Most finance teams we talk to now have two AI habits running at once, often without anyone framing them as related. Reconciliation and variance drafting get automated first, because the order of operations makes sense and the failure mode is cheap — a human still reviews every exception. Separately, board memos and variance commentary start coming out of a copilot, with a reviewer signing off before anything leaves the building.

Each habit, on its own, is sound. The problem shows up a layer up: the review in the close was designed by the controller who owns the close. The review on drafted memos was designed by whoever owns board reporting. Nobody wrote down a single standard that says, across both, what "reviewed" actually means — and that gap doesn't matter until a third or fourth AI touchpoint arrives and nobody owns the full picture.

What's missing isn't more review — it's one shared definition of it

Ask two different teams at the same company what "a human reviewed this" means for their AI output, and you'll usually get two different answers. One team traces every number back to source. Another team reads the draft for tone and assumes the underlying data was already correct, because the model "has been fine so far." Both would describe themselves as having a review step. Only one of them has a control.

That inconsistency is invisible right up until an auditor, a new CFO, or a board member asks a simple question — who signed off on this, and what did signing off actually require of them? — and the honest answer is "it depends which team you ask."

The minimum standard

Every AI touchpoint needs three things on record: a log of what the model did, a named human reviewer accountable for the output, and a written definition of what that reviewer is required to check before signing.

Turning two ad hoc habits into one register

This doesn't require a governance committee or a new piece of software. The teams doing this well keep it as close to existing SOX- style control documentation as possible — because that's exactly what it is, applied to a newer kind of process:

  • One register, every touchpoint. Reconciliation automation and memo drafting go on the same list, next to each other, not in separate team-owned documents nobody else reads.
  • A named reviewer, not a named team. "Finance reviews this" isn't a control. "Priya reviews this before it posts" is.
  • A written check, not a vibe. For reconciliation, that might be "every exception above threshold gets traced to source." For drafting, it's "every causal claim gets a cited line item." Write down what's actually required.
  • A review cadence for the control itself. Quarterly, someone re-reads a sample of what was approved and confirms the check is still being done the way it's written down — not just that a name is attached.

A control that lives in one person's habits isn't a control. It's a hope with a job title attached.

Why this matters more as the second habit becomes a third

One AI touchpoint, loosely governed, rarely causes a real problem — the team running it usually has good instincts and catches what matters. The risk compounds with the second and third touchpoint, each added by a different team, each inventing its own version of "good enough" review in isolation. Nobody is doing anything wrong. Nobody is also looking at the whole picture, which is exactly the condition under which something eventually gets missed and the retrospective question becomes "how did nobody catch this" rather than "whose job was it to catch this."

What this doesn't require

  • An AI ethics board. This is operational control documentation, not policy theater — the same muscle finance already has for every other process.
  • New tooling. A shared spreadsheet with touchpoint, owner, check, and last-audit-date columns is a perfectly adequate starting register.
  • Slowing down adoption. The point isn't to gate new AI use cases behind approval — it's to make sure each one that's already live has an owner and a written check, which usually takes an afternoon per touchpoint.

The order and the discipline, under one roof

The sequencing logic for what to automate first and the discipline of naming a reviewer who actually re-derives the claims are both the right instincts on their own. What turns them into something that survives an audit, a leadership change, or simply more AI touchpoints than one team can informally track is writing them down the same way, in the same place, so "reviewed" means the same thing no matter which part of finance is doing the reviewing.