CFOs, auditors push AI governance in finance

By early 2026, CFOs occupy a pivotal yet narrowing window to lead AI value creation in regulated enterprises, uniquely positioned to define, fund, and measure AI initiatives that drive enterprise-wide governance and accountability. Despite only 2% of C-suite executives assigning them this role, when CFOs take charge, 76% report substantial AI value generation, according to a Harvard Business Review survey cited by Melissa Valentine. This leadership demands CFOs grasp the technical robustness of AI architectures, including 'harness engineering'—the layered infrastructure and monitoring systems critical to safe, scalable AI deployment—underscored by incidents like Anthropic’s source code exposure that spotlight governance vulnerabilities.

The rapid evolution of generative AI from experimental pilots to production-grade systems has elevated AI accountability to a core CFO competency, as Melissa Valentine notes: 'Two years ago, rigorous accountability would have been premature. Today, it’s essential.' CFOs, alongside auditors, are professionalizing AI governance by enforcing measurable ROI, risk mitigation evidence, and comprehensive audit trails, creating a feedback loop that pressures front-end AI quality improvements. This governance rigor aligns with the principle that AI risk is defined by business use cases and consequences, not the technology itself, placing ultimate accountability on the business leaders who fund and approve AI projects rather than on technical teams.

Rather than reinventing governance frameworks for AI, CFOs are adapting established structures like SOX controls and the three lines of defense model to meet AI’s unique challenges. This pragmatic approach leverages existing organizational muscle to embed AI oversight seamlessly, as one expert advises, 'You don't have to reinvent the wheel... You have SOX controls, first, second, third line structures... already mapping to AI governance needs.' Such integration enables regulated enterprises to scale trustworthy AI deployment efficiently while maintaining compliance and accountability.

By mid-2026, internal audit functions are spearheading a fundamental transformation from traditional, periodic compliance checks to continuous assurance models powered by AI and automation. This evolution is driven by close collaboration with IT teams, who own many controls and are receptive to automation that enhances efficiency and real-time oversight. As one opinion piece noted, shifting internal auditors from reactive roles to proactive influencers capable of 'sales conversations' is essential to embed continuous assurance practices that keep pace with rapidly evolving technology environments.

AI’s role in modernizing internal audit is multifaceted: it automates structured, repeatable tasks such as control testing and evidence collection, accelerating audit execution without sacrificing quality or human judgment. However, the effectiveness of AI hinges on well-defined control frameworks; organizations are elevating risk and control matrices into structured audit test frameworks that encode reviewer judgment into reusable rules. This foundation enables a shift from point-in-time testing to continuous controls monitoring, delivering real-time assurance and reducing audit disruption while preserving the essential human role of interpreting findings and advising leadership on risk mitigation.

The true value of AI in internal audit extends beyond automation to uncovering meaningful signals within complex data environments, enabling earlier risk detection and shifting auditor focus from mere evidence gathering to delivering strategic insights to management and boards. To maximize this impact, audit teams must industrialize analytics by embedding scalable, repeatable AI-driven processes rather than relying on one-off scripts. Building trust in AI outputs requires robust data quality, governance, and model oversight, alongside fostering a connected assurance ecosystem that integrates data, technology, risk, compliance, and audit functions for a holistic view of organizational risk.

AI-native startups like Ardan, co-founded by Aryaman Khanna, are revolutionizing internal audit by automating manual, spreadsheet-heavy processes that have long dominated this $250 billion industry. These newcomers, unburdened by traditional domain constraints, bring fresh perspectives that challenge legacy workflows, enabling auditors to focus on judgment and evaluation rather than tedious data gathering. Beyond saving hours, AI now provides better visibility into company processes, allowing instant resolution of potentially multi-million dollar issues. Furthermore, emerging agentic AI capabilities promise to elevate internal audit by uncovering insights and patterns beyond traditional sampling methods, enabling auditors to ask deeper questions and deliver higher quality, intelligence-led outcomes.

By mid-2026, it became clear that traditional audit oversight frameworks, including PCAOB standards, were ill-equipped to handle AI-augmented audit procedures, particularly as firms increasingly analyze entire transaction populations rather than samples. MindBridge highlighted the urgent need for the PCAOB to explicitly prioritize AI in its strategic agenda, calling for a comprehensive review of supervision rules, documentation requirements, and quality management standards to accommodate AI systems performing audit work. This evolution implicitly demands new AI-specific disciplines such as evaluation engineering and runtime governance, alongside enhanced inspector training to properly assess machine-generated findings.

The absence of clear regulatory guidance has led audit firms to duplicate efforts by running AI-assisted tests alongside traditional manual procedures, unsure if AI-generated evidence alone will satisfy inspectors. MindBridge advocated for greater transparency from the PCAOB through aggregated, anonymized reporting on technology-assisted audit procedures and identified deficiencies, aiming to clarify expectations and improve implementation. Meanwhile, the PCAOB has taken initial steps like forming an inspections modernization council, but these remain insufficient without comprehensive, AI-tailored auditing standards to address emerging ethical concerns and independence risks unique to AI, such as conflicts when AI audit tools are trained on the same data they audit.

Amid these regulatory gaps, enterprises are adapting established governance frameworks like SOX to manage AI risks effectively, leveraging familiar control structures rather than reinventing governance from scratch. As one analysis noted, 'You don't have to reinvent the wheel'—existing first, second, and third line controls, objective-setting practices, and software development controls are being mapped onto AI governance needs. This approach emphasizes that accountability for AI-driven decisions rests with business leaders who authorize AI use cases, reinforcing that AI risk is tied to governance and use cases rather than the technology itself.

Practical adaptation of SOX-style controls to AI governance involves emphasizing structured, inspectable outputs and comprehensive audit trails, ensuring AI tools produce evidence detailed enough for independent review, as current PCAOB standards like AS 1215 remain the primary benchmark. This process includes pilot testing with designated owners, measuring testing quality, and iterative improvements, reflecting the integration of AI-specific disciplines such as evaluation engineering and runtime governance. Such disciplined approaches have demonstrated tangible benefits, with well-chosen AI vendors enabling teams to reclaim hours and reduce repeat information requests, often paying back investments within four to six months.

By mid-2026, it became clear that traditional software testing paradigms fall short for AI systems, especially in regulated sectors like banking, where outputs are probabilistic and can vary with identical inputs. Thoughtworks introduced the concept of 'evaluation engineering,' emphasizing continuous evaluation over deterministic verification to manage AI's unique failure modes such as 'confident hallucinations' and 'silent behavioural drift' that produce plausible yet incorrect results, posing significant risk management challenges.

This evolving landscape demands a fundamental shift from point-in-time testing to continuous monitoring and operational oversight, as highlighted by Simon Hull and Marnie McCormack. Hull stressed that persistent oversight of AI behaviors and model interactions is essential, while McCormack argued that AI quality engineering in financial services requires a systems engineering mindset focused on trust and observability, not just conventional software engineering. However, observability tools remain immature, and integrating audit constraints like SOX into AI systems is an ongoing challenge, underscoring the convergence of governance, compliance, and continuous testing.

Tanvi Mittal's insights further illuminate the necessity of continuous, adversarial testing and measurement across diverse inputs to build genuine trust in AI systems. She points out that traditional software metrics fail to capture AI-specific risks such as model drift and hallucinations, necessitating novel evaluation frameworks and tools like LogMiner-QA and PromptArmor. Mittal also highlights the 'activation gap' in AI-generated code, where secure coding knowledge exists but is inconsistently applied, reinforcing the need for rigorous validation and ongoing adversarial testing to maintain security and compliance in regulated environments.

AI agents are emerging as promising tools to automate the labor-intensive data testing processes in financial institutions by autonomously profiling data, generating validation rules, and triaging failures. However, as noted in July 2026 analyses, adoption must be cautious to satisfy stringent governance, auditability, and explainability requirements under frameworks like DORA. While AI agents already deliver measurable value across the data testing lifecycle, a hybrid approach combining AI automation with human expertise remains essential to uphold regulatory controls and ensure robust oversight.

Effective AI risk management in regulated financial operations hinges on end-to-end auditability and explainability, ensuring every step from data ingestion to outcome generation is transparent. Ongoing monitoring is critical to detect divergences or unexpected behaviors promptly, enabling timely human intervention. Moreover, risk scrutiny must be proportional to the model’s material impact; for instance, AI models in high-stakes trading require far more rigorous oversight than those handling routine tasks like invoice processing, reflecting a nuanced, risk-based approach to AI governance.

By mid-2026, financial enterprises recognized that traditional point-in-time testing and periodic audits were insufficient for AI systems, which demand continuous monitoring, explainability, and runtime governance due to their adaptive nature. Simon Hull highlighted the necessity of shifting from static validation to persistent oversight of AI behaviors and outputs, while Marnie McCormack emphasized that the focus must move from software engineering to systems engineering, where the trusted system—not just the code—is the critical asset. However, challenges remain in observability maturity and integrating audit constraints like SOX into AI governance frameworks, underscoring the need for upfront architectural rigor and a convergence of testing, governance, and operational resilience to ensure trustworthy AI deployment.

AI surged as the top compliance concern among financial firms by July 2026, with the ACA Group reporting that 85% of respondents prioritized AI over cybersecurity by a 50-point margin. Despite widespread adoption—86% of firms had AI use policies and 59% established governance committees—significant gaps persisted in human oversight and third-party AI governance, with less than half implementing formal 'human-in-the-loop' plans and only 30% addressing third-party AI risks. While firms increased compliance testing and updated vendor due diligence, continuous monitoring and internal tracking enhancements lagged, revealing an uneven and cautious integration of AI into compliance functions.

In regulated financial operations, the emphasis shifted from validating AI technology—which is becoming commoditized—to ensuring explainability, auditability, and traceability of every AI decision, as no black boxes are acceptable. Continuous human oversight is critical to detect model divergence and anomalous inputs, enabling timely intervention before risks escalate. Risk management must be tailored to the materiality of business functions, with high-risk areas like trading demanding more stringent supervision than lower-risk tasks such as invoice processing. This nuanced approach reflects a mature understanding that supervising and understanding AI’s inner workings is paramount to maintaining compliance and trust.

While AI tools are widely used for administrative compliance tasks—such as summarizing reports and drafting communications—reliance on desktop AI solutions like ChatGPT may limit effectiveness in managing complex compliance requirements. This highlights a tension between rapid AI adoption for efficiency gains and the need for robust, scalable AI governance frameworks that can handle the intricacies of financial regulation and risk management.