the [AFP](https://www.financialprofessionals.org/about/learn-more/press-releases/Details/over-75-percent-of-us-firms-experienced-payments-fraud-in-2025-while-ai-adoption-for-fraud-mitigation-lags) 2026 survey.
- **42%**
  Share of finance organizations fully ready to produce audit evidence for AI-enabled processes, per a 2026 survey by [KPMG](https://kpmg.com/xx/en/media/press-releases/2026/05/ai-adoption-in-finance-doubles-but-assurance-readiness-determines-who-wins.html).
- **21%**
  Share of companies reporting a mature governance model for autonomous agents, per [Deloitte](https://www.deloitte.com/us/en/programs/center-for-controllership/blogs/taming-ai-in-finance.html).

## No US regulator has written an AI rule for your controls

Start with what is not there. The SEC has not issued a rule on AI in internal control over financial reporting, and the PCAOB has no auditing standard specific to AI. Sarbanes-Oxley still asks the same things it always did: management assesses ICFR, the CEO and CFO certify, and for larger filers the auditor attests. An agent changes how you meet those duties, and the duties stay with the same people.

The PCAOB is openly asking whether it should act. In [Release No. 2026-005](https://assets.pcaobus.org/pcaob-dev/docs/default-source/standards/standard-setting-agenda-request-for-comment/request-for-public-comment-on-pcaob-standard-setting.pdf?sfvrsn=4cf12519_2), dated 23 June 2026, the Board summarized commenters who want it to address how a company’s use of AI affects risk assessment, auditing internal controls and what counts as sufficient audit evidence. It noted “no consensus” on whether that should come as staff guidance or a standard, and asked again. Comments closed on 7 August. Its earlier [staff Spotlight](https://pcaobus.org/documents/generative-ai-spotlight.pdf) from July 2024, which carries no Board authority, recorded audit firms saying that preparers’ use of GenAI “could amplify certain existing information technology risks,” and named segregation of duties as the example.

Inspectors are watching anyway. At the AICPA’s SEC and PCAOB conference in December 2025, Christine Gunia, who directs PCAOB inspections, said inspectors “will continue to be focused on AI as well in our 2026 work,” and acting chair George Botic warned about auditors “becoming reliant on agentic AI,” as reported by [Accounting Today](https://www.accountingtoday.com/news/pcaob-warns-auditors-about-ai-and-pe). Those remarks were about auditors’ own tools. The same skepticism will reach the client’s agents through the audit.

So the working references are voluntary. COSO’s GenAI paper extends the 2013 framework most SOX programs already use. In June, Financial Executives International’s Committee on Corporate Reporting published an [AI framework for ICFR](https://www.financialexecutives.org/About-FEI/For-the-Press/2026/fei-ccr-ai-framework-internal-control-financial.aspx) written by controllers and chief accounting officers from large public companies, built around validating outcomes. The [IIA’s AI Auditing Framework](https://www.theiia.org/en/content/tools/professional/2023/the-iias-updated-ai-auditing-framework/) covers the internal audit side. None of these is a requirement. Your auditor will still read them, and [Deloitte’s summary](https://dart.deloitte.com/USDART/home/publications/deloitte/heads-up/2026/coso-internal-controls-generative-ai) of the COSO paper tells management to agree with internal and external auditors on “what constitutes sufficient, appropriate evidence” for GenAI-enabled controls.

## The first question is whether you rely on the agent

COSO offers a working definition that I find the most useful sentence in the paper. Reliance occurs “when management depends on outputs generated by an AI system as part of the evidence supporting an ICFR control’s design or operating effectiveness.” Its example: an agent matches journal entries to support, and a manager approves the posting looking only at the agent’s output. That is reliance. If the control owner re-performs the match on all items or a sample and documents it, that is not.

The line matters because it sets your evidence bill. Where you rely, COSO says the agent’s control should meet normal ICFR evidence standards, including the documented prompt, configuration and model version, a clear sampling rationale and retained evidence. Where you do not, the bar is lower. It is easy to drift into reliance without deciding it. A reviewer approves a long batch of agent-coded invoices in a few minutes, and the documentation says “reviewed.” An auditor will read that as reliance with weak evidence.

## The agent needs its own place in the access matrix

Segregation of duties exists so that no single person can initiate, approve and record the same transaction. An agent running on one service account with broad ERP access can do all three, and nobody notices because it never appears in the user access review. COSO’s answer is plain: “Separate the ability to configure AI settings from the authority to approve or review outputs,” document SoD matrices, and define posting authority by role. For agents that orchestrate multi-step work, it lists “routing rules that create SoD violations” as a key risk.

In practice this means treating each agent as a distinct user with its own credentials, its own role and a named human owner, and running it through the same quarterly access review as people. It also means checking the people behind the agent. If the AP manager can both change the agent’s instructions and approve its exceptions, the conflict sits with the AP manager, even if the agent’s own permissions look clean.

## Prompts and thresholds are now change-managed configuration

Traditional automation is deterministic. You test a three-way match rule once, lock it, and test the change control around it. An agent can behave differently after a vendor updates the model, after someone edits a prompt or after new documents land in its retrieval source. COSO asks companies to treat models and their “configurations, fine-tuning artifacts, embeddings, RAG indexes” as configuration items under access control and change management “just like any other IT asset,” with documented approvals for changes to prompts, thresholds and retrieval sources. It flags “threshold creep leading to over-automation” as its own risk.

The vendor update is the part most change processes miss. Your team changed nothing, the provider shipped a new model version, and the agent’s accuracy on your invoices moved. COSO calls for trigger reviews on vendor and model changes. I would write that trigger into the change policy explicitly, with a regression test set of real invoices that must pass before the new version posts anything.

## The audit trail has to capture what the agent saw and used

An ERP log records that a user posted an entry. For an agent that is not enough to investigate a bad entry or support reliance. COSO describes an AI “bill of materials” that should contain “logs of prompts, outputs, system messages, model version, parameters, and plugins used,” and for automated posting it asks for “full audit trails for unattended postings” and override rationales attached to transaction records.

For a public company there is one more trail to think about. Item 308(c) of [Regulation S-K](https://www.law.cornell.edu/cfr/text/17/229.308) requires disclosure of any change in ICFR during the quarter that materially affected, or is reasonably likely to materially affect, those controls. Replacing a manual key control with an agent may or may not reach that bar. Somebody should decide that on purpose, with the auditor, before go-live.

## Private companies are audited on the same logic

A private company has no Section 404 report, but its auditor still looks at these controls. Under the AICPA’s risk assessment standard, SAS No. 145, auditors must identify the IT applications that carry risk, those risks and the general IT controls that address them, as the [Journal of Accountancy](https://www.journalofaccountancy.com/issues/2023/nov/considering-it-risk-during-audit-risk-assessment-procedures.html) explains. An agent that posts to the ledger is such an application. Testing whether those controls operate is generally required only where the auditor plans to rely on them, but design weaknesses the auditor finds can still be reported to those charged with governance. And the companies that will someday face a buyer’s diligence team, a lender’s covenant review or an IPO readiness assessment are the ones that most need clean evidence now.

## A control checklist for an agent in accounts payable

AP is where most mid-market companies put their first acting agent, and it is where the money leaves. The [AFP](https://www.financialprofessionals.org/about/learn-more/press-releases/Details/over-75-percent-of-us-firms-experienced-payments-fraud-in-2025-while-ai-adoption-for-fraud-mitigation-lags) found **76%** of US organizations faced attempted or actual payments fraud in 2025, with business email compromise at **74%**. An agent that reads email and PDFs is exposed to the same tricks as a clerk, faster. This is the list we work through before an AP agent touches production.

**1. Identity.** The agent runs on its own service account, never a person’s login or a shared one, and has one named owner in finance who answers for its output.

**2. Scope.** The agent may extract invoice data, code to the GL, propose matches and route exceptions. It may not create or edit vendor master records, release payments or approve its own exceptions. Write this into the SoD matrix as a row, like any role.

**3. Vendor records.** The agent can flag a requested change to bank details and draft it. A person verifies it by calling a number already on file, and a second person approves it. The agent never acts on payment instructions that arrive by email or inside an invoice.

**4. Untrusted input.** Treat every invoice and email as untrusted. Text inside a document must not change the agent’s instructions. COSO lists prompt injection among the GenAI risks control activities must address. Test it with planted instructions before go-live.

**5. Thresholds.** Auto-posting only below a dollar limit and above a validated confidence level, recorded in a threshold register. Changing either needs two approvers and a sample check afterward.

**6. Configuration.** Prompts, tools, model version and retrieval sources sit under change management. A model update from the vendor counts as a change and must pass a regression set of your own invoices.

**7. Logs.** For every posting: source document, extracted fields, prompt and model version, the decision, confidence, and who approved any exception. Retain them on the same schedule as the transaction records.

**8. Reliance decision.** For each key control the agent touches, write down whether management relies on its output. If yes, plan evidence to ICFR standard and agree it with the auditor.

**9. Monitoring.** Track override and reversal rates, exception aging and duplicate payment hits monthly, and re-perform a sample of auto-posted invoices by hand each quarter.

**10. Stop and fall back.** One person can switch the agent off, and the manual process is documented well enough to run the next day.

## What to do in the next 30 days

For a CFO or controller, the order matters more than the tooling. First, inventory every agent or AI feature that writes to the ERP, the vendor master or the payment system, including features your vendors switched on in their own releases. Second, put each one into the access matrix and run the next user access review with them in it. Third, take the agent closest to a key control, usually AP coding or reconciliations, and make the reliance decision in writing with the controller and internal audit. Fourth, book an hour with your external audit partner before the next quarter starts and walk them through the checklist above. Having that conversation before go-live is much easier than having it after year-end testing finds the agent in the logs.

## More notes

29 October 2026 6 min read

## Who owns what your AI learns.

Y Combinator now asks for startups that help companies own their intelligence. Before a mid-sized company owns a model, it can own the four things every model works with: context, evals, rules and connections.

26 October 2026 9 min read

## Delete the step first and give the agent whatever survives.

Musk’s five-step method puts automation last, and most AI programs start there because an agent is the one step a vendor can sell. I walk accounts payable through the steps in his order and show why an agent that clears exceptions fast hides the steps that should go.

## Your agents need a critic and so does the plan they carry out.

Models grade their own work too kindly, and the labs now separate the agent that makes from the agent that checks, the way finance separates maker and checker. I set out a four-layer review design with a minutes budget, and why the brief itself needs a critic with no stake in it.