For the last year or two, every CFO conversation eventually drifts into AI. Sometimes it’s framed as excitement, sometimes as anxiety, and sometimes as an awkward silence followed by, “Well, we’re looking at it.” What’s striking is that most of the tension around AI in finance has very little to do with the technology itself. The models work. The tools are improving fast. The vendors all have slick demos.
The real issue is governance.
Finance teams are wired around controls, auditability, and repeatability. AI systems, by contrast, are probabilistic, opaque, and constantly evolving. That mismatch is where most CFO discomfort comes from — and it’s why “let’s just automate this” often stalls once it hits a real finance process.
The first mistake I see is treating AI like just another system implementation. ERP projects taught us how painful that mindset can be. AI requires a different framing: not “what can this tool do?” but “what decisions are we willing to delegate, and under what constraints?” That sounds abstract. It isn’t.
Over the past year I’ve pushed AI tools on real finance questions: revenue recognition edge cases, SEC disclosure interpretations, covenant calculations, and technical accounting memos. The patterns that show up are not technology failures. They are governance failures waiting to happen.
1. AI doesn’t fight back.
If you have ever debated an accounting position with a strong controller or technical accounting lead, you know what conviction feels like. You push. They push back. You test assumptions. They defend them with chapter and verse. That friction is healthy. Same thing for a forecast analysis. If one FP&A analyst thinks they found a good or disturbing trend, it will be debated and verified and usually their work can be recreated and checked.
AI does not behave that way.
If you tell it, “I think you’re wrong,” it often apologizes and produces a different answer. Sometimes an entirely opposite answer. The confidence level remains high. The tone remains polished. The data is processed inside the model, and the AI often struggles to explain — or even remain consistent in — its answers.
In a live finance organization, that would be a red flag. If a manager flipped their view that quickly under mild pressure, you would question the depth of analysis. With AI, the flip can look like responsiveness rather than fragility.
That is a governance issue. It means you cannot treat an AI output as a position that has survived adversarial testing. It hasn’t. It has survived prompt engineering. And the prompt may have been poor.
2. The praise problem.
Most AI agents are relentlessly deferential. “Great question.” “Excellent point.” “You’re absolutely right to focus on that.” In a consumer context, that feels pleasant. In a finance context, it is dangerous.
Finance works because of tension — between risk and growth, between conservatism and disclosure clarity, between what management wants and what GAAP allows. When the “advisor” in the room is constantly affirming the user, it subtly reinforces bias.
I’ve seen this firsthand when asking an AI to pressure-test a disclosure approach. Rather than aggressively identifying weaknesses, it often validates the framing of the question. The tone can make a marginal position sound well-supported. In other words, the user’s confidence can rise faster than the quality of the analysis.
Governance must assume that AI will not naturally challenge you the way a seasoned audit partner or skeptical board member will.
3. The citation illusion.
This one should make every CFO uncomfortable.
Ask an AI to provide citations to accounting guidance or SEC commentary, and it will often comply — confidently. Paragraph numbers. Codification references. Even plausible-sounding excerpts.
The problem is that some of them are fabricated. They look right. They read right. They are formatted correctly. But they do not exist.
In finance, citations are not decorative. They are the backbone of defensibility. When you write a technical memo on revenue recognition or stock-based compensation, the citation is the bridge between your judgment and the authoritative literature.
If an AI invents that bridge, and a team relies on it without independent verification, the failure is not the model’s. It is the control environment’s. Any AI-assisted accounting memo must include a verification step where a human independently confirms the authoritative source. Not “glances at it.” Confirms it.
4. Rule changes and historical drift.
Accounting rules change. Constantly.
Revenue recognition under ASC 606 replaced a patchwork of legacy guidance. Lease accounting under ASC 842 upended decades of practice. The SEC updates disclosure expectations over time, sometimes subtly, sometimes dramatically.
Meanwhile, the SEC’s EDGAR archive goes back decades. There are scanned paper filings from eras when the rules were materially different. There are thousands of examples built under superseded guidance.
AI models trained on broad corpuses struggle here. They can blend old and new regimes. They can cite legacy practice as if it were current. They can rely heavily on the abundance of historical examples rather than the correctness of modern policy.
I have seen AI answers that lean on pre-606 revenue language as though nothing changed. Or that reference lease accounting concepts that no longer apply post-842. To a non-expert, the answer looks sophisticated. To someone who lived through the transition, the seams are obvious.
Governance means you assume the model does not instinctively know the effective date of your accounting framework. You have to constrain it.
5. Finance is not plain English.
Financial reporting language is precise. “Probable” does not mean “likely” in a colloquial sense. “Material” is not a synonym for “important.” “Reasonably possible” has a defined meaning.
AI systems are trained on massive volumes of plain English. That is a strength in many domains. In accounting, it can be a weakness.
I’ve seen answers where the model drifts into narrative explanations that sound sensible but subtly misapply defined terms. In a board deck, that might pass. In a 10-K, that is a problem.
When language itself carries regulatory weight, small deviations matter.
So what does governance look like in practice?
It is not banning AI. That is neither realistic nor wise. The productivity gains are real. Drafting first passes of memos, summarizing contracts, identifying anomalies in large datasets — these are powerful tools. AI can be properly trained on your data and become more accurate. Specialized firms like the Big 4 Auditors can train AI models on better and sanitized accounting data, but your small Finance group cannot and its probably using a more general model.
But they must sit inside a control framework.
At a minimum:
- AI outputs that influence external reporting require documented human review.
- AI conclusions about trends must be independently tested and verified. Don’t order another $1M of a part because a model suggested it.
- Authoritative citations must be independently verified.
- Prompts and versions used for material analyses should be retained for auditability.
- Use cases must be categorized: drafting support is different from judgment replacement.
- Responsibility for the final position must be clearly assigned to a human owner.
Most importantly, the CFO has to set the tone.
Let me make a direct observation: most leadership team members are not finance experts, but AI can create the illusion that they are. You need to make sure they understand the risk.
If AI is positioned as an infallible oracle, teams will over-rely on it. If it is positioned as a junior analyst — fast, helpful, occasionally wrong, and requiring supervision — behavior adjusts appropriately.
The question is not whether AI will be used in finance. It already is.
The question is whether it will be used inside a governance framework that protects credibility.
Investors do not care how you produced your numbers. Auditors do not care how you drafted your memo. Regulators certainly do not care that a model was “usually right.” They care that your disclosures are accurate, supportable, and controlled.
AI in finance is not a technology problem. It is a governance problem. And like most governance problems, it lands squarely on the CFO’s desk.
I don’t want to sound like Cassandra warning of inevitable doom. Nor do I want to be the boy who cried wolf while your competitor quietly figures this out and gains an advantage.
In future posts, I will outline where I believe AI can genuinely add value inside a disciplined finance organization.
Responding to a comment letter from the SEC
By Michael
On February 16, 2016
In Accounting and Reporting, CFO
Comment letters are a lot more common. You can expect that your filings will be reviewed every 2-3 years and every special filing you make (like an S-1) will draw a comment letter every time. They are common, and the typical result is improved disclosure the next time you do a filing. A bad outcome is the need to restate which can have significant personal and valuation of the company repercussions. A disaster is a Wells Notice and a full legal investigation.
When I first started, responding to a comment letter was much more difficult and you needed to rely much more heavily on your auditors and your lawyers as they had many examples of responses from their client base and you typically had nothing except for anything you had done yourself or within your company in the past. Ever since the SEC made comment letter responses available online, you should be much more capable of answering them yourself or with a lot less help from your outside advisors.
Here is my general advice on what to do when you receive a comment letter.
As a general comment, you are dealing with very experienced accounting and legal professionals at the SEC. The team that reviews filings and comments on them tend to be very experienced accountants and lawyers who read and comment on filings for a living. Their letter is reviewed by even more experienced staff before it is sent to you. The SEC monitors trends and usually every year there are specific areas of accounting and disclosure that get extra questions for just about every filer that it applies to. Unless you do actually have a very severe issue, there pretty much is no intent to “get you”. I have found 100% of the SEC staff I have worked with over the years to be professional and courteous and generally helpful where they can be helpful. They tend to be pretty flexible where they can be.
Expect an iterative process. There was one pretty long letter that I responded to that the SEC accepted all my answers the first time, but usually is takes 2-3 rounds of replies with more questions.
The first thing you need to do is read it through at least once. You don’t need to fully understand or do any deep research at this point, but make sure that you and your Controller have read the comment letter and have a general idea of what is in it and what the main questions seem to be. You will be very quickly involving others in the process, and they will be relying on you, so make sure that you know how serious the letter appears to be. It usually is pretty easy to identify the most important questions, as the examiner normally makes them pretty clear. There might be a question or two that are trickier and if answered the wrong way will cause a spiral into more questions and a much higher chance of restating.
Now inform your boss and the audit committee. This should be done quickly, your process of reading and getting a general understanding should not take long at all and you need to treat every comment letter with a sense of urgency. It is a good idea to inform your lawyers and auditors immediately and I advise that you copy legal counsel on your communications where appropriate as it is possible that the comment letter will result in legal action against your firm or you personally. The SEC does not allow you to use them as a direct legal defense and your work on replying to a comment letter can be discoverable if not protected. If you are not sure what that means and how to protect yourself and your company, seek legal advice.
I always have a very strong sense of ownership of what we file. I have always found that my reporting is better after I get and respond to an SEC comment letter. You will be engaging and using outside help, but you own the comment letter responses just like you own the filings you did. Do not allow the outside advisors to take over the process. They are not always on your side. If something needs to be restated, or if more serious issues come up, they may also have the agenda of protecting themselves. Remember that auditors commonly get sued as well if accounting issues come up from an SEC review. That means that they are very much on your side until they are not. Chances are pretty good that it will not be an issue but do remember that they have their own priorities and that may mean protecting their business just like you are trying to protect yourself and your company.
Now that your boss and the Audit Committee are informed, you should have also formed a small team to actually answer the comment letter. You need to divide up the comments and delegate them to the people best able to answer the questions (and this may be you). Personally, I think the company should write the first draft of all the responses but you may not have the expertise. If you do not, remember it because you have a skill set hole in your company that may need to be fixed later after the comment letter process is done.
Now that the SEC has made other comment letter responses public, you should be able to find the same questions answered by other companies. There is no rule against using other responses word for word. No such thing as plagiarism or copyright when reviewing SEC submissions. If you check competitors or similar companies and they have identical questions, then you know that those questions are focus areas for the SEC this cycle. Look at the answer(s) that the SEC accepted in the past and consider if the same answers or something very close also applies to you.
I cannot emphasize this enough. Prior SEC filings are a huge resource and you should absolutely use them to guide your answers. There are no prizes for brilliance and answering every question yourself with completely original answers.
Dire warnings aside about making sure you understand the risk that outside advisors may have their own agenda, your auditors are a very good resource. If you are using a Big 4 firm, then their SEC advisory group will have people that recently worked at the SEC. They probably have other clients who have received comment letters from your examiner and have more personal read on his or her style. When it comes to very technical accounting questions, your technical partner can be a big help in drafting a response that cites the correct and most compelling parts of GAAP.
I personally like my responses to be direct and to the point. Sometimes your advisors like to toss in introductory phrases like “we respectfully submit”. I never answer like that. Many times the comment letter asks you to enhance your disclosure in the future. Unless the suggestion has some fundamental error in it (which I have never found in any comment letter I have received), the correct response is to say that in future filings you will do what is requested. List out what was requested and what you agreed to. When the SEC asks for support for your current accounting, provide it in a straightforward manner. Your examiner will have several open files and comment letters they are responsible for. The more clearly you write and the more simply you write, the easier you will make it for them.
One final resource is the examiner themselves. Sometimes their questions are not very clear. You are allowed to call them up and talk to them. Like your written answers, you need to be careful what you discuss with them, but as I said earlier, they are not out to “get you”. They are limited in what they can answer. You cannot run a response by them, all responses must be submitted in writing and they can only respond in writing. However, they can clarify what a question means. You can call them and let them know that you are on a tight deadline for a filing and that you would appreciate them working as fast as possible. Sometimes it can help to have a personal relationship when they have to make a final call on an accounting item. If you are more than just text on paper, maybe something will go your way. I know that it even helps me to respond when I have a voice to go with the words on the paper.
Before you send in your response, give it one last read through. Make sure all responses follow the standard format of repeating their question and then responding. Make sure you are sure the questions are actually responded to. Double check the wording to make sure it is direct and clear. Make sure each one has enough detail but not too much that it clouds your answer. If you see an answer that disagrees with a disclosure request, ask yourself why you are not just agreeing to the additional disclosure. Sometimes if you agree then you are actually agreeing to accounting that you do not think is right, but normally fighting over disclosure requirements is just not worth it.
There is an almost certain chance that you will receive another comment letter on your responses that focus on the questions that either were not fully answered or where the examiner disagrees with you or feels that there is insufficient support for your answer. If they disagree, then you are starting to have a problem. You need to be extremely careful with any question in the second set of comments because those are the ones that the examiner is most interested in.
Hopefully you will make it through the response process with nothing more than agreeing to improve disclosures in future filings. Don’t forget to actually improve disclosures when you agree to it. It should be part of your reporting checklist to ensure that you disclose what you agreed to and how you agreed to.
Share this: