AI Financial Disclosure Review Framework for Audit Committees: 2026 Practitioner Walkthrough

Audit committees overseeing AI in financial reporting face a specific problem: every major guidance body has told them the issue matters, but none has handed them an operational framework they can actually run in a meeting. The CAQ's March 2026 Audit Committee Insights puts it plainly: "as AI becomes embedded in core financial and risk processes, audit committees are increasingly expected to ensure that governance, documentation, and human oversight are in place." Expected to ensure it, but given no blueprint for how.

This walkthrough fills that gap. It is built for audit committee chairs, CFOs, and controllers at mid-to-large public companies who need a structured, repeatable process for overseeing AI's role in financial disclosure preparation and audit, not another list of questions to "consider."

Key takeaway: The framework has three layers: Govern (policy and accountability), Assess (material risk in AI-assisted disclosures), and Oversee (ongoing monitoring and escalation). Each layer has named checkpoints, specific questions, and documentation requirements. Run them in sequence, then keep Oversee running on a standing agenda.

Why Audit Committees Need a Dedicated AI Disclosure Framework Now

The regulatory vacuum is real, and it falls on audit committees to fill it. The SEC under Chair Paul Atkins is focused on disclosure simplification and materiality-based standards, not prescriptive AI rules. The PCAOB has flagged AI-related audit risks in its 2025-2026 inspection priorities but has not issued a final AI-specific auditing standard. FASB has no AI-in-reporting guidance on its active agenda. EFRAG has issued nothing AI-specific for ESRS compliance. The burden of building governance falls on companies, not on regulatory mandates.

Two forces are colliding at the same time. Management is deploying AI tools, including Microsoft Copilot for Finance, Workiva AI, and Oracle Fusion AI, to draft MD&A narratives, run variance analysis, aggregate ESG data, and produce disclosure checklists. External auditors are simultaneously using AI to test journal entries, flag anomalies, and assess going-concern risk. Audit committees must oversee both sides of this equation, yet almost every existing guidance document addresses one side or the other, never both.

The third pressure is investor trust. The CAQ's 2026 Annual Institutional Investor Survey found that 84% of investors are "completely" or "very" confident in audit committee oversight quality, and 90% rely on audited financial statements. That baseline trust is the thing at risk if AI-assisted disclosures erode quality and the erosion surfaces later in an SEC comment letter or enforcement action.

For the SOX certification angle specifically, see SEC Liability for AI-Generated Financial Disclosures: 2026 Enforcement Reality. This article focuses on the audit committee's governance architecture.

The Three-Layer Framework: Govern, Assess, Oversee

The framework maps to COSO's 2026 GenAI governance publication, which identifies eight AI capabilities relevant to financial reporting: ingestion, transformation, posting, orchestration, judgment, monitoring, knowledge retrieval, and human-AI interaction. It also aligns with the NIST AI Risk Management Framework's four functions: Govern, Map, Measure, Manage. The three-layer structure below translates both into audit committee practice.

Layer 1: Govern, Build the Policy Foundation

Before the committee can assess anything, management needs a written AI-in-financial-reporting policy. If one does not exist, that is the first finding.

A governance-ready policy covers five elements:

1. Scope definition. Which AI tools are approved for use in financial close, disclosure drafting, and ESG reporting? This must include third-party vendor tools, not just internally built models. Most companies use vendor AI, and the audit committee's oversight obligation extends to those vendors.
2. Accountability assignment. Who is the named owner of each AI-assisted process? When AI is involved in disclosure preparation, accountability gaps appear fast. The CFO, controller, and vendor cannot all be simultaneously responsible without a clear escalation path.
3. Human-in-the-loop requirements. Every AI-assisted disclosure must have a documented human review step: a named individual who reviewed the output, confirmed its accuracy, and approved the final text. This is the central control principle in COSO's GenAI framework, the NIST AI RMF, and the EU AI Act, which became fully applicable for high-risk AI systems in August 2026.
4. Vendor risk management. For each third-party AI tool used in financial reporting, the policy should specify: what training data the vendor's model uses, how model updates are communicated, and what the vendor's liability is if the model produces a materially incorrect output. Standard vendor contracts rarely address these questions. A SOC 1 report review is a starting point, but it is not sufficient on its own.
5. Change management for prompts and model versions. Prompts used to generate financial narrative and model version numbers should be treated as change-managed configuration items, not informal inputs. This is the documentation standard the FEI Committee on Corporate Reporting's June 2026 AI Framework for ICFR recommends.

Questions to Ask Management at the Govern Stage

• Show us the written AI-in-financial-reporting policy. When was it last updated?
• Which AI tools are approved for use in the financial close and disclosure process? Who approved them, and through what process?
• For each tool, who is the named accountable owner if the AI output contains an error that reaches a filed disclosure?
• What does your vendor contract say about model accuracy, update notification, and liability for incorrect outputs?
• How are prompt changes and model version updates tracked and approved?

For a deeper walkthrough of the policy architecture, see AI Model Governance for Financial Reporting: 2026 CFO Playbook.

Layer 2: Assess, Identify Material Risk in AI-Assisted Disclosures

The Assess layer runs each reporting period. Its job is to identify where AI has touched the disclosures and whether those touchpoints create material risk.

This is where most existing frameworks stop at the surface. They ask whether AI is being used. The harder question is whether AI-assisted text is accurate, complete, and not misleading, even when the underlying numbers are correct.

The Narrative Risk That Checklists Miss

Large language models used to draft MD&A, earnings releases, and ESG reports can produce text that is factually accurate at the sentence level but materially misleading in emphasis, framing, or omission. A model trained on prior filings may systematically downplay negative trends, over-emphasize positive ones, or omit a known uncertainty that Regulation S-K Item 303 requires management to discuss. The numbers in the financial statements can be perfectly correct while the narrative creates a misleading overall picture.

This is a distinct risk from numerical error, and it is not addressed by standard disclosure checklists. A 2026 research paper in the Saudi Journal of Economics and Finance found that AI-generated financial disclosures can be as reliable as human-written ones, but only when entities implement strong AI governance and maintain human-in-the-loop review. In the absence of those controls, GenAI can materially undermine reliability and auditability.

Key takeaway: Audit committees should require management to demonstrate that human reviewers are specifically trained to catch tone, emphasis, and omission errors in AI-drafted narrative, not just factual inaccuracies. These are different cognitive tasks.

The COSO Eight-Capability Map

COSO's 2026 GenAI framework gives audit committees a structured way to scope the risk assessment. For each of the eight AI capabilities, ask where it appears in the financial close and disclosure process:

The last row is the most dangerous. Shadow reliance occurs when a "human-reviewed" control quietly stops operating as reviewers become habituated to approving AI outputs without genuine scrutiny. The FEI June 2026 framework recommends stress-testing human-in-the-loop controls by seeding a known error and confirming the human reviewer catches it.

Questions to Ask Management at the Assess Stage

• Walk us through every point in the Q3/Q4 close where an AI tool touched a number or a piece of disclosure text before it was filed.
• For AI-drafted MD&A or ESG narrative: who reviewed it, what specifically did they check, and how is that review documented?
• How do you test that human reviewers are actually catching errors in AI outputs, rather than approving them reflexively?
• Which COSO AI capabilities are present in your financial reporting process, and what controls exist at each?
• Are any AI tools being used to aggregate or draft CSRD or IFRS S1/S2 sustainability disclosures? If so, how are those outputs validated?

For the specific hallucination risk in SEC filings, see AI Hallucination Risk in SEC Filings: A 2026 Practitioner Walkthrough. For the MD&A narrative review process, see Reviewing AI-Drafted Financial Commentary: A CFO's Process Guide.

The ESG Disclosure Layer

Multinational companies face a second parallel risk stream. AI tools are being used to aggregate ESG data, map it to ESRS data points under CSRD, and draft sustainability disclosure text for IFRS S1 and S2 reporting. Neither EFRAG nor the ISSB has issued AI-specific guidance for these frameworks. Audit committees at companies subject to CSRD or ISSB standards need to apply the same Assess-layer questions to ESG disclosures as to financial ones, and they need to do it under a unified framework, not a separate process.

For companies with EU operations, the EU AI Act adds a compliance dimension: high-risk AI systems in financial services now require conformity assessments and documented human oversight mechanisms as of August 2026.

Layer 3: Oversee, Monitor, Challenge the Auditor, and Escalate

The Oversee layer is the standing agenda item. It runs every meeting, not just at year-end.

Challenging the External Auditor on AI

Most audit committee guidance addresses management's use of AI in disclosure preparation. Almost none addresses the audit committee's obligation to challenge the external auditor's use of AI in the audit itself. The PCAOB's 2025-2026 inspection priorities include AI-related audit risks, specifically over-reliance on AI outputs, inadequate human review, and model hallucination in audit analytics. No final AI-specific auditing standard exists yet, which means audit committees cannot rely on a PCAOB standard to define what "good" AI use by auditors looks like. They have to ask.

Questions to Ask the External Auditor

• Which AI tools did your firm use in this audit, and for which procedures specifically?
• How did your team validate the AI tool's outputs before relying on them as audit evidence?
• If your firm used AI to test journal entries or flag anomalies, what was the false-negative rate, and how were missed items identified?
• Can an AI-assisted audit reliably audit an AI-assisted disclosure? What additional procedures did you apply given that management also used AI in preparing the financial statements?
• What documentation does your firm maintain of AI tool use in the audit, and is that documentation available to us?

The last question matters for a reason that most committees have not yet considered: if the SEC or PCAOB later scrutinizes the audit, the committee's own oversight record will be examined. "You'd rather know than be surprised," as one audit committee chair put it in the CAQ/EY/Tapestry publication on internal audit's evolving role.

Escalation Triggers

No existing framework specifies what AI-related events should trigger escalation to the full audit committee versus being handled at management or internal audit level. Here is a working set:

Escalate to the full audit committee immediately if:

• An AI tool used in disclosure preparation produces output that was filed before human review was completed.
• A vendor AI model is updated mid-period without change management approval, and the update affects a disclosure that has already been filed.
• Internal audit identifies shadow reliance: a human reviewer approved AI outputs without genuine review for a material disclosure.
• An AI-related cybersecurity incident affects a system used in financial reporting, which may trigger disclosure obligations under SEC Final Rule 33-11216 (Form 8-K Item 1.05).
• The external auditor flags an AI-related finding in the audit that management has not separately reported to the committee.

Handle at management level, with committee notification at next meeting:

• A prompt change or model version update that passes change management review without affecting filed disclosures.
• An AI tool flagging a variance that human review confirms is immaterial.
• A new AI tool being evaluated for future use in financial reporting (committee should be briefed, not asked to approve).

Documentation: What to Maintain and Who Owns It

Existing guidance says documentation should exist. It does not specify what. For regulatory and litigation purposes, the audit committee's oversight record should include:

• Minutes reflecting the specific AI oversight questions asked and management's responses, by reporting period.
• A log of AI tools approved for use in financial reporting, including vendor name, version, and approval date.
• Evidence that human-in-the-loop review was completed for each AI-assisted disclosure, including the reviewer's name and the date of review.
• Records of prompt changes and model version updates, treated as change-managed items.
• Documentation of any escalation events and the committee's response.

The CAQ's webinar series on AI in Financial Reporting and Audit covers four core questions the committee should be able to answer at any time: how AI is being used in financial reporting, how that use impacts the audit, how auditors are using AI, and how all of this affects audit committee oversight. If the committee cannot answer all four, the documentation record is incomplete.

The Internal Audit Function's Role

Internal audit is the committee's primary intelligence source on AI controls, but its capacity to play that role depends on whether it has the skills and mandate to audit AI-assisted processes. The CAQ/EY/Tapestry publication notes that internal audit is being asked to provide "unique insight into potential risks while also ensuring that a company is following governance frameworks and implementing appropriate human oversight." One chief audit executive quoted in that publication warned: "Internal audit cannot hinder progress. It must support the implementation of technology or we are going to slow the company down."

The committee should assess annually whether internal audit has the technical skills to evaluate AI controls in financial reporting, or whether an independent third-party assessment is needed.

The SOX 302/906 Intersection

One governance question that no current framework addresses directly: if AI tools are used in disclosure preparation, do the CEO and CFO signing SOX 302 and 906 certifications have sufficient knowledge of those tools' outputs to certify accuracy? The FEI June 2026 framework makes the point clearly: AI does not change who is accountable. The 302 and 906 certifications still rest with the certifying officers. What changes is how risk manifests, and the certifying officers need to be able to demonstrate they understood and reviewed the AI-assisted outputs they are certifying.

Audit committees should ask management directly: what does the CFO's review process look like for AI-assisted disclosures before signing the 302 certification? The answer should be specific, not general. For a full treatment of the enforcement dimension, see SEC Liability for AI-Generated Financial Disclosures: 2026 Enforcement Reality.

FAQ

Is there a regulatory requirement to disclose that AI was used in preparing our financial statements or MD&A?

No specific rule requires disclosure of AI use in disclosure preparation as of October 2026. The SEC's current posture under Chair Atkins is materiality-first: if AI use in disclosure preparation is a material risk or creates a material uncertainty, it should be disclosed under existing frameworks including Regulation S-K Item 303 and Risk Factors. The SEC has not issued prescriptive AI-in-disclosure rules. Document your rationale either way.

What is the biggest failure mode in AI-assisted financial disclosure?

Shadow reliance: human reviewers who nominally approve AI outputs without genuine scrutiny. This degrades a key control silently. The FEI June 2026 framework recommends stress-testing human-in-the-loop controls by seeding a known error and confirming the reviewer catches it. If they do not, the control is not operating.

How does the PCAOB's AI focus affect what we should ask our auditor?

The PCAOB's 2025-2026 inspection priorities flag over-reliance on AI outputs and inadequate human review as audit risks. No final AI auditing standard exists yet. Audit committees should ask auditors to specify which AI tools were used in the audit, for which procedures, and how outputs were validated, since no PCAOB standard currently defines that bar for them.

Does using AI in CSRD or IFRS S2 disclosure preparation create additional audit committee obligations?

Yes. The same Govern-Assess-Oversee framework applies to ESG disclosures. EFRAG has not issued AI-specific guidance for ESRS, and the ISSB has not done so for IFRS S1/S2. Audit committees at multinational companies should treat AI-assisted sustainability disclosures as a second risk stream within the same framework, not a separate process. EU companies and U.S. multinationals with EU operations must also factor in EU AI Act compliance for any high-risk AI systems used in financial services.

What should the audit committee's standing AI agenda item cover?

At minimum: (1) any new AI tools approved or under evaluation for financial reporting use; (2) any escalation events since the last meeting; (3) the status of human-in-the-loop documentation for the most recent reporting period; (4) any PCAOB or SEC developments affecting AI governance obligations; and (5) internal audit's assessment of AI control effectiveness. Keep the minutes specific enough to demonstrate genuine oversight, not just awareness.