Why your AP AI will fail an audit

Accounts payable (AP) is the money a company owes to suppliers for goods and services it has purchased but not yet paid for. Automating AP with AI sounds efficient: the software reads invoices, matches them to purchase orders, flags discrepancies, and processes payments—all in seconds. But auditors are skeptical. When an auditor walks into a finance department, they don't just check that the math is right; they verify that no single person or system can steal money or hide a mistake without someone else catching it. This is called "segregation of duties." For decades, that meant one person requested a purchase, another approved it, and a third paid it. When AI enters the picture, the rules don't disappear—but companies often build systems where the machine makes decisions a human used to make, with no one watching. The article warns that AI agents shipping in 2026 will fail audits because they lack the governance controls—formal rules, approval workflows, and audit trails (records of who did what and when)—that turn a powerful tool into one auditors can trust.

• AI agents are automating AP decisions without audit trails → violates the control principle that all transactions must be documented and traceable.
• Most 2026 AI systems lack segregation of duties → one machine makes matching, approval, and payment calls that should be split across people or systems.
• Auditors will reject AI AP workflows without explicit authorization limits and human override capability → governance controls must be built in, not bolted on afterward.
• "Capability" (can the AI do the work faster?) is not the same as "control" (can we prove it did it right and catch when it's wrong?) → finance will have to choose between speed and auditability.

Internal control

A set of rules and processes a company uses to make sure transactions are recorded correctly, assets are protected, and no employee can steal or hide mistakes without being caught.

Segregation of duties

The principle that no single person should be able to authorize, execute, and verify a transaction by themselves; breaking the task into separate roles reduces the risk of fraud or error.

Audit trail

A complete record of who performed each step of a transaction, when it was done, and what was approved or changed; auditors use this to verify that controls actually worked.

Governance

The rules, approvals, and oversight mechanisms a company puts in place to ensure that employees and systems follow policy and act in the company's interest.

Accounts payable (AP)

Money a company owes to its suppliers for goods and services it has received but not yet paid for; typically one of the largest liabilities on a balance sheet.

Authorization limit

A rule that specifies the maximum dollar amount a person (or system, if it has one) is allowed to approve without getting permission from a supervisor.

Audit

An independent review by external accountants (or internal audit staff) to verify that a company's financial records are accurate and that internal controls are working as intended.

Vendor invoice

A bill from a supplier listing the goods or services delivered, the price, and payment terms; the company records this as accounts payable until it pays the invoice.

1. 01

   Name two internal control objectives an auditor is trying to achieve when they examine an AP process, with or without AI.

   Show answer

   Answer: Students should recognize that auditors want to ensure: (1) all transactions are authorized by someone with the right to approve them, and (2) no single person or system can complete a transaction without leaving a verifiable record that someone else can check. This prevents both fraud and unintentional errors.
2. 02

   If an AI agent matches an invoice to a purchase order and approves payment, which segregation-of-duties principle is at risk, and how would you fix it?

   Show answer

   Answer: The segregation-of-duties problem is that one entity (the AI) is now doing matching, authorization, and execution all together. The fix is to build in a human approval step or a secondary AI system (or human) that verifies high-risk or unusual invoices before payment is released. The AI can handle routine matching; the control lies in the override and review layer.
3. 03

   Why is an audit trail more important when a machine makes decisions than when a human does, from the auditor's perspective?

   Show answer

   Answer: Because auditors cannot interview a machine or rely on its judgment—they can only verify its inputs, logic, and outputs. An audit trail for AI must be far more detailed than for humans: every invoice evaluated, every rule applied, every decision made, and every override logged. Without this, the auditor has no way to test whether the AI followed policy or if it made a mistake the company never caught.

Open by asking students to design a foolproof AP approval process in a world without AI: Who requests? Who approves? Who pays? Draw three boxes and label them. Then ask: what goes wrong if one person does all three? Next, show a slide of an AI agent with arrows pointing to all three boxes at once—that's the problem. Emphasize that "faster" is not the same as "controlled." Use a retail analogy: a self-checkout is faster, but stores still have loss prevention cameras and supervisors. Same idea. Leave students with: "Auditors don't reject AI because they hate technology; they reject it because they can't see what it's doing." That's the governance gap.