Alberto Angulo

Industries · Finance and accounting

Finance and the Reconciliation Wall

Accounting already owns a large automatic error detector, because most numbers have a second record that must agree with them. AI moves fastest where that check exists, and stops where judgment starts. The design that follows is simple: the model proposes, the ledger supplies the numbers, and a person signs.

Alberto Angulo11 min read · 19 October 2026

Two customers pay the same amount in the same week. An AI system matching bank deposits to open invoices attaches each payment to the other customer's invoice. The amounts agree to the cent. The bank balance agrees with the books. Every automatic check in the finance system passes.

A careful reviewer might catch it. If not, it surfaces weeks later, when a customer asks why a paid invoice is still marked overdue.

That small error explains most of what you need to know about AI in finance. Accounting is built so that numbers can be checked against other numbers, which makes it far better suited to AI than its conservative reputation suggests. But the checks only catch numbers that disagree. AI goes first in finance wherever a number has an independent second record to agree with, and it stops where judgment starts. The design that follows is simple: the model proposes, the ledger supplies the numbers, and a named person signs.

The error detector finance already owns

Accountants built their work so that mistakes would show up on their own.

Every entry posts to at least two accounts, and the debits must equal the credits. That's double entry. The customer balances in the receivables detail must add up to the receivables line in the general ledger. And every month, the cash in the books must agree with the cash the bank says it holds, to the cent. Proving that is called a bank reconciliation.

These checks come in three strengths, and the difference matters for AI.

A record agreeing with itself. An entry that doesn't balance can't post, which catches a mistyped amount on one side. It doesn't catch a balanced entry to the wrong account: book a laptop as office supplies instead of equipment and the books still balance.

Two internal records agreeing. A detail ledger tying to the general ledger, or two subsidiaries' balances with each other netting to zero. These catch postings that were dropped or duplicated, and miss an error made the same way in both places.

Your record agreeing with someone else's. The bank keeps its own record of your cash and has no interest in making your books look right. Supplier statements work the same way. This is the strongest check, because the second record was produced independently.

So when an AI proposes that a bank line matches three invoices, checking the proposal takes a few milliseconds of arithmetic: the amounts tie out or they don't. That's the property that let code move first too, with tests in place of the bank (Why Progress Arrives Unevenly). Few business functions have it built in. Finance does.

The wall catches numbers that disagree. It doesn't catch numbers that agree and are wrong.

The hole is classification: which customer, which account, which period a transaction belongs to. Two records can agree on an amount and both be silent about what the money was for. That's where the swapped payments in the opening slipped through.

Where the wall stops

Sort finance work by two questions. How cheaply can the output be checked automatically? And how much judgment and personal accountability does the task carry?

Finance work by cost of checking and weight of judgment (conceptual) Positions are editorial judgment for a typical mid-size company, not measurements. Rules check it; a person signs AI gathers evidence; a person decides AI proposes; the ledger gates AI drafts; the outcome checks it later Footing totals Bank statement matching Three-way match Intercompany matching Journal entry drafts Variance figures Variance and close commentary Accruals Reserves, estimates Revenue recognition, new contracts Forecasts and scenarios Duty-conflict checks Audit evidence packs Payment approval cheap expensive Cost to check the output automatically low high Judgment and personal accountability preparation or judgment task control task
AI moves first where output is cheap to check and judgment is light. Finance tasks placed by how cheaply their output can be checked automatically and how much judgment and personal accountability they carry; positions are editorial judgment for a typical mid-size company in October 2026, not measurements.Conceptual illustration

Matching work sits where checks are cheap. Rules already do most of it: software pairs transactions by amount, reference and date. What rules leave behind is the messy remainder. One transfer covering three invoices. A card-processor deposit that arrives net of fees. A reference the bank cut to eight characters. Reading that text and proposing which ledger items a bank line covers is language work that models do well, and the proposal is cheap to check.

Estimates sit where judgment is heavy. How much to accrue for consulting work done but not yet invoiced. What reserve a doubtful receivable deserves. When a new contract's revenue can be recognized. There's no second record at month end, and the person who decides carries legal accountability. AI can gather the evidence (contracts, time sheets, delivery emails) and propose an amount with every input linked. The estimate stays a judgment.

There's a useful subtlety here. The SEC requires management to keep "reasonable support" for its assessment of internal controls. A contract the model found can be that support. The model's conclusion can't, for the same reason an unnamed colleague's opinion can't: nobody can examine how it was reached or hold it to account.

Even estimates get a second record eventually: the supplier's invoice arrives, and the gap between accrual and invoice measures the estimate. That gives you a way to judge an AI that proposes estimates: run it on past months whose outcomes are already known (Build an Evaluation From Your Own Work). It won't make this month's estimate checkable, but it tells you how far to trust the proposals.

Forecasts are their own case. Internal plans carry no audit opinion, so AI can draft scenarios with fewer gates, as long as the assumptions are explicit and someone later compares forecasts with actuals.

A month-end reconciliation, traced

Here's what this looks like in one month for one bank account at a mid-size company. Every number is an illustrative assumption, chosen to be plausible.

The account has 4,000 bank lines. Matching rules pair 3,120 of them automatically, 78 percent, with no AI involved. That leaves 880 lines for a person, at about six minutes each: 88 hours, roughly eleven working days of one accountant's month.

Now add a model. It reads each remaining bank line, its payment text and the open ledger items, and proposes matches for 640 of them, each with a stated reason. For a card deposit of 61,882.13, the reason might read: 412 card sales of 3 October totaling 63,401.90, less processing fees of 1,519.77. The proposal includes the fee as an entry to book.

Then code, not the model, checks every proposal. The tie-out, confirming a number agrees exactly with its record, requires the matched ledger items plus any adjustment to equal the bank amount exactly. The code computes the fee itself, as the difference, and checks it against the processor's contracted rate; the model's version of the fee is never trusted. No ledger item may already be matched elsewhere. Of 640 proposals, 598 pass. The 42 that fail sounded plausible and didn't add up.

Guess first

Of the 598 proposals that tie out to the cent, how many would you expect a careful reviewer to reject?

In this example, 14. Each has perfect arithmetic and the wrong pairing, like the two customers in the opening. Suppose reviewers catch seven in ten such errors. Then about six wrong pairings get through each month, and they surface later, through a confused customer. The customer's own records form a second wall, slower and more embarrassing.

People now investigate 296 lines instead of 880: those with no proposal, those that failed the tie-out and those the reviewer rejected.

A month of bank lines: rules, AI proposals, tie-out (illustrative, computed) Assumed: one operating account, 4,000 bank lines. Every input is listed in the article's Method section. All bank lines: 4,000 Rules match 3,120 (78%) 880 the 880, enlarged 4.5 times 880 Left after rules 640 AI proposes a match 598 Ties out to the cent 584 Reviewer accepts Exceptions people investigate: 296 240 no proposal 42 fail tie-out 14 rejected by reviewer Human review minutes before: 5,280 (880 x 6 min) after: 2,865 449 reviewing 598 proposals 2,368 on 296 exceptions (8 min each) 48 approving 96 fee/interest entries Unreconciled pile before: 880 lines after: 296 (-66%) Time per investigated line rises from 6 to 8 minutes: the easy ones left first. The gate: the month closes only if both sides agree Bank 4,812,340.17 + deposits in transit 186,420.00 - outstanding payments 243,910.55 = 4,754,849.62 Book 4,741,104.17 - fees 3,912.40 + interest 2,117.85 + unrecorded receipts 11,240.00 + duplicate payment reversed 4,300.00 = 4,754,849.62 Unexplained difference: 0.00
AI shrinks the pile people search by two-thirds, and the gate at the end does not move. One illustrative month for one account with 4,000 bank lines: people investigate 296 exceptions instead of 880, and the month closes only when adjusted bank and book balances agree exactly.ComputedSource: Computed from the illustrative assumptions listed in the article's notes and sources; script in notes/A84.notes.md.

The pile a person has to search falls by two-thirds. Total review time falls by less, 46 percent, because reviewing 598 proposals is new work, and the lines left over are the hard ones, taking eight minutes each instead of six.

The month still closes the same way. The bank balance, adjusted for deposits in transit and outstanding payments, must equal the book balance, adjusted for the fees, interest and corrections the reconciliation found. In the example both come to 4,754,849.62 and the unexplained difference is zero. Every figure in that proof comes from the bank statement or a ledger query. The model contributed pairings and reasons, and none of the numbers.

The model writes the sentence. The ledger writes the numbers.

That last point deserves to be a rule: in finance, a model should handle numbers only as references to values that a query or a calculation produced.

The reason is mechanical. A language model produces text one small chunk at a time by predicting what comes next, and a specific number recalled from memory or computed "in its head" is one of the places where fluent output is most likely to be wrong. Arithmetic is a known weak spot, partly because of how digits get split into those chunks (Confidently Wrong).

Finance benchmarks show the size of the problem, and where the fix lies. In 2023, GPT-4-Turbo, searching a shared index of company filings, answered wrongly or refused 81 percent of a reviewed sample of questions about those filings. Handed the right pages directly, the same model got 85 percent right. Most of the failure was in finding the evidence. Systems have improved since, but on a 2026 benchmark of questions an entry-level financial analyst might handle, the best system still scored about 64 percent, and the better-scoring systems were the ones that made more tool calls: looking things up and computing instead of recalling.

So the design is: the model drafts the commentary with placeholders bound to queries ("revenue rose {rev_change_pct} to {rev_q3}"), or a validator checks every figure in a draft against computed values and rejects any number without a source. And the reason a model offers for a variance is a hypothesis. "Revenue rose because of the price increase" gets tested by splitting the change into price and volume, or by asking the sales lead, before it reaches a board pack.

A model is not a control

Auditors like automated controls for one reason: a program, once tested and protected from unauthorized changes, does the same thing every time. SEC guidance from 2007 says so in plain terms, and lists automated matching among its examples.

A model doesn't meet that premise. The same input can produce different outputs, and a provider's update can change behavior without any change ticket in your own systems. My reading, until the SEC or the audit standard setters say otherwise, is that a model step can't be the control. It can be the preparer, like a junior accountant whose work gets checked. Three design rules follow.

Put the control after the model. The tie-out code and the balance proof are the controls. The same 2007 guidance describes a control where a person "manually investigates items contained in a computer generated exception report". AI changes what lands in that report and how much of the investigation arrives pre-drafted. It doesn't change who investigates or who signs.

Treat a model change like a program change. Pin the model version, record it on every proposal, and before switching versions rerun a set of past reconciliations whose answers are known.

Separate the powers. Segregation of duties applies to agents exactly as it does to people. No single actor, person or agent, should hold two of these four: propose an entry, approve it, post it, change vendor or bank details. The matching agent reads the bank feed and the ledger and writes only proposals. A model misled by a malicious payment note, or simply wrong, can at worst create a bad proposal for the tie-out or the reviewer to stop. Large entries, and entries to accounts the agent hasn't used before, always go to a person. Each posting carries an idempotency key, a unique tag built from the statement line, account and period, so a retry after a timeout can't book the same fee twice (When the Tool Call Fails Halfway). And every proposal leaves a record of its inputs, model version, reason, tie-out result, reviewer and time, because an auditor will read it.

"Finance is too regulated to move fast"

The objection deserves a fair hearing. Public-company executives certify their reports personally, and a material weakness in controls gets disclosed to investors. A finance leader who brings an unproven tool into the close takes a personal risk with little upside if it works. Caution is a rational response.

But regulation constrains finance in three specific places: changes to key controls, which must be documented and tested and are best made early in the fiscal year; evidence and duties, meaning who prepared, who reviewed and who could change what; and certain decisions about people, such as credit scoring of individuals, which the EU AI Act treats as high-risk. Bookkeeping, reconciliation and the close are not on that list.

Regulation doesn't constrain drafting, proposing matches, explaining variances, preparing evidence or building forecasts. Nothing in the US rules on internal control names a tool or forbids one. A design where the model proposes and a control checks fits the existing framework precisely, because the framework already assumes preparers make mistakes and controls catch them.

What actually slows finance teams is designing the controls and the evidence in advance. My advice is to bring the auditor in while the system runs in shadow mode, producing proposals that nobody acts on. That turns the audit from a late veto into an early review.

Where the time goes

The example saves about 40 hours a month on one account. That shortens the monthly close only if reconciliation was the step everything else waited on. Often the close waits instead on the last detail ledger, the accrual estimates and sign-off, and then the saving frees staff time without moving the reporting date (Where the Saved Time Goes). The bigger change may be timing: matching that's cheap can run every day, moving the work out of the month-end crunch.

Two second-order effects are worth planning for. Reconciliations were where junior accountants learned how money moves, and automation removes the easy matches they learned on. And as payments carry richer structured data, rules will match more on their own and the messy remainder left for AI will shrink. AI's role in matching may contract while its role in gathering evidence for judgment grows. The controls around it, the tie-out, the separated duties, the keyed postings and the evidence log, will outlast whichever model does the matching.

What to do

Start where a number has an independent second record. Bank and card matching, the invoice-order-receipt check, intercompany balances. The check is already there; you're only adding a proposer.

Never let the model be the source of a number. Every figure comes from a query or a calculation. The model writes sentences around them.

Put code and a person after the model, and keep the powers apart. Proposals go to a staging area, code ties them out, a reviewer accepts or rejects, and a separate service posts. No actor holds two of propose, approve, post and change payment details.

Measure the hole. Each month, sample accepted matches and confirm them against customer statements or payment advice. That tells you how many wrong-but-tying pairings get through, which no vendor can tell you.

For estimates, use AI to gather evidence. Let it propose an amount with every source linked, test it on past months, and keep the signature with a person. And bring the auditor in early.

AI in finance will advance fastest where the profession's oldest habit already protects it: wherever a number has a second record, and a person signs when the two agree.

Check yourself

Why was the swapped-payment error invisible to every automatic check?

The amounts agreed to the cent and the bank balance agreed with the books. The checks catch numbers that disagree, not a wrong classification where the numbers agree.

Why should a model never be the source of a number in finance?

A model predicts text one chunk at a time, so a number recalled or computed in its head is a place where fluent output is likely to be wrong. Numbers should come from a query or a calculation, with the model writing the sentences around them.

Why can a model step not be the control, but still be the preparer?

A tested program does the same thing every time, while a model can give different outputs and a provider update can change its behavior. Like a junior accountant, it can prepare work as long as a control after it checks the result.

Notes, sources and method

For readers who want to check the numbers and rules behind Finance and the Reconciliation Wall. Sources were checked on 11 October 2026. The article is general information about how these systems work, not accounting or legal advice.

Key numbers and rules

In the articleExact value and contextSource and date
4,000 bank lines; rules match 3,120 (78%); 880 left at about six minutes, 88 hours, about eleven working daysIllustrative assumptions (Method)Worked example
Card deposit 61,882.13 = 63,401.90 − 1,519.77 (412 card sales of 3 October)IllustrativeWorked example
640 proposals, 598 pass the tie-out, 42 fail, reviewer rejects 14 (584 accepted)Illustrative; rejection rate 2.3% of passing proposalsWorked example
About six wrong pairings slip through a monthA 70% reviewer catch rate implies 20 wrong-but-tying pairings, 14 caught, 6 missed. The 70% is an assumption; no public measurement exists.Worked example
296 exceptions; pile down two-thirds; review time down 46%; eight minutes per exception instead of six240 with no proposal + 42 failed + 14 rejected; 880 → 296 (−66%); 5,280 → 2,865 minutes (−46%)Worked example
Balance proof 4,754,849.62, difference zeroInvented balances chosen to reconcile: bank 4,812,340.17 + deposits in transit 186,420.00 − outstanding payments 243,910.55 = 4,754,849.62; book 4,741,104.17 + net adjustments 13,745.45 (fees −3,912.40, interest 2,117.85, unrecorded receipts 11,240.00, correction 4,300.00) = 4,754,849.62Worked example
About 40 hours saved a month2,415 minutes = 40.25 hoursWorked example
"Reasonable support"SEC guidance for management's assessment of internal control over financial reporting, June 2007[3]
Automated matching as an automated control; "manually investigates items contained in a computer generated exception report"SEC 2007 guidance: application controls "that perform automated matching, error checking or edit checking functions"; management "may determine that automated controls are more efficient to evaluate than manual controls" when IT general controls are effective; "the proper and consistent operation of automated controls or IT functionality often depends upon effective IT general controls"[3]
GPT-4-Turbo wrong or refused on 81%; 85% right with the pages suppliedFinanceBench, November 2023: shared vector store across all filings, reviewed sample of 150 questions, 13% incorrect and 68% refused; oracle setting 85% correctIslam et al. [7]
Best system about 64% on a 2026 analyst benchmark; better systems made more tool callsVals AI Finance Agent benchmark v1.1: 537 questions, built with Stanford researchers and a global systemically important bank; top score 64.37% (Claude Opus 4.7) as of 4 June 2026; vendor-run; predates models released in September 2026[6]
Executives certify reports personally; material weakness disclosedSarbanes-Oxley §302 (officer certification); §404(a) management report on internal control, §404(b) auditor attestation except for emerging growth companies and non-accelerated filers; material weakness: "a reasonable possibility" that a material misstatement "will not be prevented or detected on a timely basis"[1], [2], [3]
EU AI Act treats credit scoring of individuals as high-risk; bookkeeping not listedAnnex III point 5(b), creditworthiness and credit scoring of natural persons, except fraud detection; 5(c) life and health insurance risk assessment and pricing for individuals. Under Regulation (EU) 2026/1744 obligations for these stand-alone high-risk systems apply from 2 December 2027.[8], [9]

Method and assumptions

Worked example. All inputs are assumptions chosen for plausibility: 4,000 bank lines in a month for one operating account; rules match 78% (3,120); manual investigation before AI at 6 minutes per line; the model proposes matches for 640 of the 880 remaining lines; 598 pass a deterministic tie-out; the reviewer spends 0.75 minutes per passing proposal and rejects 14; exceptions after AI take 8 minutes each; approving each of 96 fee and interest entries from accepted proposals takes 0.5 minutes; the reviewer catch rate on wrong-but-tying pairings is 70%. Balances in the proof are invented and chosen to reconcile. The 3,120 rule matches are reviewed the same way before and after, so their review time is excluded from both totals. The computation was run in Python, and the script is in the notes file.

Task map. Positions are editorial judgment for a typical mid-size company, October 2026, not measurements. The reasoning for each placement is in the notes file.

Sources. Statutory text was read at Cornell's Legal Information Institute; the SEC's 2007 interpretive release was read as a PDF from sec.gov; the PCAOB amendments were read through the SEC's approval order as published in the Federal Register, because PCAOB pages refused automated access. The EU AI Act annex was read through a reference site that reproduces the text, and the December 2027 date from the Official Journal text of Regulation (EU) 2026/1744 (Article 113(c) as amended).

Sensitivity

Review speed. At 0.75 minutes per proposal the after-total is 2,865 minutes (46% less). If reviewers distrust the reasons and spend two minutes per proposal, it is 3,612 (32% less). If they skim at 0.2 minutes, it is 2,536 (52% less), and the catch rate on wrong-but-tying pairings is the thing likely to fall, a pattern known as automation bias.

Data quality. If cleaner references let rules match 90% instead of 78%, only 400 lines remain. Scaling the AI stages proportionally, people investigate about 135 exceptions and the AI saves about 1,100 minutes a month instead of about 2,400. The better the rules and the data, the less there is for AI to do in matching.

The undetected errors. The six wrong pairings that slip through follow from an assumed 70% reviewer catch rate, which nobody has measured for this task in public. A company can measure its own: sample accepted matches each month and confirm them against customer statements or remittances.

Finance work by check and signer

This table, from the previous version, supports the task-map figure.

WorkWhere AI helpsWhat verifies itWho signs
Bank and card matchingProposes one-to-many and messy matches, with a stated reasonAmounts tie to the cent; adjusted bank and book balances agreePreparer and reviewer of the reconciliation
Three-way match (invoice, order, receipt)Reads invoices, extracts lines, explains mismatchesPrice and quantity tolerances in the ERPAccounts payable, under the approval policy
Intercompany matchingPairs the two sides, drafts eliminating entriesBoth entities' balances net to zeroGroup controller
Journal entry draftsPrepares recurring and adjusting entries with support attachedEntry balances; account and period rules; approval thresholdsPreparer and approver
Variance analysisRuns the queries, drafts candidate explanationsFigures recompute from the ledger; explanations need confirmationFP&A or controller
Accruals, reserves, revenue recognitionGathers contracts, receipts and history; proposes a method and an amount with sourcesNo second record now; consistency with policy and prior periods; auditController, CFO
Forecasts and scenariosBuilds models, drafts assumptionsThe outcome, laterFP&A lead, executives
Evidence, approvals, duty conflictsAssembles evidence, flags access conflictsRules over access rights and logsControl owners; management

Task-map placements are editorial judgment: footing and variance figures are exact arithmetic with near-zero judgment; bank matching, three-way match and intercompany have cheap tie-outs (intercompany slightly higher because it touches eliminations and two entities' controllers); journal entry drafts balance automatically but account and period classification needs review; variance commentary has checkable numbers and uncheckable explanations; accruals, reserves and revenue recognition on new contracts have no current second record and high accountability; forecasts are checked later by the outcome with lower formal accountability; control tasks are rule-checkable but need a named signer.

Control design (figure dropped in the 19 Oct 2026 rewrite)

The control-design diagram (a84-agent-duties) was removed from the article; its content survives in prose. The matching agent reads the bank feed and ledger and writes proposals to a staging area only. Code checks the tie-out; a reviewer accepts or rejects and approves entries above a threshold; a posting service posts each entry once under an idempotency key built from the statement line, account and period. Every step writes to an append-only evidence log (inputs, model version, stated reason, tie-out result, reviewer, time, posting key). The agent has no access to vendor records or payment release. No single actor holds two of propose, approve, post, and change vendor or bank details; a small team that cannot separate every pair can compensate with a later independent review of what was posted. Corrections are made by reversing entries, never by deleting them. As evidence accumulates, a narrow class (for example, card deposits whose fee rate matches the contract) can move to acceptance by rule with monthly sampling. This is one of several workable designs, not a regulatory requirement.

Caveats and open questions

  • "A model is not an automated control" is the article's reading of how the SEC's 2007 guidance applies, not something the SEC has said about AI. Guidance from the SEC or the PCAOB on model-based controls would change it, and so would a model step shown to behave consistently under change control (weights that cannot change unannounced, outputs that repeat on identical inputs, a regression suite rerun on every change).
  • PCAOB. Amendments to AS 1105 and AS 2301 on technology-assisted analysis were adopted on 12 June 2024 and approved by the SEC on 20 August 2024; they apply to audits of fiscal years beginning on or after 15 December 2025, so calendar-year 2026 audits are the first under them. They cover the auditor's evaluation of the reliability of external information the company provides in electronic form (bank data, including whether the company modified it) and the investigation of items identified for further investigation. The SEC's approval order does not mention AI. Inferences for a company (not stated in the standards): keep the original bank feed untouched and separate from the agent's proposals; keep the match log complete; flag only what someone will investigate, because an internal tool that flags 300 anomalies nobody reviews leaves a record of known, unaddressed issues.
  • IAASB. As of October 2026 its technology page lists proposed revisions to ISA 330, ISA 500 and ISA 520 and a technology initiative launched in June 2025, with no final AI-specific standard.
  • ESMA said in May 2024 that it expects firms using AI in investment services to comply with MiFID II requirements.
  • Benchmarks do not transfer to a ledger: an analyst benchmark is not a reconciliation, and the Vals leaderboard predates the September 2026 models.
  • Data quality dominates the matching result: cleaner references shrink what is left for AI (see Sensitivity).
  • Not verified: no public measurement of reviewer catch rates for wrong-but-tying matches; no source for current AI adoption rates in finance functions, close-cycle benchmarks or reconciliation staff time; PCAOB pages not read directly; EU AI Act annex read through a reproduction site.
  • What would change the argument. Wrong-but-tying pairings turning out to be common (the wall is weaker and review must grow; monthly sampling against customer statements would show it). Models becoming reproducible and versioned in a way auditors accept as consistent operation, so a model step could serve as an automated control. AI-specific evidence requirements from the IAASB or the PCAOB. Judgment tasks acquiring faster second records, such as accrual true-ups tracked systematically against the invoices that follow.

Further reading in this collection

Customer Support Went First · Data Access Is the Real Integration Project · Same Model, Different Results · Moving Without Breaking · Reversible Work and Irreversible Effects · Regulation as a Design Constraint

Sources

  1. U.S. Code. 15 U.S.C. § 7262, Management assessment of internal controls (Sarbanes-Oxley Act § 404), read October 11, 2026. https://www.law.cornell.edu/uscode/text/15/7262 — 404(a) management responsibility and assessment; 404(b) auditor attestation; exemptions for emerging growth companies and smaller issuers.
  2. U.S. Code. 15 U.S.C. § 7241, Corporate responsibility for financial reports (Sarbanes-Oxley Act § 302), read October 11, 2026. https://www.law.cornell.edu/uscode/text/15/7241 — officer certification of annual and quarterly reports, of responsibility for internal controls and of having evaluated them.
  3. U.S. Securities and Exchange Commission. Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting, Release Nos. 33-8810; 34-55929, June 2007 (effective June 27, 2007). https://www.sec.gov/rules/interp/2007/33-8810.pdf — "reasonable support"; material weakness definition; automated matching controls; role of IT general controls in "proper and consistent operation"; manual investigation of computer-generated exception reports as a combined manual and automated control.
  4. U.S. Securities and Exchange Commission. Order Granting Approval of Amendments Related to Aspects of Designing and Performing Audit Procedures That Involve Technology-Assisted Analysis of Information in Electronic Form, Release No. 34-100774, August 20, 2024; Federal Register 2024-18986, August 23, 2024. https://www.federalregister.gov/documents/full_text/text/2024/08/23/2024-18986.txt — PCAOB adoption June 12, 2024 (Release 2024-007); effective for fiscal years beginning on or after December 15, 2025; reliability of external information provided by the company, including whether the company modified it; investigating identified items; no mention of AI.
  5. IAASB. Technology focus area, read October 11, 2026. https://www.iaasb.org/focus-areas/technology — proposed revisions to ISA 330, 500 and 520; Technology Quality Management initiative launched June 2025.
  6. Vals AI. Finance Agent Benchmark (v1.1), updated June 4, 2026, read October 11, 2026. https://www.vals.ai/benchmarks/finance_agent — 537 questions; collaborators; top score 64.37% (Claude Opus 4.7); accuracy associated with more tool calls. Vendor-run benchmark.
  7. Islam, Pranab; Kannappan, Anand; Kiela, Douwe; Qian, Rebecca; Scherrer, Nino; Vidgen, Bertie. FinanceBench: A New Benchmark for Financial Question Answering. arXiv:2311.11944, November 20, 2023. https://arxiv.org/abs/2311.11944 (PDF read October 11, 2026, Table 2) — GPT-4-Turbo with a shared vector store incorrect or refusing on 81% of a 150-question reviewed sample (13% incorrect, 68% refused); 85% correct in the oracle setting with the relevant pages supplied.
  8. EU Artificial Intelligence Act, Annex III, as reproduced at artificialintelligenceact.eu, read October 11, 2026. https://artificialintelligenceact.eu/annex/3/ — point 5(b) creditworthiness and credit scoring of natural persons, with the fraud-detection exception; 5(c) risk assessment and pricing in relation to natural persons in life and health insurance.
  9. European Parliament and Council. Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal L, July 24, 2026. https://eur-lex.europa.eu/eli/reg/2026/1744/oj (text read from the Publications Office copy, October 11, 2026) — amended Article 113(c): Chapter III, Sections 1–3 apply from December 2, 2027 for systems high-risk under Article 6(2) and Annex III.
  10. ESMA. ESMA provides guidance to firms using artificial intelligence in investment services. May 30, 2024. https://www.esma.europa.eu/press-news/esma-news/esma-provides-guidance-firms-using-artificial-intelligence-investment-services — expectation that firms using AI comply with MiFID II requirements.

All writing