# How should a finance team start using AI without breaking controls? > Treat AI as a preparer, never an approver: written rules, an approved tool, a person who reviews and evidence you keep. A plan for finance, free lessons. Source: https://learn.ynteractive.com/content/questions/how-to-start-using-ai-in-finance · Updated 2026-10-21 · Free from Stepthrough (https://learn.ynteractive.com) By [Robert Breen](https://learn.ynteractive.com/content/about) · Published October 21, 2026 · Updated October 21, 2026 · 4 min read Start by treating AI like a new junior analyst: it can prepare a draft, a reconciliation or a variance note, but it never approves, posts or pays anything, and a named person reviews its work and keeps the evidence. Write those rules down before anyone uploads a [ledger](https://learn.ynteractive.com/content/glossary/general-ledger), which takes one afternoon with [Roll Out a Team AI Policy in One Afternoon using Claude](https://learn.ynteractive.com/content/ai-acceptable-use-policy-claude). Finance has something most departments do not: a control environment. Review and approval steps, segregation of duties, an [audit trail](https://learn.ynteractive.com/content/glossary/audit-trail), and for public companies, internal control over financial reporting that auditors test. AI fits inside that structure easily if you place it in the preparer role. It breaks controls when it quietly becomes the reviewer, or when nobody can show later what it was given and what it changed. ## Which controls does AI touch? - **Review and approval.** Anything AI prepares (a [journal entry](https://learn.ynteractive.com/content/glossary/journal-entry) proposal, a reconciliation, a forecast note) still gets the same human review as work prepared by a person. - **Segregation of duties.** If the same person runs the AI and approves its output, you have the same problem as one person preparing and approving their own entry. - **Evidence.** Keep the input file, the prompt and the output with the workpaper, so a reviewer or auditor can see what was done. - **Data access.** An AI tool connected to your ERP or file shares can see whatever its permissions allow. Check those permissions like any other system access. - **Confidential and inside information.** Unreleased results, deal plans and board materials stay out of any tool your company has not approved for them. For a listed company, unreleased results can be material nonpublic information. - **Spreadsheet controls.** AI-built workbooks need the same checks as any key spreadsheet: formulas instead of typed numbers, totals tied out, a version you can find later. ## What is a controls-first rollout plan? 1. **Write the one-page rules.** Approved tools, what never goes in (bank and card numbers, tax IDs, payroll identifiers, unreleased results), who reviews, how to report a mistake without blame. 2. **Pick one approved tool** on a business plan with training off: ChatGPT, Claude or Microsoft 365 Copilot, whichever your IT team has set up. 3. **Start with low-risk, high-volume preparation**: explaining variances in plain words, drafting the commentary for a management pack, cleaning a messy export. 4. **Add a review line to each workpaper**: "prepared with AI, reviewed by [name], inputs attached." 5. **Tie out every number** to the system of record before it goes anywhere. 6. **Only then try automation**, such as invoice capture or bank matching, with an approval step for anything that posts or pays. ## What does this look like in a real lesson? In the Claude policy lesson you work at an 18-person consulting firm where people already use AI on personal accounts, and someone pasted client numbers into a free tool last month. You give Claude your rules (which tools, what never goes in, who checks, who to ask) and a line telling it not to invent laws, and it writes a one-page policy. You check three sections: the never-paste list includes client financials with names, the rule that a person checks every output makes the sender responsible, and a no-blame rule says to report a wrong paste the same day. Then Claude writes the announcement email and a five-question true or false quiz, including one that catches a common mistake: an approved tool with no human check is still against the rules. For the analysis habit itself, [Analyze a Spreadsheet](https://learn.ynteractive.com/content/chatgpt-analyze-spreadsheet-csv) has ChatGPT check a file for duplicates and blank cells before it calculates anything, and ends with one thing to double-check against your own records. ## What mistakes should I avoid? - **Letting AI be the reviewer.** "I had AI check my reconciliation" is not a review. A person signs off. - **No evidence trail.** If the chat is gone, nobody can show how a number was produced. - **Pasting unreleased results** into an unapproved tool because the deadline is close. - **Trusting AI arithmetic.** It can add wrong. Tie every total to the ledger. - **Connecting AI to the ERP first.** Start with exports you control, then widen access deliberately. For more on where AI fits in finance processes, read [How to Add AI to Finance Workflows](https://learn.ynteractive.com/content/blog/how-to-add-ai-to-finance-workflows) and the [AI prompts for financial analysts](https://learn.ynteractive.com/content/prompts/roles/financial-analysts). For data safety habits, see [Use AI at Work Without Leaking Client Data](https://learn.ynteractive.com/content/safe-ai-at-work-what-not-to-paste), and for one common first task, Can AI explain budget vs actual variances for my monthly report? ## Key takeaways - AI prepares, people review and approve. Keep segregation of duties. - Keep the input, prompt and output with the workpaper. - Bank details, tax IDs and unreleased results stay out. - Tie every AI number to the system of record before anyone relies on it. ## Frequently asked questions **Will our auditors accept work prepared with AI?** Auditors look at whether controls work, not whether a person typed every cell. Show them the review, the evidence and the tie-outs, and talk to them early about how your team uses AI. **Is Microsoft 365 Copilot safer for finance than ChatGPT?** It can be the easier choice if your files already live in Microsoft 365 under your company's agreement. The same controls apply: review, evidence and access limits matter more than the brand. **What is the safest first AI task for a finance team?** Writing plain-language commentary from numbers you already reviewed, such as explaining a variance for a management pack. The numbers are already checked, so the AI only drafts the words. ## Learn it hands-on Free, interactive lessons: you do every step yourself in a practice copy of the real tool, it checks your work as you go, and nothing touches your real accounts. - [Roll Out a Team AI Policy in One Afternoon using Claude](https://learn.ynteractive.com/content/ai-acceptable-use-policy-claude): Your team already uses AI, with or without rules. Have Claude write a one-page acceptable use policy from your rules, check the parts that matter… (about 10 minutes) - [Analyze a Spreadsheet with ChatGPT: Upload a CSV, Get a Chart and Three Takeaways](https://learn.ynteractive.com/content/chatgpt-analyze-spreadsheet-csv): Upload a CSV of sales to ChatGPT, have it check the data first, ask your questions, get a chart you can download, and finish with the three… (about 10 minutes) - [Use AI at Work Without Leaking Client Data using ChatGPT](https://learn.ynteractive.com/content/safe-ai-at-work-what-not-to-paste): Turn off model training, strip a tenant's bank details and address out of a prompt, then catch the two promises ChatGPT made up before the reply… (about 7 minutes) [Start the free lesson](https://learn.ynteractive.com/modules/claude-team-ai-policy) ## AI tools in this answer Each one in the Stepthrough AI tools directory: what it does, who it is for and the free lesson where there is one. [ChatGPT](https://learn.ynteractive.com/content/ai-tools/tool/chatgpt) · [Claude](https://learn.ynteractive.com/content/ai-tools/tool/claude) · [Microsoft 365 Copilot](https://learn.ynteractive.com/content/ai-tools/tool/microsoft-365-copilot) [The full AI tools directory](https://learn.ynteractive.com/content/ai-tools) ## Related terms Plain-English definitions, each with an example from a free lesson. [General ledger](https://learn.ynteractive.com/content/glossary/general-ledger) · [Audit trail](https://learn.ynteractive.com/content/glossary/audit-trail) · [Journal entry](https://learn.ynteractive.com/content/glossary/journal-entry) · [AI policy](https://learn.ynteractive.com/content/glossary/ai-policy) · [CSV](https://learn.ynteractive.com/content/glossary/csv) · [Improve the model for everyone](https://learn.ynteractive.com/content/glossary/improve-the-model-for-everyone) [The full AI glossary](https://learn.ynteractive.com/content/glossary) ## Related prompts - [ChatGPT settings checklist prompt](https://learn.ynteractive.com/content/prompts/chatgpt-account-settings-checklist-prompt): A copy-ready prompt that turns your plan and data rules into a one-page checklist of ChatGPT settings for staff, with a column… - [Timesheet summary prompt](https://learn.ynteractive.com/content/prompts/timesheet-summary-prompt): A ChatGPT prompt that turns a timesheet export into a summary: hours by person and project, missing days, unusual entries and… - [AI assistant answer scorecard prompt](https://learn.ynteractive.com/content/prompts/ai-assistant-answer-scorecard-prompt): A prompt that checks four AI assistants' answers to the same task against your own facts and fills a scorecard, so you can pick… [All free prompt templates](https://learn.ynteractive.com/content/prompts) ## Related questions - [How should L&D roll out AI training to the whole company?](https://learn.ynteractive.com/content/questions/how-to-train-staff-to-use-ai): Start with a one-page AI policy, then hands-on practice on real tasks, then role-based tracks. An L&D rollout plan with free… - [Can AI run payroll, or only help around it?](https://learn.ynteractive.com/content/questions/can-ai-run-payroll): No, the pay math, tax filing and deposits stay in your payroll system. AI helps with pre-run checks, employee questions and… - [How should an IT team roll out ChatGPT or Copilot to the whole company?](https://learn.ynteractive.com/content/questions/how-it-teams-roll-out-ai-safely): Pick one assistant, lock down the tenant and data settings, fix oversharing, pilot with a small group, then roll out with a… - [Can lawyers use ChatGPT without breaking their ethics rules?](https://learn.ynteractive.com/content/questions/can-lawyers-use-chatgpt-ethically): Yes, if you understand the tool, protect client confidences, supervise staff, verify every citation and bill fairly. Not legal… - [How do I convince my boss to let our team use AI?](https://learn.ynteractive.com/content/questions/convince-boss-to-allow-ai): Bring one low-risk use case, a short trial, data rules written down and a demo you ran yourself. A step-by-step pitch, with free… - [How are compliance teams using AI?](https://learn.ynteractive.com/content/questions/how-compliance-teams-use-ai): Compliance teams use AI to compare rule and policy versions, answer questions from their own documents with citations, and write… [More questions: AI by department](https://learn.ynteractive.com/content/questions/by-department) · [All AI questions](https://learn.ynteractive.com/content/questions) · [All free tutorials](https://learn.ynteractive.com/content)