Your ERP has AI agents now. Can you explain to your auditor what they did?
NetSuite, QuickBooks, Sage and Xero are adding AI agents that read your books, propose entries and act on your data. We map every AI touchpoint in your finance function, put the right controls around it and give you a package your auditor can test.
The rules did not change for AI. The questions did.
AI controls are still controls
If an AI agent performs a control that prevents or detects a misstatement, it needs the same design documentation, testing and sign-off as any other control.
AI can be confidently wrong
An agent can produce a plausible but wrong output without raising an alert. Auditors expect compensating controls that catch it.
Every action needs a trail
Auditors now ask what triggered an agent, what data it read, what it did and who approved it. Most ERP setups do not record all four.
An audit-ready package for every AI agent in your finance stack
Built around the ERP you already use, sized for a growing company, not a Fortune 500.
AI inventory
Every place AI touches your numbers: ERP agents, connected apps, bank feeds, and the ChatGPT, Claude or Copilot use on your team. Classified by risk.
AI risk and control matrix
For each AI use: the risk, the control, the owner, the evidence and the financial-statement assertion it supports. Ready to drop into your existing matrix.
Agent permissions review
Roles and permissions for every AI agent and integration in NetSuite, QuickBooks, Sage or Xero. Read-only by default, posting only with human approval.
Silent-failure controls
Output sampling, known-answer tests, exception routing and change control for model and agent updates.
Vendor review
What your AI vendors' SOC reports cover and what they miss, plus the user controls you need on your side.
Auditor and board pack
A walkthrough-ready binder for your external auditor and a two-page summary for owners, the board or the audit committee.
Four steps, three to four weeks
- 01
Inventory
Short interviews with finance and IT, plus a read-only look at your ERP roles, integrations and AI settings.
- 02
Assess
We score each AI use on impact and control risk and test how it behaves on a sample of real transactions.
- 03
Design
We write the controls, fix permissions with your admin and set up the evidence each control produces.
- 04
Hand over
You get the matrix, the binder and a session with your team. Optional quarterly monitoring keeps it current.
Finance teams turning AI on
- Controllers and CFOs enabling NetSuite, QuickBooks, Sage or Xero AI features
- Companies with an annual audit, lender reporting or private equity owners
- Teams preparing for a SOX program, an IPO or a sale
- Businesses whose staff already use ChatGPT, Claude or Copilot with financial data
What we do and don't do
- We review, design and document controls, and we test them on a sample.
- We work alongside your external auditor. Your independent auditor issues the opinion.
- We do not sell or resell AI software, so our review is independent of any vendor.
- Read-only access, signed confidentiality agreement before we see any data.
Fixed fees, agreed before we start
AI Controls Snapshot
One ERP, up to 5 AI uses. Inventory, risk ranking and a prioritized fix list.
Full Review
Complete matrix, permissions fixes, silent-failure controls and the auditor and board pack.
Quarterly Monitoring
New agents and updates reviewed, controls re-tested and evidence refreshed every quarter.
Projects are 50% at signing and 50% on delivery. Multi-entity groups and SOX programs are quoted after a 20-minute call.
Common questions
We only use the AI built into our ERP. Do we still need this?
Yes. Built-in agents still act on your data under roles you configure. Who can run them, what they can change and how you would notice an error are your controls, not the vendor's.
Will this slow down our use of AI?
No. The goal is to let you turn AI on with confidence. Most controls are lightweight: a permission, a log, a sample review.
Do you replace our auditor or our SOX provider?
No. We prepare the controls and the evidence. Your auditor tests them and issues the opinion. If you already have a SOX provider, we focus on the AI-specific gap.
Which systems do you cover?
NetSuite, QuickBooks Online, Sage Intacct and Xero, plus connected AP, expense and bank-feed tools. We can review SAP and Dynamics from documentation and exports.
Turn on AI without creating an audit finding
Tell us which AI features you use or plan to use. In 20 minutes we'll tell you where the control gaps usually are and whether a Snapshot or a Full Review fits.