Can You Let AI Into the Close Without Blowing Up Your SOX Audit?

Across the 80,000+ accounting and finance postings we track at Audit Friendly as of July 2026, AI skills have started showing up in the requirements lines of controller and senior accountant jobs - often two bullets down from "maintain SOX compliance." I wrote up what those postings actually ask for, and the pairing tells you where the profession has quietly landed: employers now expect you to use AI inside controlled processes, and they expect the controls to survive the encounter.

So, can you let AI into a SOX-controlled close? Yes, and plenty of teams already have, because what your auditor ultimately certifies is that competent humans reviewed and approved the work against evidence they can trace - and that requirement survives AI just fine. What doesn't survive is sloppiness about where the model's work ends and your control begins. Drawing that line properly is the whole game, so let's draw it.

Does using AI in the close violate SOX?

No. SOX requires management to maintain and assess internal controls over financial reporting - documented, operating, evidenced - and it is completely indifferent to which tools sit underneath those controls. Nothing in Section 404 says a human has to do the first pass of a reconciliation, the same way nothing in it ever said you couldn't use Excel, which is lucky, because the profession ran on undocumented spreadsheet logic for twenty years and mostly got away with it. An AI-drafted flux commentary that a controller reads, corrects, and signs is a controlled process. The same commentary pasted into the reporting package unread is a control failure - and it would be a control failure if an intern wrote it too. AI changes the speed at which the mistake arrives; the framework already covers the mistake.

What does the PCAOB actually say about AI?

The audit regulator has already shown you the exam. The PCAOB's staff Spotlight on generative AI in audits and financial reporting, built on outreach to audit firms and preparers, is refreshingly grounded: adoption is early but moving fast, firms are building AI tools for drafting memos, researching guidance, and risk assessment, and every firm they talked to emphasized the same two requirements - human review of AI output is essential, and the auditability of both the source data and the AI-generated content is what makes any of it defensible. The staff's own summary reads like a checklist of what your auditors will ask you: show me the inputs, show me who reviewed the output, show me the policy that governs the tool.

That's a gift. You know the questions in advance, which means you can build the answers into the process from day one instead of reverse-engineering them in March while fieldwork breathes down your neck.

Where does AI fit without touching the control?

The pattern that works: AI runs the preparation layer, humans hold the control point. Concretely, that looks like models doing transaction matching and flagging exceptions - the tedious shit nobody's career was ever built on - drafting the first pass of flux explanations for a reviewer who actually knows the business, assembling PBC support and tie-outs, which is where I'd start because audit prep is where AI pays off first, and keeping reconciliations continuously updated the way I laid out in the rolling reconciliations piece. In every one of those, the model produces work product and the human produces the control: a review, performed with skepticism, by someone with the standing to reject the output, leaving evidence that the review happened.

Tooling matters more than people admit here. A platform that logs every automated action natively turns your reviewer's job into scrolling an audit trail; a black box turns it into forensic reconstruction. That's the lens I'd shop with, and it's increasingly how we look at tools in the software directory - can the thing show its work, because your auditor is going to ask it to.

Where does it get you in trouble?

Four places, all avoidable, all the kind of thing that turns a clean 404 opinion into a pissed-off audit committee. First, treating model output as audit evidence - a model's summary of an invoice is not the invoice, and the moment an AI-generated number supports a balance without a trace back to source documents, you have a documentation problem that no amount of model accuracy fixes. Second, black-box vendors: if the tool can't produce logs of what data it saw and what it did, you've bought a control deficiency with a subscription attached. Third, review decay - the quiet slide where month one's careful review becomes month six's rubber stamp, and auditors know damn well what rubber-stamping looks like; a reviewer who has changed nothing in six months is a reviewer who has stopped reviewing, and your sign-off log will say so. Fourth, ITGCs: plug a new system into the close and you've created new IT general controls - access, change management, data integrity - whether or not you bothered to document them. The pilot finance ran without telling IT is a finding waiting for a fieldwork date.

Hold both truths at once: the risk is real, and the machinery for managing it is the boring machinery the profession already owns. You apply the same control design to the new tool that you'd apply to anything else that touches the ledger, and most of the scary evaporates.

What I'd do

Pick one control-adjacent process this quarter - a single recon class, flux commentary, PBC assembly - and pilot with the sign-off untouched. Update the control narrative to name the AI step explicitly, because a control description that hides the model is a misstatement about your own process, and that's a worse look than using AI ever was. Bring your external auditor in at planning, while it's still a design conversation instead of a finding. Keep the review substantive - reject output occasionally, in writing, so the evidence shows a functioning reviewer rather than a formality. Log everything the tool touches. And if you're on the job market side of this: the postings say AI-inside-controls is becoming a real, paid skill, and there are thousands of controller and senior accountant seats live on the job board where a one-quarter pilot story would separate you from every candidate still debating whether AI is coming.

Frequently asked questions

Is AI allowed under SOX?

Yes. SOX governs controls over financial reporting, and no tool is banned by the statute. What matters is that any process involving AI stays documented, human-reviewed, and evidenced, exactly like every other process in your control environment.

Will auditors accept AI-generated reconciliations?

They'll accept reconciliations prepared with AI assistance and reviewed by a competent human who left evidence of the review. They won't accept model output as a substitute for source documents - per the PCAOB's outreach, auditability of inputs and outputs is exactly what audit firms are being told to examine.

Do I need to tell my external auditor I'm using AI in the close?

Tell them at planning. New systems in the close change their risk assessment and ITGC scope, and finding out mid-fieldwork turns a design conversation into a suspicion. Auditors handle disclosed changes well, and discovered ones badly.

What should I document when AI is part of a control?

The control narrative naming the AI step, the data the tool accesses, the review procedure and who performs it, access and change management for the tool itself, and a log tying each AI-assisted output to its human sign-off. If that list feels heavy, notice it's the same list you'd need for any new close system.

Does AI create new SOX controls?

It mostly extends existing ones and adds IT general controls around the new system - access, change management, data flows. Budget for that in the pilot rather than discovering it at year-end.

The teams getting this right started small, wrote things down, and kept their reviewers awake, and every bit of that is available to any finance team this quarter. Pick the recon, run the pilot, keep the sign-off human. Your auditor might even thank you, which would be a first for everybody.