AI Agents for
Control Validation
Designed, documented and operating are three different claims, and most testing answers only the first two.
- Whether a control is designed, documented, or actually operated on every transaction are three separate claims, and only the third protects anything.
- Whether a control can be bypassed is almost never tested, and it is where losses happen.
- A control test examines items that went through the process, so it cannot see an item that never entered it.
- A payment made outside the payment run, or a vendor created and paid the same day, is made of individually legitimate steps. The sequence is the signal.
- Evidence preparation is retrieval and assembly rather than judgement, which is why automating it does not touch auditor independence.
AI agents for control validation test whether a control operated on every transaction in the period, look for the transactions that bypassed it entirely, and assemble audit evidence with its support attached. ChatFin tests for absence and sequence rather than only for correctness.
The gap in most control frameworks is not the design. It is that testing examines items which went through a process and confirms they were handled properly, which by construction cannot see the manual payment made outside the run or the approval given by the person who raised the request. ChatFin looks for what avoided the control.
Designed, documented and operating are three different claims
Control frameworks conflate three separate questions, and most control testing answers only the first two. Whether a control was designed sensibly, whether it is written down, and whether it actually operated on every transaction in the period are genuinely different things, and only the third protects anything.
| Claim | How it is usually evidenced | What it proves |
|---|---|---|
| The control is designed | A narrative or flowchart | Somebody thought about it |
| The control is documented | A procedure document | It is written down |
| The control operated | A sample of approvals | It worked on those items |
| The control operated always | Rarely tested at all | Nothing, it is assumed |
| The control cannot be bypassed | Almost never tested | Nothing |
The bottom two rows are where losses happen and they are the two nobody evidences. ChatFin tests operation across the whole period and, more usefully, looks for the transactions that went around the control rather than through it.
ChatFin tests whether a control operated on every transaction and looks for the ones that bypassed it, which is the question a sample of approvals cannot answer.
The interesting transactions are the ones that avoided the control
Control testing looks at items that went through a process and checks they were handled correctly. That design cannot see an item that never entered the process.
Every one of those is a normal looking transaction. None of them appears in a sample of items that went through the control, because they did not. ChatFin tests for absence and sequence rather than only for correctness.
ChatFin tests for absence and sequence, which is how a payment made outside the payment run or a vendor created and paid the same day becomes visible.
Evidence preparation is most of the cost of an audit
The expensive part of an external audit is rarely the auditor's thinking. It is finance assembling what the auditor asked for, in the format they asked for, twice, because the first version was not quite it.
| Request | Why it takes days | What removes the delay |
|---|---|---|
| A sample of fifty invoices | Retrieved one at a time | Bulk retrieval by criteria |
| Support for a journal | Attachments across systems | Assembled at posting |
| A reconciliation as at a date | Rebuilt retrospectively | Snapshotted when prepared |
| Approval evidence | Screenshots from workflow | Exported as a record |
| An explanation of a movement | Written from scratch | Drafted from the ledger |
Every row is retrieval and assembly rather than judgement, which is why it is worth automating and why doing so does not reduce the auditor's independence at all. ChatFin assembles the requested population with its support attached and reports what it could not find, which is itself a finding.
ChatFin assembles audit requests with the support attached and reports what it could not find, because a missing document is a finding rather than a gap in the pack.
Where this underperforms
Three.
Deeper in control validation
The use cases this hub covers.
Worked on this page
Audit evidence preparation · Exception identification · Control validation
Covered as sections here
Designed versus operating · Bypass detection · Sequence testing · Evidence assembly
Questions heads of audit ask first
What is the difference between a control being documented and operating?
A documented control is written down. An operating control was applied to every transaction it should have been applied to. A sample of approvals proves the control worked on those items and says nothing about the rest, and it says nothing at all about items that never entered the process. ChatFin tests the whole period and looks for bypasses.
How do you test for a control being bypassed?
By testing for absence and for sequence rather than for correctness. A payment outside the payment run, a journal posted directly to a subledger controlled account, an invoice paid with no purchase order in a category that mandates one. Each looks normal on its own. ChatFin identifies them by what is missing and by the order things happened.
Does automating audit evidence compromise independence?
No, because the work being automated is retrieval and assembly rather than judgement. Pulling fifty invoices by criteria, attaching support to a journal, or exporting approval records does not touch what the auditor concludes. ChatFin also reports what it could not find, which is itself a finding rather than a gap in the pack.
Look for what went around the control.
ChatFin tests whether a control operated across the whole period, and separately tests for the transactions that never entered the process at all.
Audit evidence is assembled with support attached, and anything that could not be found is reported as a finding.
Bring twelve months of payments. The bypass query runs in minutes.
Book a demoAll images are served from the Pexels content network. No third party product screenshots, vendor logos or licensed media are used on this page.
Bring twelve months of payments.
We will look through ChatFin for the ones made outside your payment run and show you which controls were bypassed rather than failed.