The most important control in your business right now isn't in your accounting system. It's the one nobody has written down yet — the rules for how your people use AI.
I've spent four decades watching internal controls evolve. Segregation of duties. Approval thresholds. Reconciliations. A documented audit trail. None of those were invented for fun. Each one was a response to a specific way a business could lose money, lose data, or lose trust. Controls are just lessons that got formalized after someone learned them the hard way.
AI is the next lesson. And most firms are learning it right now, whether they realize it or not.
The Gap Opened Faster Than Any I've Seen
Here's what makes this different. Past control gaps showed up slowly. A new revenue stream, a new system, a new regulation — you had time to see it coming. AI didn't work that way. It arrived through the side door. Your people started using it because it made their day easier, and the adoption was company-wide before anyone in leadership made a decision about it.
That's not a knock on your team. It's human nature. But it means the exposure is already inside the building.
Look at It the Way a CFO Looks at Any Control
Strip away the hype and AI governance comes down to four questions I'd ask about any control gap:
- Access. Who is using these tools, and were they approved?
- Inputs. What data is going in? Client information? Financials? Anything covered by a confidentiality obligation?
- Outputs. Where does the result go, and who relies on it? Is it informing a decision, a client deliverable, a number on a statement?
- Accountability. When the output is wrong — and sometimes it will be — who owns the consequence?
If you can't answer those four cleanly, you don't have a technology question. You have a control gap.
An AI Policy Is a Financial Control, Not an IT Memo
This is where firms get it wrong. They treat the AI policy as something IT writes and files away. It isn't. It protects client data, intellectual property, reporting accuracy, and your name in the market. Those are the same things every other control protects. Put it in the same category, with the same seriousness.
A workable policy doesn't need to be long. It needs to answer five things:
- Approved tools — what people may use, and what they may not.
- Data boundaries — no sensitive or client data in public models. No exceptions that aren't written down.
- Review requirements — human review on anything that touches a client or a financial statement. AI drafts. People decide.
- Ownership — a named person accountable for the policy, not a committee that meets twice a year.
- A safe path to ask — so people raise their hand before they experiment, instead of after.
Where This Is Heading
The firms that treat AI as governance will scale without surprises. They'll adopt faster, not slower, because their people will know the guardrails and use the tools with confidence. The firms that treat it as a side conversation will find out the cost when a client's data ends up somewhere it shouldn't, or a number nobody checked makes it into a report.
Same discipline we've always applied. New surface.
So here's my question for the operators and finance leaders reading this: if I audited your business tomorrow and asked which AI tools your team uses and what data goes into them, could anyone in leadership answer? If the honest answer is no, that's not a future project. That's this quarter.
Frequently Asked Questions
What is AI governance in a business?
AI governance is the framework a company uses to determine how artificial intelligence tools can be used, what information can be entered into them, how AI-generated work should be reviewed and who is accountable for their use.
Why does a business need an AI policy?
A business AI policy establishes clear rules for how employees can use AI tools. It can identify approved platforms, establish boundaries around confidential or client data, require human review of AI-generated work and assign responsibility for oversight.
How does AI create internal control risks?
AI can create internal control risks when employees use unapproved tools, enter sensitive information into public AI models or rely on AI-generated outputs without appropriate review.
What should be included in a corporate AI policy?
A corporate AI policy should define which AI tools are approved, what data employees can and cannot enter, when human review is required and who is responsible for overseeing AI use.
Who should be responsible for AI governance?
AI governance often requires input from finance, operations, IT, legal and other business functions, depending on the organization. However, accountability should be clearly assigned rather than left to an undefined committee. Leadership should know who is responsible for maintaining the AI policy, evaluating risks and making sure established controls are followed.
What role does a CFO play in AI governance?
A CFO can help evaluate AI through the same risk and control framework used throughout the business. This may include examining which tools employees use, what financial or client information enters those systems, how AI-generated outputs influence reporting and decisions and whether adequate review controls are in place.
About the Author
Donald Retreage, Jr. - CFO/COO/EOS® Integrator is a visionary finance executive and trusted advisor to C-suite leaders and boards, known for driving growth and turnarounds through strategic financial and operational leadership. A transformational servant leader, he builds and mentors cross-functional, cross-cultural teams that consistently exceed stakeholder expectations.
Contact Us
If you have any questions or would like to discuss your organization’s finance and strategic management needs, please call the Florida CFO Group at 1-877-352-2367 or send us a message. We are here to help you navigate your financial challenges and achieve success!
Sign Up for the CFO Insider
Every month, our CFOs share what they’re seeing in the market, what smart companies are doing differently, and where hidden risks and opportunities may be emerging. The Florida CFO Insider is built for leaders who want to grow intentionally, optimize performance, and protect what they’ve built. Join the list and get the inside perspective - sign up here for the Florida CFO Insider Monthly Newsletter.