Does putting AI in accounts payable weaken our internal controls?

The question splits in two. During a proof of concept the AI drafts coding for invoices your team posted weeks ago, working from copies, and the drafts land on a scoring sheet. Nobody is paid from it, nothing is entered from it and no approval waits on it. A control operates on real transactions, and a test has none.

A live run is different, because drafts now meet invoices that will be paid, and the design has to say where the AI sits. GAO's 2025 revision of the Green Book, its Standards for Internal Control in the Federal Government, takes effect for fiscal year 2026 and now names emerging technologies such as artificial intelligence among the internal risk factors management weighs. It is written for federal agencies, but the point carries: a new tool on the payables desk is a risk to assess and place, not a reason to rebuild the controls.

This note is not audit, accounting or legal advice. How your controls are designed, and whether they work, is for management and your auditors to decide.

A payables desk usually keeps four duties apart: setting up vendors, entering and coding invoices, approving them, and releasing payments. The 2025 Green Book frames this as separating authority, custody and accounting, and adds that segregation reduces the risk of management override but can't rule out two people colluding. Drafted coding belongs to one duty only, entry and coding. It never approves an invoice, edits a vendor or releases a payment.

The AI does add one duty that didn't exist before: configuring it. Someone writes its instructions, sets the point at which it hands an invoice to a person, and chooses the reference lists it reads. COSO's February 2026 publication on internal control over generative AI meets that duty head on: separate the ability to configure AI settings from the authority to approve or review its outputs. The Green Book says the same of technology generally: no one person should control every critical stage of a process, from designing a system to processing transactions through it.

So the AP clerk who corrects drafts all day can propose better instructions, but shouldn't both change them and approve the invoices they shape. NIST's control catalog, SP 800-53, asks under AC-5 for duties that need separating to be identified and documented, with system access set up to support the split. Put the configuring duty on your role list with a name beside it.

The approver stays a person, and the same person you would choose today. The PCAOB's standard for audits of internal control, AS 2201, has auditors check that a control is performed by someone with the necessary authority and competence, both in its design and in its operation. A draft changes nothing about who has authority over an invoice, and it shouldn't move an approval limit.

What can shift without anyone deciding it should is what an approval means. COSO's publication draws the line. Management relies on AI when it depends on the AI's output as evidence for a control; its example is a reviewer who approves a posting using only what the AI produced. It is not reliance when the control owner re-performs the match on all items, or a sample, and documents that review. The publication also asks for AI outputs to be treated as assertions that need evidence, not as facts. An approver who opens the invoice image beside the draft is testing an assertion; one who clicks through a queue is relying on it.

Timing matters too. The 2025 Green Book separates preventive control activities, which stop an unintended result before it happens, from detective ones, which find and correct it afterward, and tells management to consider preventive ones first. A draft that waits for approval before it posts keeps the approval preventive; one checked only at month-end becomes a detective control, possibly after the payment has gone.

An approval that leaves no trace can't be tested. AS 2201 ranks audit evidence from least persuasive to most: inquiry, observation, inspection of documents and re-performance of the control, and says inquiry alone is never enough. "Our clerk checks every draft" is inquiry. A record on each invoice can be inspected, and the source document beside it lets the check be re-performed. Each approved draft's record should show:

• The draft as proposed, before anyone corrected it, and the source document it was drafted from.
• What the approver changed, field by field, with a note where the reason isn't obvious.
• Who approved it and when, under their own login. NIST's control AU-10, non-repudiation, names the goal: evidence that a particular person performed an action, with approving a procurement request among its examples.
• Which version of the AI produced it: the instructions, settings and model in use that day. Where management relies on AI output, COSO's publication lists the documented prompt, configuration and model version first among the evidence it expects, then a clear reason for any sampling and how exceptions were resolved.

Most AP controls assume software behaves tomorrow as it did today. An AI can change when its instructions are edited, a threshold moves, a reference list is reloaded or its provider switches models. COSO's publication treats prompts, system prompts, retrieval connectors and transformation rules as governed configurations with version history and approval workflows, and asks for documented approvals and evidence behind changes to prompts, thresholds and the material the AI retrieves.

That is ordinary change management applied to a new kind of setting. The 2025 Green Book expects changes to information technology to be authorized, documented, tested and independently reviewed. NIST's CM-3 adds two habits worth copying: decide in advance which kinds of change go through the process, and record every decision, refusals included. For document work the list is short: the instructions, the hand-off thresholds, the lists it reads, and the model with its version.

Auditors have a reason of their own to care. Under AS 2201's benchmarking strategy, an auditor can treat an entirely automated control as still effective in later years without repeating every test, but only if general controls over program changes, access and operations work and the control hasn't changed since it was last tested. A model swapped in without notice is a change, so ask any vendor, us included, how you will hear about one first.

The proof of concept set earns a second life here: the 20 to 30 invoices your reviewer scored become a fixed test. After any change, run them again and compare the drafts before the change reaches live invoices.

Which rules apply depends on who you are. AS 2201 is a PCAOB standard, so it governs audits of internal control at public companies only. A private company's auditor usually works under the AICPA's standards, where SAS No. 145, effective for periods ending on or after December 15, 2023, carries extensive guidance on a company's use of IT and its IT general controls; ask yours which apply. Either way, expect questions to start from one invoice: in an AS 2201 walkthrough, the auditor follows a transaction from origination to the records using the same documents and technology your people use. Have answers ready for these:

• Which control does the AI touch? Name the step it prepares and the control that follows it.
• Show us one invoice end to end: the image, the draft, the correction, the approval and the posting.
• Who can change the instructions, thresholds or model, and how is a change approved and tested?
• Does anyone rely on the AI's output as evidence for a control, or is the check re-performed on every draft or a documented sample?
• What does the provider control, and what do you? The Green Book holds that management keeps responsibility for controls over work it hands to a service organization.

Our free AI proof of concept runs on copies of 20 to 30 invoices your team already posted, sent after an NDA is signed. Nothing logs in to your accounting system or your bank, and nothing it drafts is entered, approved or paid. Your reviewer, the person who knows your AP coding best, scores the drafts against what the team did, under success criteria written down first.

After a yes, the job runs on new invoices for about 30 days, and a person approves each draft before it posts. The approver, the limits and whoever releases payments stay as they are. How drafts reach your system is agreed before you sign, so bring the evidence list above, and your auditors' questions, to that conversation.