Page 79 - CMA Journal (Jul-Aug 2026)

T O P T ECHNO L O G Y T R END

A tool which passed validation six months ago may act
Table 1: Risk-Based Governance Framework for AI Use in Finance di erently after an undetected update. The register
should therefore be linked to vendor review and
Risk tier Finance examples Primary concern Minimum governance response monitoring for changes. To understand what the
Low Drafting public text; Poor wording or minor User review; approved tool; no organization relies on, there must be a shared
summarizing non-sensitive inaccuracy con dential data understanding between procurement, technology,
material legal, and nance.
Moderate Variance commentary; Misinterpretation or data Named owner; source checks; access
Introduction Why Finance spend classi cation; leakage controls; sample testing Treat AI literacy as an internal control

A common misconception about AI in nance is that Cannot Delegate internal research nancial or Independent validation; documented No policies can cover all prompts or features. Individuals
should be aware when an AI answer isn't certain, when
Forecasts; credit or pricing Material
it's usually a catastrophic failure of the machines. It is AI Governance High recommendations; fraud customer impact limits; human approval; monitoring data isn't suitable to be shared, and when escalation is
usually an undocumented tool, an unchecked answer, alerts necessary. Training should be job speci c. The nancial
a private spreadsheet that is pasted into a public Sometimes AI Automated postings, Direct loss, misstatement, Executive approval; segregation of analyst requires other examples than does the
system, or an answer that is based on assumptions that governance is perceived Critical payments, disclosures or unfair outcome or non- duties; audit trail; fallback and accounts-payable o cer, the internal auditor or a board Good governance does not come with guarantees that AI
as an IT or legal project.
are uncheckable. The role and in uence of AI on Both functions are consequential decisions compliance incident plan member. Short scenario-based exercises are more will never get it wrong. It ensures that the organization is
decisions, controls and trust are therefore shifting from necessary, but neither e ective than a generic annual presentation. It is not aware of where AI is being used, what failure would entail,
user to stewardship by nance leaders. about becoming a data scientist. Its purpose is to develop
can be the sole driver of Source: Author's synthesis based on NIST AI RMF and ISO/IEC 42001. adds controls in accordance with consequences, and is
Arti cial intelligence is not usually implemented in an the impact of AI on educated doubt and sensible faith. able to explain the nal decision-maker. That ability to
organization as a singular, formal transformation enterprise value. Finance The same generative AI service may be low risk when it and mechanisms for access to the data. Equally crucial, What nance leaders can do in the next factor in decisions becomes a marketable skill in an age of
initiative. It arrives quietly. A team out ts a generative has an understanding of improves the wording of a public presentation, and there should be evidence of material outputs. Keep 90 days? fake content and AI-driven recommendations.
AI assistant to create a variance commentary. A materiality, internal high risk when it recommends provisions, evaluates source data, relevant prompt or con guration, model The question nance leaders are now faced with is no
procurement analyst instructs a model to make controls, audit trails, employees, or processes con dential customer data. version (if applicable), human reviewer, approval, and Day 1-30: Assess what AI is being used. Make a set of use longer, 'Should we use AI?'. It is, 'What shall we do when
comparisons on bids. A controller tries out anomaly decision rights, and Governance must therefore begin with the purpose, nal decision. If there is no traceability, there's only cases, review software features and procurement records, we must? The answer needs to be accurate numbers,
detection. A business unit purchases software with an cost-bene t trade-o s, as well as the di erence data, decision, and possible consequence. guesswork in the review. and conduct team surveys. Release an interim regulation safeguarded information, transparency and
AI component, but the contract calls it "automation”. between an estimate and a fact. Finance is a logical A Finance-Led Operating Model Keep human judgment at the decision point about acceptable tools, con dential information, and accountability, evidence that can be checked, and human
When senior management talks about an AI policy, the co-owner of AI governance because of those Human oversight is NOT being done by putting a required human review. Choose 2-3 material use cases to judgment in the right places. Regulating those conditions
technology could be impacting reports, estimates, and capabilities. Create an AI use-case register human at the end of an automated process. The explore in greater detail. does not impede innovation. That's the path to winning
decisions. Try to think of a model that makes a cash ow Don't wait for a day of perfection. Use a practical reviewer should have the authorization, skills, time, and Days 31-60: Categorize those use cases based on the trust in innovation.
This results in an administrative void. The organization prediction. The technical team may perform accuracy register that includes columns for business purpose, data to critique the product. It is important for controls consequences and assign owners, and document some References
might be aware of the enterprise systems that it has, and cybersecurity assessments. Legal could review owner, users, data sources, vendor or model, output, to recognize situations where AI might make a minimum controls. Verify reproduction and challenge of
a ected decision, risk tier and risk review date. Don't
but not the types of AI systems which employees are contractual and privacy issues. Finance has yet to just use stand-alone chatbots, but integrate AI into decision, decisions AI might suggest, and decisions AI outputs. Check terms with vendors and determine areas of • European Commission. AI Act: regulatory framework and
need for logging, access, data management, and incident
application timeline, updated 2026. Available at: https://digital-
using, the data fed into those AI systems, or how their decide on the right model for the planning cycle, current software applications. The register turns should never make on its own. A reviewer who is reporting. strategy.ec.europa.eu/en/policies/regulatory-framework-ai
output in uences decision-making. That is the reason whether any unusual events are included, who could invisible experimentation into controlled work. It also accustomed to clicking 'approve' adds ceremony; it
why the riskiest AI in the nancial sector might not be be responsible for overriding the model, and how it avoids duplicate purchases and facilitates the doesn't add governance. Days 61-90: Approve, amend, or suspend priority use • IFAC. IFAC Technology Matrix: Arti cial Intelligence and
the most sophisticated. Maybe the unrecorded one. will be explained if there is a material variance. The comparison of the nancing's value with the control Test for business tness, not only accuracy cases. Set up regular reviews of high-risk applications, Accounting resources. Available at: https://www.ifac.org/
same holds true for credit scoring, pricing, expense de ne escalation and fallback plans, and start delivering knowledge-gateway/discussion/ifac-technology-matrix
The need is not hypothetical. According to the World review, tax analysis, fraud alerts, and management cost. Accurate is not enough; it is necessary. Finance leaders AI literacy training to various groups. Report to senior • ISO. ISO/IEC 42001:2023, Arti cial intelligence management
Economic Forum's Future of Jobs Report 2025, 86% of reporting. If you have a technically sound system but Assign accountability before approval should also question the stability, explain ability of the management in business language: value created, risk system. Available at: https://cdn.standards.iteh.ai/samples/
employers believe that AI and information-processing have the wrong context, incentives, or controls, then Each use case must have a business owner, who will be system (to the decision), security, and fairness of the accepted, controls operating, and decisions required. 81230/4c1911ebc9a641fcb6ee21aa09c28ad3/ISO-IEC-42001-202
technologies will change the nature of their business you will get a poor business decision. held accountable for results; a technical owner, who system when people are involved, and resilience of the This way you do not fall into two undesirable traps. One is 3.pdf
by 2030. This gure is even higher in nancial services, Finance should not try to be the owner of all the has technical knowledge of the system; and a control system in the case of changes in data or conditions. The an embargo that breaks the cycle of experimentation. The • NIST. Arti cial Intelligence Risk Management Framework:
at 97 percent. Meanwhile, international advice is technical decisions. It is designed to guarantee owner, who is knowledgeable about the safeguards test must not be based on average performance but on other is that it's an unrestricted adoption that takes speed Generative Arti cial Intelligence Pro le, 2024. Available at:
gaining in speci city. NIST categorizes AI risk accountability in the use of AI in nancial processes. and will ensure they are working. Approval should be exceptional cases. This could be supply interruption, for progress. Good governance provides a regulated https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
management into four functions: Govern, Map, This involves asking the "why" questions that ensure cross-functional for material applications. An AI currency uctuation, and/or an unexpected shift in innovation journey. Low-risk uses are fast-moving. Strong • OECD.AI. OECD AI Principles, updated May 2024. Available at:
Measure, and Manage. ISO/IEC 42001 speci es the integrity of the numbers: What decision is the committee can coordinate, but accountability should demand for a forecasting model. In the case of evidence, oversight, and accountability for high-impact https://oecd.ai/en/ai-principles
requirements for an AI management system for an system supporting? What are the chances of not be forgotten in a committee. Whether and under generative AI, it could be fabricated citations, uses.
organization. Transparency, robustness, and something going wrong? What might the what circumstances the use is acceptable is up to the inaccurate calculations, prompt injection, or leakage of • World Economic Forum. Future of Jobs Report 2025. Available at:
accountability are key principles in the OECD AI repercussions be? Which aspects need to be decision of a named executive. con dential data. There need to be thresholds on Conclusion: The Advantages of Trust https://www.weforum.org/publications/the-future-of-jobs-repor
t-2025/
Principles. Some high-risk obligations are given a later preserved? Who is responsible if the product is Protect data and preserve evidence material use cases that, on review, suspension, or The role of AI will grow more signi cant in predicting,
transition date, but the main parts of the European disputed? fallback to manual process. planning for resource allocation, anomaly identi cation,
Union's AI Act entered into general application on 2 The nance data is particularly con dential as it may Govern vendors and model change and communicating performance. The nance function
August 2026. In fact, these changes demonstrate the Govern the Use Case, Not Just the Tool show performance, pricing, payroll, customers, The purchase of AI doesn't shift responsibility. Data use, may react to the problems as they start to arise, or be
direction of travel: the use of AI must be made visible, A common mistake is to approve or prohibit AI tools as suppliers and future strategy. Rules of approved use security, audit rights, service continuity, model updates proactive in de ning the rules under which AI can enter
risk-based, documented and reviewable, even for a whole. Risk usually depends less on the brand of the should include what kinds of information can be placed and noti cation, and exit arrangements should all be the enterprise. The second one is more valuable.
organizations outside Europe. tool than on the use case. in each system, where it is processed, whether data is covered in contracts.
allowed to be retained or processed on that system,

ICMA’s Chartered Management Accountant, Jul-Aug 2026 77