Page 78 - CMA Journal (Jul-Aug 2026)

TOP TECHNOLOGY TREND
T O P T E CHNO LO G Y T RE ND
Governing AI Before It Governs the Numbers:
A Practical Agenda for Finance Leaders
Introduction Why Finance
A common misconception about AI in nance is that Cannot Delegate
it's usually a catastrophic failure of the machines. It is AI Governance
usually an undocumented tool, an unchecked answer,
a private spreadsheet that is pasted into a public Sometimes AI
system, or an answer that is based on assumptions that governance is perceived
as an IT or legal project.
are uncheckable. The role and in uence of AI on Both functions are
decisions, controls and trust are therefore shifting from necessary, but neither
user to stewardship by nance leaders.
can be the sole driver of
Arti cial intelligence is not usually implemented in an the impact of AI on
organization as a singular, formal transformation enterprise value. Finance
initiative. It arrives quietly. A team out ts a generative has an understanding of Dr. Salman Ahmed Khatani
AI assistant to create a variance commentary. A materiality, internal Associate Professor & AI Literacy
procurement analyst instructs a model to make controls, audit trails, Practitioner, IQRA University
comparisons on bids. A controller tries out anomaly decision rights, and
detection. A business unit purchases software with an cost-bene t trade-o s, as well as the di erence
AI component, but the contract calls it "automation”. between an estimate and a fact. Finance is a logical
When senior management talks about an AI policy, the co-owner of AI governance because of those
technology could be impacting reports, estimates, and capabilities.
decisions. Try to think of a model that makes a cash ow
This results in an administrative void. The organization prediction. The technical team may perform accuracy
might be aware of the enterprise systems that it has, and cybersecurity assessments. Legal could review
but not the types of AI systems which employees are contractual and privacy issues. Finance has yet to
using, the data fed into those AI systems, or how their decide on the right model for the planning cycle,
output in uences decision-making. That is the reason whether any unusual events are included, who could
why the riskiest AI in the nancial sector might not be be responsible for overriding the model, and how it
the most sophisticated. Maybe the unrecorded one. will be explained if there is a material variance. The
same holds true for credit scoring, pricing, expense
The need is not hypothetical. According to the World review, tax analysis, fraud alerts, and management
Economic Forum's Future of Jobs Report 2025, 86% of reporting. If you have a technically sound system but
employers believe that AI and information-processing have the wrong context, incentives, or controls, then
technologies will change the nature of their business you will get a poor business decision.
by 2030. This gure is even higher in nancial services, Finance should not try to be the owner of all the
at 97 percent. Meanwhile, international advice is technical decisions. It is designed to guarantee
gaining in speci city. NIST categorizes AI risk accountability in the use of AI in nancial processes.
management into four functions: Govern, Map, This involves asking the "why" questions that ensure
Measure, and Manage. ISO/IEC 42001 speci es the integrity of the numbers: What decision is the
requirements for an AI management system for an system supporting? What are the chances of
organization. Transparency, robustness, and something going wrong? What might the
accountability are key principles in the OECD AI repercussions be? Which aspects need to be
Principles. Some high-risk obligations are given a later preserved? Who is responsible if the product is
transition date, but the main parts of the European disputed?
Union's AI Act entered into general application on 2
August 2026. In fact, these changes demonstrate the Govern the Use Case, Not Just the Tool
direction of travel: the use of AI must be made visible, A common mistake is to approve or prohibit AI tools as
risk-based, documented and reviewable, even for a whole. Risk usually depends less on the brand of the
organizations outside Europe. tool than on the use case.
76 ICMA’s Chartered Management Accountant, Jul-Aug 2026
A tool which passed validation six months ago may act
di erently after an undetected update. The register
should therefore be linked to vendor review and
monitoring for changes. To understand what the
organization relies on, there must be a shared
understanding between procurement, technology,
legal, and nance.
Treat AI literacy as an internal control
No policies can cover all prompts or features. Individuals
should be aware when an AI answer isn't certain, when
data isn't suitable to be shared, and when escalation is
necessary. Training should be job speci c. The nancial
analyst requires other examples than does the
accounts-payable o cer, the internal auditor or a board Good governance does not come with guarantees that AI
member. Short scenario-based exercises are more will never get it wrong. It ensures that the organization is
e ective than a generic annual presentation. It is not aware of where AI is being used, what failure would entail,
about becoming a data scientist. Its purpose is to develop
adds controls in accordance with consequences, and is
educated doubt and sensible faith. able to explain the nal decision-maker. That ability to
The same generative AI service may be low risk when it and mechanisms for access to the data. Equally crucial, What nance leaders can do in the next factor in decisions becomes a marketable skill in an age of
improves the wording of a public presentation, and there should be evidence of material outputs. Keep 90 days? fake content and AI-driven recommendations.
high risk when it recommends provisions, evaluates source data, relevant prompt or con guration, model The question nance leaders are now faced with is no
employees, or processes con dential customer data. version (if applicable), human reviewer, approval, and Day 1-30: Assess what AI is being used. Make a set of use longer, 'Should we use AI?'. It is, 'What shall we do when
Governance must therefore begin with the purpose, nal decision. If there is no traceability, there's only cases, review software features and procurement records, we must? The answer needs to be accurate numbers,
data, decision, and possible consequence. guesswork in the review. and conduct team surveys. Release an interim regulation safeguarded information, transparency and
A Finance-Led Operating Model Keep human judgment at the decision point about acceptable tools, con dential information, and accountability, evidence that can be checked, and human
Human oversight is NOT being done by putting a required human review. Choose 2-3 material use cases to judgment in the right places. Regulating those conditions
Create an AI use-case register human at the end of an automated process. The explore in greater detail. does not impede innovation. That's the path to winning
Don't wait for a day of perfection. Use a practical reviewer should have the authorization, skills, time, and Days 31-60: Categorize those use cases based on the trust in innovation.
register that includes columns for business purpose, data to critique the product. It is important for controls consequences and assign owners, and document some References
owner, users, data sources, vendor or model, output, to recognize situations where AI might make a minimum controls. Verify reproduction and challenge of
a ected decision, risk tier and risk review date. Don't
just use stand-alone chatbots, but integrate AI into decision, decisions AI might suggest, and decisions AI outputs. Check terms with vendors and determine areas of • European Commission. AI Act: regulatory framework and
application timeline, updated 2026. Available at: https://digital-
need for logging, access, data management, and incident
current software applications. The register turns should never make on its own. A reviewer who is reporting. strategy.ec.europa.eu/en/policies/regulatory-framework-ai
invisible experimentation into controlled work. It also accustomed to clicking 'approve' adds ceremony; it
avoids duplicate purchases and facilitates the doesn't add governance. Days 61-90: Approve, amend, or suspend priority use • IFAC. IFAC Technology Matrix: Arti cial Intelligence and
comparison of the nancing's value with the control Test for business tness, not only accuracy cases. Set up regular reviews of high-risk applications, Accounting resources. Available at: https://www.ifac.org/
de ne escalation and fallback plans, and start delivering knowledge-gateway/discussion/ifac-technology-matrix
cost. Accurate is not enough; it is necessary. Finance leaders AI literacy training to various groups. Report to senior • ISO. ISO/IEC 42001:2023, Arti cial intelligence management
Assign accountability before approval should also question the stability, explain ability of the management in business language: value created, risk system. Available at: https://cdn.standards.iteh.ai/samples/
Each use case must have a business owner, who will be system (to the decision), security, and fairness of the accepted, controls operating, and decisions required. 81230/4c1911ebc9a641fcb6ee21aa09c28ad3/ISO-IEC-42001-202
held accountable for results; a technical owner, who system when people are involved, and resilience of the This way you do not fall into two undesirable traps. One is 3.pdf
has technical knowledge of the system; and a control system in the case of changes in data or conditions. The an embargo that breaks the cycle of experimentation. The • NIST. Arti cial Intelligence Risk Management Framework:
owner, who is knowledgeable about the safeguards test must not be based on average performance but on other is that it's an unrestricted adoption that takes speed Generative Arti cial Intelligence Pro le, 2024. Available at:
and will ensure they are working. Approval should be exceptional cases. This could be supply interruption, for progress. Good governance provides a regulated https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
cross-functional for material applications. An AI currency uctuation, and/or an unexpected shift in innovation journey. Low-risk uses are fast-moving. Strong • OECD.AI. OECD AI Principles, updated May 2024. Available at:
committee can coordinate, but accountability should demand for a forecasting model. In the case of evidence, oversight, and accountability for high-impact https://oecd.ai/en/ai-principles
not be forgotten in a committee. Whether and under generative AI, it could be fabricated citations, uses.
what circumstances the use is acceptable is up to the inaccurate calculations, prompt injection, or leakage of • World Economic Forum. Future of Jobs Report 2025. Available at:
decision of a named executive. con dential data. There need to be thresholds on Conclusion: The Advantages of Trust https://www.weforum.org/publications/the-future-of-jobs-repor
t-2025/
Protect data and preserve evidence material use cases that, on review, suspension, or The role of AI will grow more signi cant in predicting,
fallback to manual process. planning for resource allocation, anomaly identi cation,
The nance data is particularly con dential as it may Govern vendors and model change and communicating performance. The nance function
show performance, pricing, payroll, customers, The purchase of AI doesn't shift responsibility. Data use, may react to the problems as they start to arise, or be
suppliers and future strategy. Rules of approved use security, audit rights, service continuity, model updates proactive in de ning the rules under which AI can enter
should include what kinds of information can be placed and noti cation, and exit arrangements should all be the enterprise. The second one is more valuable.
in each system, where it is processed, whether data is covered in contracts.
allowed to be retained or processed on that system,