SOX 404

The AI+SOX Playbook

Agents now draft entries, build revenue schedules and clear reconciliations, which is the exact work SOX tests. Here is the control model that holds up under audit: who owns each control, the controls over the AI itself, sample RCMs for four processes, and the questions your auditor will ask.

Controls over the AI itself, each with a test procedure

COSO

Mapped to COSO's internal control guidance for generative AI

Questions your auditor will ask, each mapped to a control

The controls
The controls that keep AI in the preparer seat

Each set covers what could go wrong, who prepares and reviews, the assertions it addresses, and how to test it.

AIG-01 – AIG-09

Controls over the AI itself

Can an agent approve its own work, change accounting logic without sign-off, or leave gaps in the logs?

OTC-01 – OTC-06

Order-to-Cash & ASC 606

When the agent reads the contract and builds the schedule, who catches a misread termination clause?

P2P-01 – P2P-06

Procure-to-Pay

A convincing email asks to change vendor bank details: what stops the agent from applying it?

TRS-01 – TRS-03

Treasury

Can any agent or integration user release a payment on its own, or miss an account opened for payroll?

RPT-01 – RPT-03

Reporting & Insights

Did the controller verify the flux explanation against transactions, or just accept it as written?

PCAOB AS 2201

The 10 Auditor Questions

Who prepared this, is the population complete, and is the review more than a click-through?

What’s Inside
Every control, worked four ways

This isn't a summary of COSO. Every control is written the same way, so you can lift it straight into your RCM and test it on Monday.

What Could Go Wrong

The risk of material misstatement the control addresses, in one line.

Preparer & Reviewer

Who prepares, who reviews and who owns it, with frequency and control type.

Assertions Covered

Completeness, existence, accuracy, valuation, obligations and presentation, marked per control.

Test Procedure

The steps to test operating effectiveness, and the evidence your auditor will inspect.

Where to Focus
Not every control carries the same weight

Nine controls are the ones auditors examine first. A failed AI governance control is pervasive, because every module relies on it, and AIG-06, AIG-07 and AIG-08 matter most to external auditors.

AIG-01

An agent can complete a transaction end to end.

Quarterly

AIG-03

An incorrect agent output reaches the GL.

Per transaction

AIG-06

Errors below the review threshold go undetected.

Monthly

AIG-07

Exceptions are incomplete because the agent decides what to flag.

Monthly

AIG-08

Logs and evidence are altered or incomplete.

Quarterly

OTC-01

Contract terms, performance obligations or SSP allocation are captured incorrectly.

Per contract

P2P-01

Unauthorized changes to vendor bank details.

Per change

TRS-03

Unauthorized payments or transfers.

Per batch

RPT-01

Unusual movements go unexplained.

Monthly

Sources & Precision
Built on the standards auditors already apply

There is no AI-specific audit standard yet. PCAOB standards are technology-neutral, so AI-prepared work is judged under the same requirements as any other.

COSO GenAI Guidance

Achieving Effective Internal Control Over Generative AI

PCAOB AS 2201 & AS 2501

Auditing ICFR, and auditing accounting estimates

ASC 606, 326 & 350-40

Revenue, credit losses and capitalized software: where the agent prepares and a person decides

The Playbook
Take the full guide with you

The complete playbook: every control, its test procedure, the deficiencies auditors find most often, and a practical step for each part.

The AI+SOX Playbook

The controlsThe controls that keep AI in the preparer seat

What’s InsideEvery control, worked four ways

Where to FocusNot every control carries the same weight

Sources & PrecisionBuilt on the standards auditors already apply

The PlaybookTake the full guide with you

The controls
The controls that keep AI in the preparer seat

What’s Inside
Every control, worked four ways

Where to Focus
Not every control carries the same weight

Sources & Precision
Built on the standards auditors already apply

The Playbook
Take the full guide with you