Real Estate Agents Need Written Controls
Software agents are being used to prepare reconciliations, draft journal entries, and flag variances, with the goal of handing a finished package to a human for sign off. BlackLine, FloQast, Microsoft, and Workday have all launched or announced products with these capabilities.
The adoption of these agents is happening quickly, with 75 percent of senior finance leaders reporting active use of AI in finance, according to a survey conducted in March 2026. However, only 42 percent of leaders said their organizations were fully assurance ready.
Before implementing these agents, it’s essential to put certain controls in writing. This includes creating an inventory of agents, with a named control owner for each one, as well as evidence of the auditor’s ability to replay the agent’s work.
This inventory should include the task each agent performs, the accounts and assertions it touches, the data it can read and write, and the named human who owns its output. COSO has issued guidance on internal control over generative AI, emphasizing the need for formal oversight channels.
There are five key controls to consider when implementing agents: an agent inventory with a named control owner, evidence the auditor can replay, human sign-off gates scaled to risk, third-party assurance, and monitoring with an exit threshold.
Human sign-off gates are particularly important, as they ensure that agent output is reviewed and approved by a human before it feeds into the financial statements. The depth of this review should scale with materiality and judgment.
Third-party assurance is also important, as most agentic close tools are subservice organizations. However, existing reports may not provide sufficient guidance on AI use, so it’s essential to read these reports closely and cover any gaps with contract terms and complementary user entity controls.
Monitoring and exception metrics are also vital, as they help to identify when an agent is not functioning as expected. This includes setting thresholds for match rates, exception volumes, and error rates.
Related: EU Questions US Tariff Rationale
By putting these controls in place, organizations can ensure that their use of software agents is efficient, effective, and compliant with professional standards.
According to Lucia Wind, executive director of COSO, these tools “can be confidently wrong, easily manipulated, or deployed outside formal oversight channels.” An inventory of agents is essential to preventing these issues.
As the use of software agents becomes more widespread, it’s likely that we’ll see a greater emphasis on business models that incorporate these tools.
Organizations that are considering implementing software agents should start by creating an inventory of agents and establishing clear controls and procedures.
It’s also essential to read third-party assurance reports closely and cover any gaps with contract terms and complementary user entity controls. By taking these steps, organizations can ensure that their use of software agents is efficient, effective, and compliant with professional standards.
Ultimately, the key to successful implementation of software agents is to establish clear controls and procedures, and to ensure that these are followed consistently.
By doing so, organizations can reap the benefits of increased efficiency and productivity, while also ensuring that they’re complying with professional standards.
