September 22, 2026
Financial Reporting and AI:
Why Management Can't Trust The Financial Statements
“based on the Officers Knowledge....that the report contains
no untrue statement of material fact, and that the financial statements
fairly present in all material respects...”
Section 302, Sarbanes-Oxley Act, 15 U.S.C. §7241
Internal Controls:
“the officer hereby certifies responsibility for
designing and evaluating the effectiveness of the controls.”
Section 302 certification, prescribed at Item 601(b)(31), Regulation S-K
as required by Exchange act Rule 13a-14(a)
A member of the finance team builds a schedule in Claude. Another creates draft disclosures using GPT. Copilot helps organize emails, gather data, and produce spreadsheets — and the work product finds its way into reporting systems faster than most finance teams can govern.
The danger with Ai in financial reporting isn’t that it can “hallucinate”. It’s that AI can produce work product that reads as verifiable regardless of whether it is or not — and it's happening in finance departments across America.
Certification Ready AI provides the smallcap issuer with a framework for keeping AI-assisted financial reporting reviewable, supportable, and ready for certification.
Based on COSO's new Generative AI guidance, PCAOB evidence standards, and SOX §302 certification rules, we examine the rapidly changing financial-reporting landscape, and what it means for both finance teams and the certifying executive.
by Jason Baybutt, COO
PubCo Reporting Solutions, Inc.
“AI is great at producing numbers, not so great at producing anything I'd sign-off on.”
Nanuk Warman, CPA, CFA | PubCo Reporting Solutions, Inc
Every tool makes mistakes.
“Dumb apps” such as QuickBooks, ADP, the cap-table platform and bank feed run in familiar control environments -- they compute. Their output can be tested, reproduced, and tied-back to source records supported by IT General Controls (ITGCs) and SOC 1 assurance.⁽¹⁾
Enter the correct formula into a spreadsheet and you get an answer you can verify and reproduce. Pull an aging report from QuickBooks, and you can tie it back to the general ledger month after month.
The majority of adverse findings in smallcap financial reporting are related to Information Produced by the Entity (IPE) — the reports, schedules, and spreadsheets that a company generates and relies on as a control or in the financial statements.⁽²⁾
Generally speaking, IPE follows two familiar verification paths:
▢ System-generated – a report from a known system operating within a control
environment that can be tested; or
▢ Manually prepared - a spreadsheet, memo, or schedule built by someone who can
show you exactly how it was made.
AI-assisted work product checks neither of those boxes. It is not system-generated (with ITGC-governed or SOC 1 assurance), nor is it manually prepared, because the logic behind it is not authored – it is inferred.
When 'prompting', Generative AI interprets instructions to resolve ambiguity, select context, and generate answers probabilistically.
That is a third kind of IPE, and it presents a new consideration for the certifying executive: work product that is visible while part of the basis for it is not.
That is the gap.
Definitions
A short glossary for the terms used in this article.
Information Produced by the Entity (IPE) — The reports, schedules, and spreadsheets a company generates and then relies on in its financial statements, or as a control. An auditor can test it two ways: examine the information itself, or test the controls over how it was produced.
AI-Assisted Work Product — Financial-reporting or control-related work that is created, transformed, analyzed, summarized, or materially influenced by an artificial-intelligence system. This can include calculations, reconciliations, accounting memos, disclosure drafts, variance analyses, schedules, and supporting documentation.
Invisible IPE — Financial-reporting work that enters a control or the financial statements without a recoverable, contemporaneous record of the sources, instructions, assumptions, transformations, and review that produced it. It is neither system-generated nor manually prepared, because the logic was inferred, not authored.
Internal Control Over Financial Reporting (ICFR) — The policies and procedures designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with the applicable reporting framework.
IT General Controls (ITGCs) & SOC 1 — The control and assurance layer that stands behind everyday accounting systems. ITGCs govern the systems that produce financial data — access, change, and operations — while a SOC 1 report gives independent assurance over a service provider’s controls relevant to financial reporting. Together, they let a reviewer rely on a system’s output.
§302 Certification — The certification the CEO and CFO personally sign under the Sarbanes-Oxley Act. Two of its representations are limited to “based on my knowledge”; the paragraph on internal control is not — the officers are simply “responsible for establishing and maintaining” it.
Audit Trail AI Standard™ (ATAI) — The standard that closes the gap Invisible IPE opens. It requires the trail to be built while the work is produced, not reconstructed after the auditor asks: sources named, instructions captured, assumptions stated, transformations recorded, review logged — at the moment the AI does the work.
Why AI Fails In The Finance Dept
Modern finance teams are using AI to draft memos, summarize contracts, build reconciliations, organize support, and transform a mountain of source material into something that’s reviewable in a matter of minutes.
For a team that’s well-trained in public-company accounting, that is extraordinary leverage.
That same leverage magnifies what lies underneath.
If a team member or outside vendor uses AI to generate reconciliations, variance narratives, memos, accrual schedules, or disclosures, that output becomes IPE the moment it enters a control or in the financial statements.
The problem is not that AI can hallucinate the wrong number. It is that AI can make – or materially influence – the very judgement a control is meant to establish: what source-system to trust, which filter to apply, what counts as complete, and how the spreadsheet logic should work.
And those judgements become much harder to verify as the work moves downstream.
If the original source, assumptions, model behavior, and workflow are not mapped, then reliability cannot be reconstructed after the fact.
That is Invisible IPE.
Invisible IPE
Financial-reporting work that enters a control or the financial statements without a recoverable, contemporaneous basis showing material sources, assumptions, instructions, transformations, and review that produced it.
The work is visible. The trail is not.
Generally speaking, large public companies have an apparatus in place to absorb new technology risk: model governance, internal audit, a control team, a legal department, and budget lines to match.
The answer for a small finance team is not “don’t use AI”. It's a distinction that needs to be made in the workflow: does it ask the reviewer to trust the output, or does it preserve enough evidence that a reviewer can verify the work?
That is the basis for a new framework.
AI has put institutional-grade capability into the hands of lean finance teams faster than institutional-grade controls have arrived to support it. New frameworks are required.
The Institutional Shift
PCAOB auditing standards have long applied the same basic test to information management provides – a spreadsheet, a schedule, a system report: is it complete, and is it accurate? ⁽³⁾
AI does not change that rule. It changes how difficult it is to satisfy.
In February, 2026, COSO released new guidance that applies its Internal Control-Integrated Framework (ICFR) to generative AI — an audit-ready roadmap for governing risk when AI adoption outruns internal control.
Accounting firms are now applying that guidance to practice:
-
Deloitte requires that financially relevant GenAI uses are mapped to reporting processes, relevant assertions and controls with appropriate human oversight.⁽⁴⁾
-
KPMG has framed GenAI in financial reporting and ICFR as a governance-and-control question over work related to journal entries, reconciliations, disclosures, and review controls.⁽⁵⁾ ⁽⁶⁾
-
EY states that AI-assisted output should follow a human review and decision path, rather than using documentation reconstructed after the fact.⁽⁷⁾
As AI increasingly influences estimates, classifications, and other financial-reporting judgements, regulators are also weighing in:
-
SEC Chief Accountant Kurt Hohl says his office is actively assessing how AI is being used in financial reporting – emphasizing management's responsibility for appropriate oversight of AI use and the risks it creates.⁽⁸⁾
-
PCAOB has amended its audit-evidence standards — effective for fiscal years beginning on or after December 15, 2025 — emphasizing the reliability of electronic source information, controls, and the need for sufficient and appropriate audit evidence.⁽⁹⁾
-
FINRA stresses that existing regulatory obligations apply when firms use GenAI. Its 2026 Regulatory Oversight Report says that policies should also consider the integrity, reliability and accuracy of AI models.
-
IOSCO has specifically flagged AI governance, oversight, transparency, explainability, third-party dependence, testing and ongoing monitoring as high priority regulatory concerns.⁽¹¹⁾
Taken together the direction is clear: AI-assisted financial reporting is moving from an emerging technology issue to a governance and control concern that's now squarely on the agenda.
That is the shift.
SOX 302 certification does not require perfect controls. It requires controls designed to provide reasonable assurance - a standard that deliberately leaves room for judgment.⁽¹²⁾
For example, if an AI-assisted reconciliation, accrual, or disclosure enters the reporting process without a trail that a traditional control is meant to test...
Then the AI is in the financial statements without being in the controls.
“That is the real exposure – That management may be
certifying a control environment that no longer captures
how the financial statements were actually produced”
Nanuk Warman, CPA, CFA | PubCo Reporting Solutions, Inc
This presents management with the obvious question:
If the control environment is expected to see AI provenance in its work product and control, then what, exactly, does the control need to see?
That is the juncture where Invisible IPE ends and the Audit-Trail AI standard (ATAI) begins.
The Audit Trail AI™ Standard — A
Control-Ready Framework
For an AI control to be effective, it needs to be recoverable, reviewable, and retained at the point where the work is produced.
We call it the Audit-Trail AI standard (ATAI).
ATAI is a five-rule standard for smallcap finance teams. Each rule is fully traceable and auditable so that the basis for any AI-work is recoverable and retained.
1. Inventory Financially Relevant AI Use
Before it can be governed, the finance department must know where AI is being used:
The need to inventory financially relevant use cases — including reconciliations, journal-entry support, estimates, technical-accounting research, disclosures, variance analysis, contract review, spreadsheet generation, close support, and controls that themselves use AI.
Each use case needs to identify the owner, purpose, systems and data involved, and whether the output can affect amounts, disclosures, judgments, or control.
If the use is invisible, the control is invisible too.
2. Bound and Standardize the Workflow
Define what the AI is allowed to do before relying on what it produces.
Establish the approved sources, data, instructions, model or system, human decision points, and escalation requirements for each financially relevant workflow.
Obviously, repeated work needs to follow a repeatable process. Five people performing the same task with different AI models, sources, prompts, and review habits makes for five variations of one risk.
3. Capture the Audit Trail at Production
Material support needs to travel with the work every step of the way, not recreated if somebody asks for it later.
The trail needs to carry sufficient material evidence to recover the chain: source files or data, governing instructions, significant assumptions, AI output, material transformations or exceptions, and the applicable model or configuration where relevant.
The objective is to make sure that a qualified reviewer is able to understand how the work was produced without relying on the memory of the person who produced it.
4. Require Human, Evidence-Based Review
Human review in itself is not a control simply because a human looked at the answer.
A reviewer needs to test the risks relevant to the work.
For a reconciliation, that may include completeness, source-to-ledger tie-out, recalculation, and exception testing.
For a disclosure, it may include factual support, applicable accounting guidance, source data, and the judgment of management.
The review record needs to show what was tested, what changed, what exceptions were identified, and why the work was accepted.
5. Reassess Workflow Changes
Attention needs to be paid to and AI control when the system underneath changes.
A new model, source set, instruction, integration, level of autonomy, or materially different use can change the risk profile of the workflow.
When the process changes materially, the control needs to be reconsidered with it.
AI-assisted financial reporting is not a set-and-forget control environment.
The Same Accrual Schedule, Two Different Control Environments
For example, let's consider a routine but AI-assisted accrual schedule.
That difference in the chart above is what the control environment needs to capture in order to make AI-assisted work verifiable.
What a Control Environment
Needs to See
For a small issuer, the answer should not be a giant AI-governance bureaucracy. At minimum, the finance function needs a small set of repeatable artifacts:
▢ An AI-use register for financially relevant workflows - what is being used, where,
by whom, and for what purpose.
▢ A defined workflow for recurring uses - approved tool, source boundary, governing
instructions, ownership, and escalation points.
▢ An evidence packet or workpaper for material AI-assisted output, enough to
recover the basis of the work at the time it was produced.
▢ A documented reviewer sign-off - what was tested, what changed, what
exceptions were resolved, and who accepted the final work.
▢ A change trigger - a simple rule for when a new model, source, integration, or
workflow change requires re-assessment.
That is enough to begin moving AI from an invisible production shortcut into a visible part of the reporting process.
Practical Checklist: Before AI Work Enters Financial Reporting
Before relying on materially relevant AI-assisted work, ask:
▢ Do we know AI was used, and is the use case in our inventory?
▢ Can the reviewer identify the source data, documents, or accounting support the
work relied on?
▢ Can we recover the governing instructions and material assumptions?
▢ Can the material calculations, conclusions, or assertions be tied out or independently
tested?
▢ Is the reviewer's work evidenced - not merely implied by a sign-off?
▢ Would a meaningful change in model, source, configuration, or workflow trigger re-
assessment?
If the answer to several of those questions is no, the problem is that the finance team is relying on work the control environment cannot fully see.
Counterpoints Worth Taking Seriously
There are reasonable objections to treating AI-assisted financial reporting as a distinct control problem.
“People make mistakes too.”
Yes, and so do spreadsheets, accounting systems, and outside service providers. The issue is not that AI is uniquely fallible. The issue is whether or not the work can be tested, reproduced, and supported. A manually prepared spreadsheet may contain an error, but its formulas, inputs, and assumptions can usually be inspected. A system-generated report may be wrong, but the system and the controls surrounding it can be tested. What we're finding is that AI-produced work often lacks the full path from source to answer, which is not all that surprising, given that it's a new technology many issuers are still experimenting with.
“If a qualified accountant reviews the output, isn’t that enough?”
Sometimes. But human review is only as strong as what the reviewer can test. Looking at a finished answer and concluding that it looks reasonable is not the same as testing the source data, assumptions, completeness, calculations, exceptions, and judgment that produced it. Our confidence might be high, but as accountants we need evidence.
“Why not just treat AI like another software application?”
That's an argument that could be made. But in financial reporting, it doesn't matter to us if the work is AI-assisted or not. The workflow needs to be bounded, documented, repeatable, and supported by evidence that can be brought into the control environment.
“Do we really need a new framework? Existing internal-control standards
already apply.”
Yes, they do. AI does not repeal the existing requirements around completeness, accuracy, review, evidence, or management responsibility. In that sense, the underlying control principles are not new. What is new is the workflow. The purpose of an AI-specific framework is not to invent a new accounting standard; it's to make existing control requirements operational when using AI.
“Does every use of AI need this level of documentation?”
No. A risk-based framework should focus on financially relevant use: work that can affect amounts, disclosures, accounting judgments, controls, etc. Using AI to rewrite an internal email is not the same control problem as using it to build an accrual, generate reconciliations, interpret contracts, or draft disclosures. The control burden rises with the financial-reporting consequence.
It's a matter of having better-calibrated control. Management needs to match the significance of the work — lighter where AI is merely helping, stronger where it is influencing calculations, judgments, disclosures, or controls.
That is how AI becomes leverage without becoming a blind spot.
What PubCo Reporting Does
Pubco Reporting Solutions provides startups and smallcaps with the financial-reporting support they need — from the early growth stage to uplisting and beyond.
From financial statements and SEC filings to pre-audit prep and coordination, internal controls, EDGAR and SEDAR, and ongoing reporting...
For a free consultation to discuss your company's financial reporting needs, please book a call with us here >>
Key Takeaways
-
AI-assisted work becomes IPE the moment it enters a control or the financial statements. Reconciliations, accrual schedules, memos, variance analysis, disclosures, and other AI-influenced work do not sit outside the control environment simply because AI helped produce them.
-
The biggest AI risk is not (necessarily) a wrong answer. AI can produce a correct result while the sources, assumptions, instructions, transformations, or logic behind that result are incomplete or unrecoverable. That is Invisible IPE.
-
Existing control principles still apply. AI does not change the requirement that financial-reporting information be complete, accurate, supportable, and subject to effective review. It can change how difficult those requirements are to satisfy.
-
Human review is only useful when it is evidence-based. A reviewer looking at an answer is not the same as a reviewer testing the source data, assumptions, calculations, exceptions, and judgments that produced it.
-
Small issuers do not need enterprise-scale AI governance. They need a practical control layer: an inventory of financially relevant AI use, repeatable workflows, evidence captured at production, documented review, and reassessment when the workflow changes.
AI can change how financial-reporting work gets produced. It cannot lower the standard of evidence behind the work.
© 2026 PubCo Reporting Solutions, Inc.
Vancouver
610 - 475 W. Georgia St.
Vancouver, BC Canada
V6B 4M9
Miami
6800 SW 40th St #213
Miami, FL, USA 33155