By Louis Balla, Chief Revenue Officer, Nuage.
Internal controls for AI in finance work like controls for any other process: a documented approval before AI output reaches the ledger, a saved record of what was reviewed, and an audit trail of who changed what. Auditors will ask to see the source data, the approval chain and the user activity behind each AI-assisted result.
Gaps in control evidence show up during month-end close and audit prep, and in spreadsheet workarounds that exist because a system report takes too long to rebuild. This article maps the control evidence auditors will expect once AI touches approvals, reporting, reconciliations or exception review.
The AI work in our client records is read-only pilots, connector setup and features that flag items for review. Our records show no AI tool posting transactions to a production account, and nothing here assumes one does. The controls below are what we recommend putting in place before that changes.
How does AI change internal controls evidence?
Auditors ask for system evidence of who could access the data, who changed it and who approved it. Finance teams can configure strong workflows and still leave the audit evidence in ad hoc pulls, email threads and spreadsheet tabs.
What are internal controls, in plain finance language?
Internal controls give management a repeatable way to trust the numbers. They define who can approve a transaction, who can change master data, how exceptions get reviewed and how the team proves the control happened.
With AI in the process, an auditor needs to trace both the finance decision and the system activity behind it. Saved reports let your team hand over that evidence without rebuilding it under deadline pressure.
What will auditors ask to see first?
Auditors will ask whether the control exists, then whether your evidence proves it worked. For AI-assisted finance steps, that evidence needs to show the source data, the approval chain and the user activity that led to the final accounting result.
If your controller has to ask someone to rerun a report with “the same filters as last time,” the control evidence has a weakness. Save the report with its filters so the same evidence can be pulled each cycle.
A documented approval chain
Your approval chain should connect policy to transaction activity. A journal entry approval, vendor change approval or revenue adjustment sign-off should show who reviewed it and what they reviewed before the posting moved forward.
AI may suggest a match, draft an accrual or flag an exception. Finance still needs a documented sign-off before that output affects the GL, and the approver needs enough context to make a real decision. Teams that want a stronger baseline for approvals can align workflow design with NetSuite approval workflows that protect finance decisions, especially where approval thresholds and exception routing affect month-end close.
Saved and permissioned reporting
Auditors test what you actually used. A saved report package should carry a consistent name, owner, date range logic and role-based access.
With ad hoc pulls, two users may choose different filters, export different columns or run the same report under different permissions. When the audit team asks who ran the report, under what permissions and when, the answer needs to be in the system, or the company carries extra audit prep risk.
Who changed what and when
The audit trail needs to answer a direct question: who changed what and when. This applies to approval rules, saved searches, role permissions, inventory adjustments and any workflow that affects reported numbers.
A life sciences controller asked our team for one more piece of his quarterly access review: “If there’s a report that kind of tracks changes from the previous reports to now, that would be helpful as well.” Access matters for AI too, because an AI-assisted step may rely on data that a user could edit. Your team should know who can change what before the auditor asks, and the access controls your auditor wants to see should connect roles to real finance duties. For a closer look at logging for AI-assisted work, see our post on keeping an audit trail when AI is doing the work in NetSuite.
Which preventive, detective and corrective controls apply to AI-assisted finance?
Auditors still classify controls as preventive (stopping bad entries), detective (finding exceptions) or corrective (resolving issues before reporting deadlines), and each type applies to AI-assisted steps.
Map each AI-assisted finance step to the control type and control objective it affects. The examples below are illustrative.
| Control type | Finance example | Auditor expectation |
|---|---|---|
| Preventive | Approval required before an AI-assisted journal entry reaches posting | Workflow history shows the approver and the supporting record |
| Detective | Exception report flags unusual matches or manual data entry changes | Saved report shows consistent filters and reviewer sign-off |
| Corrective | Accounting manager resolves a failed reconciliation before close | Audit trail shows the original exception and the final correction |
Where do controls fail in real finance workflows?
Control breakdowns usually start with workarounds. A team exports transactions to a spreadsheet, adds manual notes and sends the file to a reviewer because the system view feels too slow for the close calendar.
The export saves time at close and leaves evidence that is harder to defend in the audit. Spreadsheet workarounds often lose user permissions, timestamps and the direct link back to the source record.
Inventory teams face the same issue with cycle counting. If the count adjustment flows through an AI-assisted exception review, the auditor will want the count result, the adjustment approval and the record of any override.
How Nuage approaches audit-ready evidence
Our working rule is to build the evidence as part of the workflow, then reuse it each cycle. When a client’s auditors ask for evidence, our team pulls it from NetSuite directly. What we pull usually includes the following.
- Role permissions and access. We export the role permissions and the employee access report for the period.
- Logins. We pull the login audit trail.
- Changes. We pull system notes on the records that changed.
- Approvals. We export workflow history and approval logs for the controls being tested.
- Auditor access. Where auditors need direct access, we set up a read-only auditor role, and we refresh control screenshots for the audit file.
Our recommendations for AI-assisted workflows are in the checklist below. Nuage applies this through NetSuite optimization and governance around the platform, including NetSuite services for finance process alignment. The goal is a cleaner control environment and a report package that exists before the audit starts.
Build the evidence once
Define the evidence package before audit prep starts. It needs the saved report, approval record, audit trail and exception resolution tied to the same control objective.
For SOX-regulated teams or companies preparing for tighter board scrutiny, a NetSuite SOX compliance guide can help connect ERP activity to control narratives and testing needs.
Assign ownership before the audit
Assign each control to a named person. The controller usually owns the close controls, and IT owns system change control with finance input. A finance leader at a payments technology company explained why her Claude connection to NetSuite was not live yet: “I’m supposed to do that with IT this week. There is a reason why, because they control the connection on the Claude side.” Decide who approves a connection before anyone asks for one.
Larger companies may need a standing AI governance review group. Smaller teams can usually give auditors the evidence they need with a named controller review and a documented change approval.
NetSuite reporting for internal controls and audit readiness
The report package should show what the controller used to review the numbers during the period.
Standardize the close reports and approvals before you automate any part of the close.
Which report categories will your auditor care about?
Your audit package should not try to include everything. Too many reports create more questions, especially when nobody can explain which report supports which control.
Start with report categories that map directly to finance risk:
- Approval reports: journal entries, vendor changes, customer credit changes and high-risk adjustments.
- Access reports: role assignments, permission changes and users with sensitive finance access.
- Exception reports: failed matches, unusual manual data entry and override activity.
- Close reports: reconciliations, late postings and review status for close tasks.
- Inventory reports: cycle counting results, count variances and approved adjustments.
Each report needs an owner. The owner should confirm filters, permissions and timing before the audit starts.
A pre-audit checklist for CFOs and controllers
A practical pre-audit check follows the way transactions move through your ERP. Start with the AI-assisted process, then trace the source data, approval, system change record and reporting evidence.
We recommend this checklist before the next audit planning call:
- List every finance workflow where AI assists matching, drafting, exception review or reporting.
- Confirm the approval chain for each workflow and name the required reviewer.
- Save the report package that supports each control and restrict access by role.
- Review who can change approval rules, saved reports and sensitive master data.
- Test whether the audit trail shows user activity, timestamps and record changes.
- Document exception handling, including who reviewed the exception and how finance resolved it.
- Retire spreadsheet workarounds that duplicate system evidence without preserving permissions.
Do not automate a weak control. If the approval chain lacks an owner or the reporting package changes every close, AI will repeat the weakness at volume, and the evidence will be harder to explain.
Frequently asked questions about AI internal controls
How can AI speed up control testing and working papers?
AI can draft test steps, summarize evidence and organize working papers for a person to review. The control test itself still needs evidence from the system, such as the approval record and the audit trail, so keep a person responsible for each conclusion. Record what the AI produced, who reviewed it and what they changed.
What controls keep AI-generated financial reports audit-ready?
Keep the source data, the report definition and the reviewer’s sign-off together for each report. Maintain a lightweight register of the model or prompt used, its owner, version history and approval records, so reviewers can see what changed and whether the change was authorized. Store the outputs and approvals under your normal retention rules.
What does an external auditor look for when testing AI controls in a finance function?
An auditor will look for the control design, evidence that it operated and the access around it: the source data, the approval chain, who can change the configuration and the user activity behind the final entry. They will also ask how exceptions were handled. Expect to produce system reports and logs alongside the policy document.
How do you handle segregation of duties when AI can draft entries or propose approvals?
Separate AI assistance from authorization. The AI can prepare recommendations, and a distinct role should approve and post. Review role design periodically so no one person can initiate an entry, approve it and change the configuration that drives the AI’s behavior.
How can finance teams validate AI outputs without slowing the close?
Use risk-based review. Require deeper validation for high-impact transactions and use spot checks or threshold rules for low-risk items. Put the validation steps into checklists tied to close task owners, so reviews are consistent and time-boxed, and keep the record of what was checked.
Make control evidence part of the close
Auditors will expect internal controls to show the full path from AI-assisted activity to final finance approval. Teams that prepare well preserve the evidence inside the workflow and stop rebuilding it each cycle.
For CFOs and controllers, start with the approval chain and the saved reports for each AI-assisted workflow. Nuage helps finance teams optimize and govern automation around NetSuite so audit evidence is produced during the close.
Get the free NetSuite Performance Scorecard, no email required, or schedule a discovery call with a NetSuite expert to review where your control evidence may break under audit scrutiny.
About the author
Louis Balla is Chief Revenue Officer at Nuage, a NetSuite optimization partner that has served 250+ clients since 2011 and holds a 4.9 out of 5 rating on Clutch. The client work in this article is our team’s.
