- of employees who use AI rely on its output without checking, per KPMG's 47-country study
- 66%
- say they have made mistakes at work because of AI
- 56%
- tiers of review, matched to the consequence of an error, are enough for most companies
- 4
In October 2025 one of the world's largest professional firms agreed to refund part of its fee to the Australian government for a report costing AUD 440,000. The report contained references that did not exist and a quotation attributed to a court judgment that the court had never written. The firm acknowledged that a generative AI tool had been used in preparing it. The people involved were qualified, the firm had a methodology, and the errors still reached the client.
That episode is the clearest public lesson on the subject of this article. The failure was not that AI was used. It was that the review process, built for work prepared by people, did not catch errors of a kind people rarely make: fluent, well-formatted, entirely invented.
Finance is now exposed to the same problem. When a tool reads the bills, proposes the coding, matches the bank, drafts the variance commentary and builds the schedule for the bank, who checks, and how? This is the ninth article in our series on artificial intelligence for business in Nepal and the last of four on finance.
Why the old control breaks
The foundation of control in accounting is the maker and checker. One person prepares. Another, who did not prepare, reviews and approves. The control works because of three unstated assumptions.
The preparer understood the work. A junior who prepared a reconciliation by hand knows where each figure came from and can answer questions about it.
Errors look like errors. Human mistakes tend to be visible: a transposed figure, a column that does not add, a missing line. Reviewers learn where to look.
Volume is limited. A person can prepare only so much, so a reviewer can keep up.
AI weakens all three. The person who ran the tool may not know how the output was produced. The errors are plausible: the total adds, the format is perfect, the explanation reads well, and one figure has been invented or drawn from the wrong period. And volume is unlimited: a tool can generate in an hour more schedules than a reviewer can read in a week.
There is a behavioural problem on top. People defer to confident, well-presented output. The KPMG and University of Melbourne study of 48,000 people in 47 countries found that 66 per cent of employees who use AI rely on its output without evaluating it, 56 per cent report having made mistakes at work because of it, and 57 per cent conceal their use of it. A control environment in which the preparer does not check and the reviewer does not know a tool was used is not a control environment.
How AI gets numbers wrong
Controls should be designed against specific failure modes. Seven matter in finance.
| Failure | What happens | Example |
|---|---|---|
| Fabrication | The model produces a figure, reference or fact that has no source | A section number of the Income Tax Act that does not say what is claimed |
| Extraction error | A document is misread | NPR 1,50,000 read as 15,000 because of lakh-style comma grouping, or a Devanagari numeral misread |
| Arithmetic error | Language models compute unreliably unless they call a calculation tool | A column total that is close but wrong |
| Wrong source or period | The right kind of figure, from the wrong file, entity or month | Last year's trial balance used for this year's ratio |
| Classification error | A transaction coded to a plausible but wrong head | Capital expenditure expensed, or an exempt supply treated as taxable |
| Omission | Rows silently dropped when the input is long | A debtors list of 400 lines summarised from the first 250 |
| Inconsistency | The same question gives different answers on different runs | Two versions of a schedule that disagree |
Three further risks are less about a single number.
Staleness. A model's knowledge has a cut-off date. Tax rates and thresholds change with every Finance Act. A tool may apply a superseded rate with complete assurance (can AI be trusted on Nepali tax law).
Instruction injection. A tool that reads incoming documents can be manipulated by text placed inside them, for example an invoice containing hidden instructions. Systems that both read external documents and take actions need particular care.
Silent change. A vendor updates the model, and the same prompt behaves differently from last month.
The governing principle
Treat the output of an AI tool as the work of a fast, well-read, unverified junior with no accountability, who never says "I am not sure". That framing leads to the right behaviour. You would not send such a person's schedule to the bank unchecked. You would not let them post journals without approval. You would ask where each number came from. And you would never accept "the junior did it" as an explanation to the board.
It also sets the right ambition. Nobody proposes banning juniors. The aim is supervision proportionate to the stakes.
Tiering by consequence
Not every use deserves the same control. Classify each AI-assisted task by what happens if the output is wrong.
| Tier | Nature of use | Examples | Minimum control |
|---|---|---|---|
| 1. Low | Internal, no numbers relied on | Drafting an email, summarising a meeting, explaining a formula | User reads before using |
| 2. Moderate | Internal analysis that informs a decision | Variance commentary draft, ad hoc query on the ledger, first-pass ageing analysis | User ties key figures to source. Reviewer sees the source, not just the output |
| 3. High | Feeds the books or management reporting | Bill coding, bank matching, accrual proposals, management pack figures | Independent review, control totals, sample re-performance, exception log, sign-off |
| 4. Critical | Goes outside the company or carries legal effect | Tax returns, statutory accounts, schedules to lenders, valuations, payments | Full verification to source by a qualified person, second review, evidence retained, named accountable signer |
The tiering does two things. It stops trivial uses being smothered in procedure, which only drives use underground. And it concentrates effort where an error costs money, reputation or a penalty.
The control set
Before the tool runs: input controls
Approved tools only. A short list of tools that may be used for tiers 2 to 4, with the settings that govern data retention.
Defined data sources. The tool works from the closed ledger or a named export, never from a file of unknown origin.
Completeness of input. Record the row count and total of what goes in.
Data rules. What may not be entered: client-identifiable data, payroll details, bank credentials, anything subject to confidentiality, unless the tool is approved for it (AI risk as a governance question).
Standard prompts. For recurring tasks, a tested, version-controlled prompt or configuration, not an improvised one each month.
While it runs: process controls
Calculation by tool, not by language. Arithmetic should be done by a spreadsheet, the accounting system or code the model writes and runs, not by the model "in its head".
Source citation. Require the output to state where each figure came from: ledger account, document, cell.
Constrained outputs. Coding chosen from the chart of accounts, not free text. Amounts within defined limits.
Thresholds. Auto-processing only below a set amount and within tolerance. Everything else is routed to a person.
After it runs: output controls
These are where most of the protection lies.
1. Tie to control totals. The total of the schedule equals the ledger balance. The number of invoices processed equals the number received. The sum of the parts equals the whole. This one check catches omission, duplication and most extraction errors.
2. Trace to source. For tier 3, trace a sample. For tier 4, trace every material figure to the underlying document or ledger.
3. Re-perform a sample independently. A reviewer recomputes a selection without looking at the tool's answer first.
4. Reasonableness. Compare with the prior period, the budget and expectation. An electricity charge three times the usual, or a gross margin that has moved four points, needs an explanation before it is accepted.
5. Verify every external reference. Section numbers, rates, case names, circular dates and quotations are checked against the primary source. No exception. This is the control that failed in the Australian report.
6. Consistency. Where it matters, run the task twice or by two methods and compare.
7. Exception review. A person examines everything the tool flagged, and a sample of what it did not.
Around it: organisational controls
Segregation. Whoever configured or prompted the tool does not give final approval to its output for tiers 3 and 4.
Disclosure. Preparers state when and how AI was used. Concealment is treated as a control breach, use is not.
Competence. The reviewer must be able to do the task without the tool. A reviewer who cannot is a rubber stamp.
Evidence. A record of what was checked, by whom and when.
Change control. Changes to prompts, rules, thresholds and tool versions are logged and tested.
Access. Who may run automated postings, change rules or approve exceptions is restricted and reviewed.
Reviewing differently
Reviewing machine output is a different skill from reviewing a junior's work, and reviewers need to be taught it.
Review the source, not the summary. Open the ledger or the document. A reviewer who reads only the output is checking grammar.
Hunt for what is missing. Machines omit quietly. Count rows. Check the last page.
Distrust polish. Fluency carries no information about accuracy.
Check the boring figures. Dates, entity names, currency, units, lakh and crore. Errors hide in what nobody reads.
Ask one question the output cannot answer. "Why did freight rise?" If the preparer can only repeat the tool's sentence, the cause has not been established.
Time-box, do not skim. If volume exceeds review capacity, reduce the volume or increase capacity. Do not approve unread work.
A useful practice is to seed errors deliberately. Once a quarter, insert three known mistakes into a machine-prepared schedule and see whether review catches them. The result is the most honest measure of the control.
Worked example: the monthly management pack
Consider an illustrative company, not a client, that uses an AI feature to assemble its monthly pack and draft commentary. A sound control design would be:
Input. The pack is generated only after the ledger is closed and locked. The closing trial balance total is recorded.
Generation. Figures are pulled by fixed queries from the ledger. The language model writes commentary only, and receives the computed variances as input. It does not compute them.
Tie-out. The accountant agrees revenue, gross profit, net profit, cash, receivables and payables in the pack to the trial balance and bank reconciliation. A one-line tie-out sheet is signed.
Commentary check. For each variance explanation, the accountant confirms the cause with the relevant manager and corrects the draft. Explanations that cannot be confirmed are removed or marked as unconfirmed.
Review. The finance head reviews the pack against the tie-out sheet and the prior month, and asks at least two questions that require going back to source.
Disclosure. The pack carries a footnote on which sections were machine-drafted and which figures are estimates.
Evidence. The tie-out sheet, queries and sign-offs are filed with the pack.
The total extra effort is perhaps an hour. It turns a document that looks reliable into one that is.
What auditors, lenders and the tax office will ask
Outside parties care about the result and, increasingly, about the process.
Auditors. Auditing standards require the auditor to understand the entity's information system and controls relevant to financial reporting. Where automated tools post or prepare, expect questions on who approves, how exceptions are handled, how changes are controlled and what evidence exists. A company that cannot show review may face more substantive testing and a longer audit.
Lenders. Banks relying on borrower-prepared stock and receivable statements, projections and management accounts will not accept a tool as the source. Under Nepal Rastra Bank's AI Guidelines, as reported, banks themselves must classify their AI systems by risk, keep humans in oversight, and hold the board and senior management ultimately accountable. They will expect comparable seriousness from borrowers whose data feeds their models (how lenders will read your business).
The tax office. A return is a declaration by the taxpayer. An error introduced by software is the taxpayer's error, and interest and penalties follow in the ordinary way. With the Inland Revenue Department moving toward automated risk selection, an unexplained inconsistency is more likely to be noticed (the data-driven tax authority).
Directors. Under the Companies Act 2063 the board is responsible for the accounts. "We relied on the system" has never been a defence, and AI does not make it one.
Frameworks worth knowing
Nobody needs to invent this from nothing. Three reference points are useful, each applied in proportion.
The COSO internal control framework remains the base: control environment, risk assessment, control activities, information and monitoring. AI controls are ordinary controls applied to a new kind of preparer.
The NIST AI Risk Management Framework organises AI risk management under four functions: govern, map, measure and manage. It is voluntary and readable, and a sensible checklist for a larger company.
ISO/IEC 42001 is a certifiable management system standard for AI. It is relevant mainly to organisations that build or heavily deploy AI, such as banks and IT companies serving foreign clients.
In Nepal, the binding reference for banks and payment institutions is Nepal Rastra Bank's guideline. For other companies there is no AI-specific rule, and the general duties of directors, the Individual Privacy Act 2075 and professional standards apply. The National AI Policy 2082 indicates that risk-based regulation will follow.
Controls for a small team
A company with three people in accounts cannot segregate everything. Proportionate substitutes exist.
The owner or an outside reviewer acts as the independent check on tier 3 and 4 items.
Control totals are non-negotiable, because they cost minutes.
Bank reconciliations are reviewed monthly by someone who does not post entries.
Returns and anything going to a bank are reviewed by a qualified person, in-house or external.
A one-page rule states which tools may be used and what must never be entered.
Control scales down. It does not disappear. See why growing businesses need better internal controls.
From ground level to policy level
On the ground, the control that matters most is cultural: staff must feel safe saying "I used a tool for this, and here is what I checked". Where use is hidden, nothing else works.
At company level, the board should ask for an inventory of where AI touches financial numbers, the tier of each use and the result of the last control test. That is a one-page report.
At the level of the profession, the Institute of Chartered Accountants of Nepal's ethical requirements of competence, due care and confidentiality already apply to work done with AI. Guidance specific to AI use in practice would help members and firms, as accountancy bodies elsewhere have begun to issue.
At policy level, the direction of Nepal's regulators is accountability with human oversight: the central bank has said so for banks, and the national policy anticipates risk-based law. Companies that build review and evidence into their processes now will meet whatever standard emerges.
The role of consulting and advisory firms
The large accounting firms are in an unusual position here. They sell "responsible AI" and "trusted AI" frameworks, they are developing assurance services over AI systems, and they are heavy users of AI in their own audit and advisory work. Their frameworks are broadly consistent with one another and with NIST, and are worth reading. Their own incidents show that a framework on paper does not ensure review in practice.
An adviser's proper role in this area is to help a company inventory its uses, tier them, design proportionate controls, train reviewers and test that the controls operate. An adviser should also apply the same discipline to its own deliverables and be willing to say how.
Our position: we design and review internal controls, including controls over automated and AI-assisted processes (internal audit), and we set up reporting with tie-outs built in (data analytics and reporting, process automation). In our own work, figures are tied to source and references are checked against primary material before anything leaves the office. We do not perform statutory audits or certify AI systems.
The next 90 days
Days 1 to 30. Ask every member of the finance team, without blame, where they use AI tools. List the uses and assign each a tier. Issue a one-page rule: approved tools, prohibited data, disclosure of use.
Days 31 to 60. For each tier 3 and 4 use, write the control: control total, sample, reviewer, evidence. Introduce the tie-out sheet for the management pack. Train reviewers in reviewing machine output.
Days 61 to 90. Run a seeded-error test. Report the inventory, tiers and test result to the board. Fix what the test exposed and set a quarterly cycle.
Frequently asked questions
Is it acceptable to use AI to prepare financial information?
Yes, with review proportionate to the importance of the output. Nothing in Nepali law prohibits it. Responsibility for the result stays with the company and the people who sign.
Who is responsible if an AI tool makes an error in our accounts or return?
The company and its directors, and the professional who signed. Tools carry no liability, and vendors' terms generally exclude it.
How much checking is enough?
Enough that you would be comfortable explaining it to an auditor or a tax officer. For internal drafts, a read and a tie of key figures. For anything external, verification of every material figure and reference by a competent person.
Can one AI tool check another?
It can help, for example by flagging inconsistencies. It does not replace human review for important outputs, because both tools can share the same blind spots and neither is accountable.
Should staff disclose when they use AI?
Yes. Make disclosure normal and penalty-free. Hidden use is the largest control risk, and the KPMG study suggests it is common.
Do our auditors need to know?
Where automated or AI tools prepare or post information that feeds the financial statements, tell them. They are required to understand the system, and early discussion avoids surprises.
What is the cheapest effective control?
The control total. Agreeing a schedule to the ledger and counting rows takes minutes and catches a large share of errors.
Does this slow everything down?
Less than it seems. The tool saves hours of preparation, and review takes a fraction of that back. The alternative, an error reaching a bank or the tax office, costs far more.
*This article is general guidance, not professional advice. References to regulatory guidelines are based on published reports and should be confirmed against the original documents. The worked example is illustrative.*
