Governing AI in the finance function: a one-page control set

Finance carries confidential data and statutory responsibility. A light governance layer lets teams use AI without surprising the auditor.

Six controls

1. Approved tools list. Name the tools staff may use for company data, and ban the rest.
2. Data rules. Say what may never be pasted: personal data, client names, unreleased results, bank details.
3. Human in the loop. Any output that reaches a ledger, a filing, a payment or a client needs a named human approver.
4. Evidence. Keep prompts and outputs for material uses, as you would keep working papers.
5. Validation. Test each use case on known data before relying on it, and again when the tool or model changes.
6. Ownership. Assign a use-case owner who is accountable for accuracy and for stopping the use if it fails.

Risk tiers

Low risk: drafting and summarising internal text. Medium: analysis that informs decisions. High: anything that posts, files or pays. Match the review effort to the tier.

Check data-protection and professional-confidentiality duties that apply to your entity and your clients before adopting any tool.