When you integrate AI into a control that prevents or detects material misstatements in your financial statements, you're handling critical functionality under the Sarbanes-Oxley Act. This isn't about general AI governance. It's about ensuring a specific AI-enabled control performs consistently through your fiscal year.
This checklist focuses on controls where AI assistants gather information for human decision-makers or AI agents act autonomously. If the control fails and poses a reasonable risk of material error, you'll need this assessment.
Prerequisites
Before using this checklist, confirm:
- The AI is used in a key control that prevents or detects material misstatements in financial statements filed with the SEC.
- You've identified the specific risk the AI-enabled control addresses.
- You have access to AI change management documentation if your organization has formalized these processes.
- You understand whether the AI is an assistant or an agent and whether it can evolve or change itself.
Ensure you can draw a direct line from the AI's function to a specific financial statement assertion, like completeness or accuracy, and articulate what happens if it fails.
Checklist Items
1. Document the AI's Role in the Control
☐ Identify whether the AI gathers information for human review (assistant) or acts autonomously (agent).
☐ Map the AI's function to the specific risk of material misstatement it addresses.
☐ Document the financial statement line items and assertions affected.
Provide a clear narrative, such as: "This AI reviews vendor invoices against purchase orders and flags discrepancies above $10,000 for AP review, addressing the completeness assertion for accounts payable accruals."
2. Assess Control Design Adequacy
☐ Evaluate whether the AI's logic addresses the identified risk completely.
☐ Identify compensating controls if the AI has known limitations.
☐ Document the threshold at which AI outputs trigger human intervention.
Explain what the AI does, what it doesn't do, and why that design prevents or detects the material misstatement risk you're concerned about.
3. Establish AI Change Management Controls
☐ Identify who can modify the AI's parameters, training data, or decision logic.
☐ Document the approval process for AI changes.
☐ Confirm that changes are tested before deployment.
☐ Verify that change logs capture what changed and when.
Ensure a change control process similar to your IT general controls (ITGC) but tailored to AI's unique characteristics. Know when the AI was last modified and whether that change was authorized and tested.
4. Define Your Testing Approach
☐ Determine whether a "test of one" is appropriate (likely not for AI agents that can evolve).
☐ Design testing methodology specific to this AI-enabled control.
☐ Establish the sample size and frequency for testing.
☐ Document how you'll verify the AI performs consistently across different scenarios.
Create a testing plan that acknowledges AI doesn't behave like traditional automated controls. If the AI can change, your testing should include ongoing validation rather than a single point-in-time test.
5. Test AI Functionality
☐ Execute test transactions or scenarios through the AI.
☐ Compare AI outputs to expected results.
☐ Test edge cases and boundary conditions.
☐ Verify that the AI handles exceptions appropriately.
Gather evidence that the AI correctly identified issues it should catch and didn't flag false positives that would undermine its reliability. Test scenarios that stress the control's boundaries.
6. Evaluate Ongoing Performance
☐ Review AI operation logs for the period.
☐ Analyze exception rates and trends.
☐ Investigate any anomalies in AI behavior.
☐ Confirm the AI hasn't degraded or drifted from expected performance.
Provide quantitative evidence that the AI operates within expected parameters throughout the fiscal year, not just at the testing date. Demonstrate consistent performance.
7. Assess AI Operations and Security Controls
☐ Verify access controls limit who can interact with the AI.
☐ Confirm monitoring detects unauthorized changes.
☐ Review incident logs for AI-related issues.
☐ Validate backup and recovery procedures for AI systems.
Ensure controls similar to your ITGC program but adapted for AI infrastructure. Treat the AI as critical functionality that requires protection.
8. Document Reliance and Limitations
☐ State explicitly what you're relying on the AI to do.
☐ Identify what the AI cannot do and how that gap is covered.
☐ Document the period of reliance (through fiscal year-end).
☐ Note any conditions that would invalidate your reliance.
Provide clear documentation that auditors and management can review to understand the scope and boundaries of your reliance on this AI-enabled control.
Common Mistakes
Treating AI governance as Sarbanes-Oxley Act compliance. General AI policies don't tell you whether a specific AI-enabled control works. Focus on the controls over each AI used in ICFR, not enterprise-wide AI governance.
Assuming traditional automated control testing applies. The "test of one" concept assumes controls don't change. AI agents can evolve. Your testing methodology must account for that.
Testing the AI in isolation. Test the entire control process, including how humans interact with AI outputs and what happens when the AI flags an exception.
Ignoring change management. If the AI can learn or be modified, you need robust change controls. Otherwise, the control you tested in Q1 might not be the control operating in Q4.
Applying one-size-fits-all testing. Each AI-enabled control requires a tailored testing approach based on its specific function, risk, and potential to change.
Next Steps
After completing this checklist:
- Brief your external auditors on AI-enabled controls you're relying on and your testing approach.
- Monitor for guidance from the IIA or other standard-setters on AI in Sarbanes-Oxley Act compliance programs.
- Review quarterly whether the AI's performance remains consistent with your initial assessment.
- Update your testing methodology as you learn more about how the AI behaves over time.
If you identify deficiencies, document them immediately and implement remediation plans. An AI-enabled control that doesn't work reliably is worse than no automation at all because it creates false confidence in your ICFR.
