AI in Finance: A Control Framework for CFOs, Accountants and Auditors
Current position
India does not have one finance-specific AI statute that replaces existing duties. Companies must apply data-protection, cybersecurity, accounting, audit, employment, contract and sector rules to the use case. RBI’s FREE-AI report provides a financial-sector framework for responsible and ethical adoption, while the DPDP framework is commencing in phases. Sector-specific instructions and contractual confidentiality remain essential.
How it works
Use cases should be risk-tiered. Drafting a management summary is different from approving credit, posting journals, calculating tax or generating investor disclosures.
Inputs, prompts, model version, output, reviewer and final decision should be traceable for material use. A polished answer without source evidence is not audit evidence.
Public models can retain or process data outside expected boundaries. Review enterprise terms, access, residency, deletion, subcontractors and training use before uploading personal or commercially sensitive information.
| Issue | Current position | Why it matters |
|---|---|---|
| Accountability | Human owner remains responsible | AI output is not approval |
| Data rule | Use lawful, minimised and protected data | Do not upload confidential records casually |
| Model control | Test, monitor and document | Accuracy can drift by task and time |
Practical example
A controller asks an AI tool to classify 20,000 expenses. The model is 95% accurate overall but misclassifies most inter-company charges. Posting every output would create tax and consolidation errors. A controlled process uses a tested sample, rules for low-confidence items, reviewer sign-off and reconciliation to the ledger before posting.
Action checklist
- Create an approved-use-case and prohibited-data policy.
- Assign a business owner, model owner and independent reviewer.
- Test accuracy using representative and adversarial samples.
- Keep source citations and human sign-off for material outputs.
- Monitor access, drift, incidents and vendor changes.
Evidence and document checklist
- Use-case risk assessment and approval.
- Vendor contract, privacy and security review.
- Prompt/output log for material processes.
- Testing results and exception thresholds.
- Reviewer evidence and final reconciliation.
Common mistakes
- Treating fluent output as correct evidence.
- Uploading payroll, customer or board data to unapproved tools.
- Letting AI post or pay without maker–checker review.
- Using one accuracy percentage across different tasks.
Red flags
- Model output cannot identify its source.
- Vendor terms allow unexpected training use.
- Manual overrides rise without analysis.
- AI recommendations systematically disadvantage a group.
Escalation and complaint route
Finance incidents should follow the organisation’s data, cyber, audit and whistleblower channels. Regulated entities must assess RBI, SEBI, IRDAI or other reporting duties. Personal-data breaches and material misstatements require prompt legal and professional review.