Only 7% of Finance Leaders Put AI Agent Governance First. Now the AICPA Is Testing the Agents.

For two years, AI in finance mostly meant a copilot: a tool that drafted, summarized and suggested while an accountant did the work. That arrangement has a release date for ending. In the space of two weeks, Workday and SAP each announced agents that act on their own inside the ledger, and both put early adopter programs in early 2027. The accounting profession moved in the same window. On October 13 the AICPA issued its first practice aid on how client AI affects a financial statement audit, and on October 19 it announced a program to certify AI agents by attacking them. Finance teams now have roughly one budget cycle to decide what an agent is allowed to touch, and how they will prove what it did.

The Vendors Have Picked a Date

At its Rising conference, Workday launched what it calls autopilot agents for HR, finance and IT. Its Accounting Agent is designed to pull key terms from a newly signed customer contract, prepare the accounting entries, recommend revenue recognition and billing schedules, and test transactions in the background so issues are flagged before auditors arrive. Workday says the agents inherit each customer's policies, permissions and approval rules, that customers choose which tasks run automatically and which need review, and that every action is logged with the data it used and who approved it. Gerrit Kazmaier, Workday's president of product and technology, framed the design choice directly: "Probabilistic AI is great at guessing, but in payroll and finance, a good guess isn't good enough."

SAP is moving on the same timeline from a different direction. CFO Dive reported on October 6 that SAP launched SAP Pay inside SAP Cloud ERP, generally available in the U.S. and U.K., which executes a payment when an invoice falls due and reconciles it in the same workflow, across ACH, wires, checks and stablecoin settlement for cross-border transactions. A spokesperson described the goal as "bringing payment execution, reconciliation, controls and auditability into the same workflow." SAP also said it plans further agents for financial close, planning, treasury, billing, tax and receivables, with early adopter programs planned for the first quarter of 2027.

Put together, two of the largest enterprise application vendors are converging on the same claim: that the controls live inside the workflow, so the agent cannot step outside them. That may prove true. It is also, for now, a vendor claim. Neither announcement includes independent evidence of how the agents behave when the inputs are wrong, and that is the question auditors are starting to ask.

Governance Is Running a Lap Behind

The pressure on finance leaders points the other way. Avalara's Agents of Change survey, conducted by Censuswide in June among 1,505 CFOs and senior finance leaders in the U.S., U.K., Australia and India who had deployed, piloted or evaluated AI agents, found that 92% feel moderate or significant career pressure to show a return on agent investments. Half say their agent initiatives have delivered only limited measurable ROI so far. Asked what drives the push, 71% said it is mostly or entirely about deployment speed, and just 7% said their organization prioritizes governance over speed.

The control environment has not caught up. In the same survey, 30% had not updated internal controls in the past year to account for agents that take or recommend actions. Some 44% were only somewhat confident they could explain an agent's actions to an auditor or regulator, and 23% said accountability for a significant agent error would be unclear or would rest with no one. Three in four, 76%, lack dedicated in-house expertise on how their agents work and rely on IT, the vendor, or nobody. The capabilities respondents valued most were audit-ready documentation for every AI-driven action and real-time monitoring of regulatory changes, each cited by 30%.

Auditors are now formalizing what they expect to see. The AICPA's new practice aid, Artificial Intelligence (AI) Considerations for Financial Statement Auditors, covers how a company's use of AI in financial reporting affects the audit, and how audit firms use AI themselves. It is nonauthoritative, and further guidance on assessing the risk of material misstatement and evaluating audit evidence when a company uses AI is still to come. But its direction is clear, and AICPA chief auditor Jennifer Burns restated the principle that will shape every engagement: "Ultimately, the auditor remains responsible for the audit and the audit opinion." Management carries the same weight for its own controls, whether or not an agent posted the entry.

What an Agent Audit Actually Tests

The most concrete signal is the certification itself. The AICPA and the Artificial Intelligence Underwriting Company are combining a SOC 2 report, which examines whether an organization's controls are designed appropriately and operating effectively, with AIUC-1 certification, which tests how the agent itself behaves. The testing targets prompt injection hidden in emails or documents, data leakage, and agents acting beyond their authority. A finance agent, for example, could be tested against manipulated invoices or payment instructions, and checked for whether it invents financial figures or company policies. Weaknesses can be fixed and retested, with both rounds shown in the report. AIUC-1 requires quarterly technical retesting because models, tools and prompts change, and both the SOC 2 report and the certification renew annually.

Pilots are underway and the launch is targeted for the first quarter of 2027, the same quarter the Workday and SAP agents reach early adopters. AICPA vice president Amy Pawlicki summed up the shift in emphasis, saying the focus of AI assurance so far has been governance and compliance, but "what is critical is to demonstrate that those policies are being followed." For a CFO, that reframes vendor selection. A policy document that says an agent cannot release a payment without approval is a starting point. Test results showing the agent refused a doctored payment instruction are evidence. Pricing for the program has not been disclosed, and it is aimed at technology vendors, so buyers will see it first as a line on a due diligence checklist.

The Playbook: Govern the Agent Before It Posts

• Write the authority matrix now: For every agent on the 2027 roadmap, list which actions it may take alone, which it may only recommend, and which always need a named approver, then map those limits to existing delegation of authority policies.
• Update controls before go-live, not after: Nearly a third of finance leaders have not revised internal controls for agents in the past year. Add agent actions to the risk and control matrix and agree the testing approach with your auditor before the pilot starts.
• Demand logs an auditor can read: Require every agent action to record what it did, which data it used and who approved it, retained in a form that supports audit documentation rather than a vendor dashboard.
• Ask vendors for adversarial test evidence: Add SOC 2 coverage of agent features and results from manipulated-invoice and prompt-injection testing to procurement questionnaires, and ask how often testing is repeated.
• Name an owner for agent errors: With nearly a quarter of finance leaders unable to say who answers for a significant agent mistake, assign accountability by process before an exception forces the question.
• Build in-house expertise: Three in four teams rely on IT or the vendor to understand their agents. Train at least one controller or internal auditor per agent workflow to explain its behavior to an auditor without help.