Written by Sahil Shah
A transaction occurs just below the approval threshold. Then another and another. The automated monitoring system detects the pattern and flags it as potentially indicative of someone deliberately circumventing the controls. But what if most of those transactions are legitimate?
Technology did its job and detected something it considered out of the norm. The problem, however, was a lack of context. The system still needed to understand the business, how it conducted transactions, and the people involved to determine which transactions were risky and which were not.
This distinction is even more pertinent as financial institutions use artificial intelligence (AI) for fraud detection, risk assessment, and controls. Technology can review more transactions, spot patterns quickly, and identify anomalies that a manual review would likely miss. The issue is what to do with those findings, and that requires human judgment.
How fraud and data problems led to AI
Some of the most compelling arguments for AI-driven financial controls stem from the inherent weaknesses of conventional fraud detection. Contract-processing practices that allow transactions to proceed without proper verification can facilitate legitimate business activity but can also create opportunities for fraud. Data integrity issues and operational weaknesses increase exposure. Established rules catch some anomalies, but suspicious behavior does not always fit the patterns existing controls were designed to detect.
For banks, treasury teams, and corporate finance teams, the relevance is obvious. Payment irregularities, odd journal entries, and questionable approvals often only come to light when viewing transactions in aggregate.
What AI-assisted analytics changed
Historically, financial control testing has relied almost entirely on sampling. Auditors chose a selection of transactions, reviewed the results, and decided whether they suggested a broader problem. That approach still has merit, but analytical technology has made full population testing much more viable.
Tools such as SQL, Power BI, and Tableau enable the finance function to compare transactions against risk criteria, reconcile information across systems, and investigate exceptions without manually sorting through thousands of records. The benefits include faster reporting and greater visibility into activity previously hidden in the data.
Why human judgment remains essential
One practical test for whether a financial process needs human review is whether two competent professionals, looking at the same evidence, could reasonably reach different conclusions. Matching invoices or finding duplicate payments generally follows a set of rules. Assessing an impairment charge, interpreting a complex contract, or determining whether an unusual entry is fraud all differ. Those decisions rest on assumptions the data alone cannot answer.
The issue becomes even more complex when attempting to reduce false positives. The monitoring system may generate so many alerts that the people reviewing them simply can’t get through them. Raising the detection threshold seems to be the answer, because it flags far fewer transactions. Unfortunately, that adjustment could mask a breach of conduct.
Threshold changes require testing against known cases, and analysts need to be extremely mindful of what falls below the new thresholds. Otherwise, management has no way of knowing whether the AI system has improved its detection capabilities or has simply stopped identifying relevant exceptions. This is where overconfidence in automation can be dangerous. A report showing fewer exceptions is reassuring only if analysts can establish why the exceptions have decreased.
Analysts cannot assign accountability to a machine. The 2026 AFP Payments Fraud and Control Survey found that treasury was the function most likely to detect attempted fraud (83%) and actual fraud (55%). The survey also found that only 17% of organizations used AI to fight payment fraud. Those figures underline the value of using experienced financial staff to spot and address suspicious activity.
In one case, an audit manager at a telecom company oversaw five auditors responsible for approximately 40 stores. An investigation uncovered significant fraud and led to the termination of seven employees. The work involved reviewing transactions, coordinating with police, filing court action, and handling other associated responsibilities. Technology could assist in identifying evidence. It could not conduct the entire investigation or work out the implications.
Organizations incorporating AI into financial controls can draw on the COSO Internal Control—Integrated Framework. Four practices are particularly useful:
Assess the financial reporting exposure. Identify which AI-assisted activities affect the financial statements or reporting controls. The more significant the impact, the greater the need for review.
Control who can do what. Access permissions and approval limits are still critical, especially for automated systems that can initiate or affect transactions.
Test changes prior to deployment. Keep model development separate from production so analysts can validate any changes to rules, thresholds, or the underlying analytical logic.
Make someone responsible. Every model-assisted control needs an owner accountable for monitoring performance, investigating failures, and knowing when the output no longer makes sense.
None of these practices are particularly revolutionary. AI changes how controls work, but the fundamental responsibilities of financial management remain unchanged.
A practical path for modernizing enterprise risk management
Before automating a financial control, analysts need to understand how the process works. A flawed process that runs faster is still flawed. Automation can make the consequences of the flaw harder to see when staff accept the results without question.
Start with risk registers. Instead of updating documents during periodic compliance reviews, they can record exposures, decisions, corrective actions, and risk changes as they happen. Past incidents and their outcomes provide useful material for assessing the model’s future performance.
Training deserves equal attention. Finance professionals do not need to become software developers, but familiarity with data analysis helps them challenge questionable findings. Technology teams, meanwhile, benefit from understanding why accounting concepts such as materiality, cut-off, and segregation of duties matter. Senior executives will ask a different set of questions: Which of the financial controls are model-based? Who tested the model? When was it last reviewed?
Answers will vary by organization. A large financial institution might have the capacity to support extensive monitoring and investigation. A smaller business with fewer people may be better served by a more limited set of controls that it can consistently review and act on.
The true measure of success: Better decision-making, not more data
As analytical systems improve, they’ll look beyond the ledger. Contracts, correspondence, filings, and other unstructured data will increasingly become part of continuous monitoring. That will give the investigator more evidence, but also more findings to interpret.
The true test of progress won’t be how many anomalies it finds or how slick the dashboard is. It will be whether the organization makes better decisions, identifies significant problems, and recognizes when controls are ineffective. AI can make financial risk easier to see. But understanding the risk, deciding what it means, and taking responsibility for the outcome are responsibilities that only humans can assume.
About the Author:
Sahil Samir Shah is an accounting consultant at Diamond Universe LLC, a wholesale jewelry business, where he leads accounting, reporting, and auditing work. He has more than 15 years of experience spanning finance and analytics. Shah’s contributions include streamlining reporting frameworks, performing risk assessments, and enabling stakeholders to achieve strategic goals. He earned his master’s degree in business administration (finance) from the New York Institute of Technology and a bachelor’s degree in accounting and finance from Mumbai University. Connect with Shah on LinkedIn.
