Financial Control Evidence for Agent-Delivered Work

Begin with the Financial Assertion

The CFO should ask which financial statement assertion the outsourced service can affect before approving its automation. An agent preparing a journal, reconciling an account, or classifying an exception presents different control questions. The service should connect its actions to the bank’s relevant financial control objectives rather than treat a general AI approval as sufficient.

EY’s 2026 governance survey distinguishes formal policy adoption from evidence of effective operation.¹ Its US executive survey is not a test of this bank’s financial controls. The practical implication is to inspect the evidence supporting a material assertion instead of inferring control effectiveness from a policy or committee.

Define the source population, transformations, permitted postings, approval authority, and final system of record. Identify what constitutes a complete reconciliation and which unresolved differences prevent closure. A plausible explanation can accompany an incorrect balance; narrative quality should not determine financial acceptance.

Make Human Intervention Part of the Record

The study reports manual alterations across the sampled engagements.² It does not establish financial misstatement. For finance, the concern is whether a correction changes the evidence on which a control owner relies and whether the final work can be traced back to the original source and authorized intervention.

In a hypothetical reconciliation, a provider employee might alter a mapping so that two balances agree. The final equality does not establish that the mapping is correct. Preserve the original inputs, reason for the change, authority, affected items, reviewer decision, and resulting ledger state.

Human work can be a legitimate control or a necessary repair. Label it accurately. An approval added after execution should not be represented as a preventive authorization, and a provider’s explanation of its own correction should not automatically become independent review.

Use an Assertion to Evidence Record

Figure 1 proposes a record linking the assertion, service action, control, and retained evidence. For each material route, specify how management establishes completeness of the population, accuracy of the transformation, authority for the action, and treatment of exceptions. Define who can reproduce the conclusion.

Keep the control owner distinct from the person responsible for supplier delivery. That separation need not require duplicate testing of every transaction, but it should preserve an effective challenge. Changes to prompts, mappings, models, source systems, or intervention practices should trigger review of the affected control.

BCG’s control-plane discussion connects runtime governance to identity, permissions, and operational ownership.³ A platform can support finance evidence, but it does not decide whether an accounting assertion is satisfied. The finance function must define and test that conclusion.

Preserve the Bank Specific Control Framework

EU, UK, Swiss, US, and other financial reporting and audit regimes differ. The CFO should identify the applicable accounting, internal control, recordkeeping, and assurance requirements for the legal entity and service. Do not label a technology log as an audit-ready control record without evaluating its content, completeness, integrity, and retention.

The provider contract should support timely access to source records, intervention history, relevant configuration, and personnel. Resolve restrictions before the close timetable makes retrieval urgent. Confidentiality protections should allow the necessary bank and auditor access through an agreed secure process.

An assurance report may address selected provider controls for a defined period and scope. Management should determine which complementary controls remain at the bank and whether the report covers the actual agent service. A broad certification should not obscure an untested financial workflow.

Approve the Evidence Before Relying on the Result

A reasonable objection is that this repeats established financial control practice. The objective is to preserve that discipline while the delivery method changes. Agent-generated explanations, distributed execution, and concealed manual repair can alter where the evidence resides and what a reviewer must inspect.

Before the next material reliance decision, select an affected financial assertion and reconstruct representative work from source population through final posting and exception resolution. Have the control owner assess whether the evidence supports the assertion and whether another authorized reviewer can reach the same conclusion.

The CFO should accept the service when the bank can demonstrate the financial result and the control that supports it. Output speed and supplier assurance are supporting facts. Neither replaces the evidence needed to explain what entered the accounts, why it was authorized, and how management knows it is correct.

Evidence and Source Note

The study is a nonrepresentative cross-section of 850 vendor delivery-team respondents on 150 engagements serving Tier 1 financial institutions, collected during January–June 2026. Neither banks nor vendors corroborated the accounts. It establishes reported experience, not causation, legal breach, or market prevalence. The author-supplied version 1.8.2 is dated November 1, 2026 and is cited as a forthcoming manuscript consulted October 23, 2026.⁴

This is an analytical decision paper based on the supplied study and selected primary public sources checked through October 23, 2026. The original contribution is an assertion-to-evidence record linking outsourced agent execution and human alteration to financial control reliance. The proposed method has not been independently validated. Legal requirements depend on the entity, activity, jurisdiction, and effective provisions; supervisory observations, research, and professional commentary have distinct authority.

Notes

1. Richard Jackson and John McLain, “AI Governance Has Entered Its Next Phase: Closing the Confidence Gap,” EY, September 15, 2026, US survey population and chapters 4–5, https://www.ey.com/en_us/insights/assurance/ai-governance-has-entered-its-next-phase-closing-the-confidence-gap. ↩
2. Phil Hatch, Agentic AI Outsourcing at Tier 1 Financial Institutions: Full Study Report, version 1.8.2 (Akholi, forthcoming manuscript dated November 1, 2026), Part 5, “The Five Manual Alteration Methods” and “Disclosure of Manual Alteration,” table 5.8, https://doi.org/10.2139/ssrn.7164559. ↩
3. Shaheer Rizvi et al., “Enterprise AI Control Plane: The CIO’s Guide to Governing and Accelerating AI Agents,” Boston Consulting Group, August 14, 2026, “Technical Components of the EACP” and “Lessons Learned”, https://www.bcg.com/publications/2026/how-cios-govern-ai-agents-at-scale. ↩
4. Hatch, Agentic AI Outsourcing, Introduction, “Executive Summary” and “Evidentiary Basis and Its Limits”. ↩

Bibliography

• Hatch, Phil. Agentic AI Outsourcing at Tier 1 Financial Institutions: Full Study Report. Version 1.8.2. Akholi. Forthcoming manuscript dated November 1, 2026. Author-supplied manuscript consulted October 23, 2026. https://doi.org/10.2139/ssrn.7164559.
• Jackson, Richard, and John McLain. “AI Governance Has Entered Its Next Phase: Closing the Confidence Gap.” EY. September 15, 2026. https://www.ey.com/en_us/insights/assurance/ai-governance-has-entered-its-next-phase-closing-the-confidence-gap.
• Rizvi, Shaheer, Zeeshan Shah, Sarvesh Singh, Nicolas Tanaka, Francois D’Agostini, and Jazz Tobaccowalla. “Enterprise AI Control Plane: The CIO’s Guide to Governing and Accelerating AI Agents.” Boston Consulting Group. August 14, 2026. https://www.bcg.com/publications/2026/how-cios-govern-ai-agents-at-scale.