When the Tool Becomes the Risk: Governing AI in Your Control Framework

Organisations are adopting AI tools to support control testing, financial monitoring and risk reporting. But as AI enters the control environment, it introduces a category of risk that traditional frameworks have not fully addressed: the AI system itself as a potential control failure point. In early 2026, COSO published new guidance addressing exactly this gap.

What Is the New COSO Guidance on AI and Internal Controls?

The Committee of Sponsoring Organisations of the Treadway Commission published a practical framework in early 2026 addressing internal control over generative AI. The guidance recognises that AI systems used in operational and financial workflows are not just tools — they are themselves a category of control that requires governance.

The question the guidance poses is direct: if AI is making or supporting decisions about financial data, who is ensuring that AI is doing so reliably and correctly?

Why Do AI Tools Need Their Own Internal Controls?

Traditional controls are designed around processes and people. They assume a human is performing the activity being controlled. When an AI system performs or supports a task — summarising evidence, flagging exceptions or drafting reports — the accountability structure shifts.

If an AI produces an incorrect output, the control may appear to have been performed while the underlying assessment was flawed. This is a new failure mode: a control that functions operationally but fails intellectually.

What Can Go Wrong When AI Is Part of a Control?

The risks are concrete:

• AI producing confident outputs without flagging uncertainty or limitations
• Inconsistent performance across different document types or data formats
• Outputs that are not independently verifiable without specialist knowledge
• Overreliance reducing the review rigour of human operators
• Absence of a clear audit trail showing what the AI assessed and why

Each of these can result in a control being recorded as complete when it has not actually performed its intended function.

How Do Traditional Control Principles Apply to AI-Assisted Controls?

The core principles of effective controls — ownership, consistency, testability, documentation — still apply. What changes is how each principle is satisfied when an AI is involved.

The standard does not change. The method of applying it does.

What Does Good AI Governance Look Like in Practice?

Governing AI in a control environment does not require specialist technical knowledge. It requires the same rigour applied to any significant manual or automated control.

In practice, this means documenting what the AI does and what it is permitted to influence, maintaining human review at key decision points, monitoring AI performance over time and understanding where outputs are most likely to be unreliable.

Organisations that treat AI tools like any other third-party process — with defined scope, tested outputs and clear ownership — are better placed to provide assurance when it is needed.

How Is CovaCtrl Different?

CovaCtrl was designed with this governance dimension in mind. Its AI analysis is structured, transparent and always reviewed by the user before any conclusion is recorded. The platform does not act autonomously — it provides structured evidence and recommendations that human teams assess and own.

This means organisations using CovaCtrl can demonstrate that AI is supporting the control, not replacing the accountable person responsible for it.

Why This Matters Now

AI is moving into control functions quickly, often ahead of governance frameworks. COSO's new guidance is a clear signal that standard-setters consider this a material issue today, not a future concern.

Organisations that govern their AI tools with the same care they apply to other controls will be better positioned for audit scrutiny, stakeholder trust and genuine control effectiveness.

The question is not whether to use AI in control work. It is whether the AI itself is under control.