AI Can Do the Work. But Who Signs Off?

One question I keep coming back to when we talk about AI in accounting is this:

If AI prepares the work, who signs off?

If AI prepares the work, who signs off?

Under today's framework, I think the answer is still quite straightforward.

It is the user of AI.

The software vendor is probably not going to sign your financial statements. It is not going to sign your audit opinion either. Until the law, regulators and the other stakeholders relying on our work are prepared to accept something different, accountability still sits with the professional.

On what basis are we comfortable signing?

So to me, the more interesting question is: on what basis are we comfortable signing?

The immediate answer many of us will probably give is "human-in-the-loop".

I agree with the principle. But I think we need to be careful about what that means in practice. Where do we place the human, and in which loop?

In the early days of agentic AI, every single write action triggers a permission grant prompt.

As time went by, I almost wanted to put an eraser on the keyboard.

Imagine an AI processing 5,000 transactions and asking someone to approve every one of them.

On paper, that sounds like a strong control. This is what we call design effectiveness.

In reality, after hundreds of approvals, how meaningful is that review?

You start getting decision fatigue. People click through things. A control that looks effective by design may not be very effective operationally.

And from an economics perspective, if AI removes the preparation work but we recreate almost all of that effort during review, the productivity gain becomes much smaller.

I think audit already gives us a useful way to think about sign-off

One caveat.

This is my personal view of how some of the principles we already use in audit could help us think about AI-produced accounting work.

As far as I am aware, we have not yet had these exact boundaries tested extensively by regulators or the courts in the context of AI. So I would not say that a risk-based AI review model is already the accepted regulatory answer.

But as a profession, we are not starting from zero either.

We already understand risk, controls, reliance and professional scepticism.

We may need to apply those same principles to a very different way of producing the work.

I think the way we conduct audit has dealt with this question for a long time.

An auditor does not reperform every single transaction before signing an audit report.

We use a risk-based approach.

We understand the process. We understand the controls. We consider where things can go wrong. We test. We apply professional scepticism. Then we decide how much reliance we are prepared to place on that process.

How much review (or audit work) needs to be done before you are comfortable signing off?

There are two ends of the spectrum: an algorithm at one end, and a large language model at the other.

If I have a deterministic algorithm that has been properly designed, tested and controlled, the system should perform the same action consistently on the same input.

If I can get comfortable with the design, access controls, change management and the relevant IT general controls, I may not need to manually reperform every output.

An LLM does not give me that. Its output is not reproducible in the same way, and the behaviour moves when the prompt or the model changes. That is before you add an environment where prompts are changing every week, models are being swapped around, and people are vibe coding tools and putting them into production.

In that environment, naturally I would want more assurance.

I would probably review more outputs.

If I start finding exceptions, I would increase the extent of my review.

That is not very different from the way accountants and auditors already think about risk.

The less certainty I have over the system, the more assurance I need around its output.

I think there is something we can borrow from that thinking as AI becomes part of accounting workflows.

Not all AI should have the same review process.

	Algorithm	Large language model
Extent of review	I may not need to manually reperform every output.	I would want more assurance and would probably review more outputs.
What gets reviewed	Design, access controls, change management and the relevant IT general controls.	Outputs, with the extent of review increasing if I find exceptions.
Where the human sits	Around the system and its controls rather than every output.	Closer to the output, especially where prompts change weekly, models are swapped and tools are vibe-coded into production.

Human-in-the-loop should not mean human-on-everything

This is why I do not think the answer to AI governance is simply to put a human approval box everywhere.

The human needs to be at the right part of the loop.

For some processes, that may be transaction-level review.

For others, it may be exception review.

For a well-controlled system, more of the human effort may sit around system design, changes, reconciliations and monitoring rather than checking every transaction one by one.

And where judgement is involved, naturally the human role becomes more important.

That, to me, is a much more practical interpretation of human-in-the-loop.

AI may remove preparation. That does not automatically mean less review.

This is probably the part I find most important.

I expect AI to remove a significant amount of preparation work from accounting.

But total effort is preparation plus review.

Automating the preparation does not simply subtract that effort from the total. Review work may increase, depending on how the automation was implemented.

The work may simply move.

• Less time on extracting data, preparing schedules and processing routine transactions.
• More time on exceptions, controls, unusual items and judgement.

And especially in the early stages of AI adoption, perhaps even more professional scepticism around how the work was produced.

So when we talk about the return on investment of AI, I do not think the right measure is simply:

How many preparation hours did we save?

I would rather ask:

What is the total effort and cost required to get from the raw data to a piece of work that somebody is prepared to put their name on?

That is where I think the real productivity gain needs to be measured.

AI can remove the preparation. It does not remove the accountability.

And perhaps the question going forward is not whether a human checked every line.

It is whether the human had a sufficient basis to sign.