Start by treating AI like a new junior analyst: it can prepare a draft, a reconciliation or a variance note, but it never approves, posts or pays anything, and a named person reviews its work and keeps the evidence. Write those rules down before anyone uploads a ledger, which takes one afternoon with Roll Out a Team AI Policy in One Afternoon using Claude.
Finance has something most departments do not: a control environment. Review and approval steps, segregation of duties, an audit trail, and for public companies, internal control over financial reporting that auditors test. AI fits inside that structure easily if you place it in the preparer role. It breaks controls when it quietly becomes the reviewer, or when nobody can show later what it was given and what it changed.
Which controls does AI touch?
- Review and approval. Anything AI prepares (a journal entry proposal, a reconciliation, a forecast note) still gets the same human review as work prepared by a person.
- Segregation of duties. If the same person runs the AI and approves its output, you have the same problem as one person preparing and approving their own entry.
- Evidence. Keep the input file, the prompt and the output with the workpaper, so a reviewer or auditor can see what was done.
- Data access. An AI tool connected to your ERP or file shares can see whatever its permissions allow. Check those permissions like any other system access.
- Confidential and inside information. Unreleased results, deal plans and board materials stay out of any tool your company has not approved for them. For a listed company, unreleased results can be material nonpublic information.
- Spreadsheet controls. AI-built workbooks need the same checks as any key spreadsheet: formulas instead of typed numbers, totals tied out, a version you can find later.
What is a controls-first rollout plan?
- Write the one-page rules. Approved tools, what never goes in (bank and card numbers, tax IDs, payroll identifiers, unreleased results), who reviews, how to report a mistake without blame.
- Pick one approved tool on a business plan with training off: ChatGPT, Claude or Microsoft 365 Copilot, whichever your IT team has set up.
- Start with low-risk, high-volume preparation: explaining variances in plain words, drafting the commentary for a management pack, cleaning a messy export.
- Add a review line to each workpaper: "prepared with AI, reviewed by [name], inputs attached."
- Tie out every number to the system of record before it goes anywhere.
- Only then try automation, such as invoice capture or bank matching, with an approval step for anything that posts or pays.
What does this look like in a real lesson?
In the Claude policy lesson you work at an 18-person consulting firm where people already use AI on personal accounts, and someone pasted client numbers into a free tool last month. You give Claude your rules (which tools, what never goes in, who checks, who to ask) and a line telling it not to invent laws, and it writes a one-page policy. You check three sections: the never-paste list includes client financials with names, the rule that a person checks every output makes the sender responsible, and a no-blame rule says to report a wrong paste the same day. Then Claude writes the announcement email and a five-question true or false quiz, including one that catches a common mistake: an approved tool with no human check is still against the rules.
For the analysis habit itself, Analyze a Spreadsheet has ChatGPT check a file for duplicates and blank cells before it calculates anything, and ends with one thing to double-check against your own records.
What mistakes should I avoid?
- Letting AI be the reviewer. "I had AI check my reconciliation" is not a review. A person signs off.
- No evidence trail. If the chat is gone, nobody can show how a number was produced.
- Pasting unreleased results into an unapproved tool because the deadline is close.
- Trusting AI arithmetic. It can add wrong. Tie every total to the ledger.
- Connecting AI to the ERP first. Start with exports you control, then widen access deliberately.
For more on where AI fits in finance processes, read How to Add AI to Finance Workflows and the AI prompts for financial analysts. For data safety habits, see Use AI at Work Without Leaking Client Data, and for one common first task, Can AI explain budget vs actual variances for my monthly report?
Key takeaways
- AI prepares, people review and approve. Keep segregation of duties.
- Keep the input, prompt and output with the workpaper.
- Bank details, tax IDs and unreleased results stay out.
- Tie every AI number to the system of record before anyone relies on it.
Frequently asked questions
- Will our auditors accept work prepared with AI?
Auditors look at whether controls work, not whether a person typed every cell. Show them the review, the evidence and the tie-outs, and talk to them early about how your team uses AI.
- Is Microsoft 365 Copilot safer for finance than ChatGPT?
It can be the easier choice if your files already live in Microsoft 365 under your company's agreement. The same controls apply: review, evidence and access limits matter more than the brand.
- What is the safest first AI task for a finance team?
Writing plain-language commentary from numbers you already reviewed, such as explaining a variance for a management pack. The numbers are already checked, so the AI only drafts the words.