AI for Financial
Controls
Frameworks record whether a control operated. They rarely record whether it could have caught anything.
- Control frameworks test whether a control operated. Whether it was capable of catching what it was written for is a design question and almost never tested.
- Any control with a number in it changes behaviour around that number. Bunching just under an approval threshold is the most detectable design weakness there is.
- Segregation of duties breaks through combinations rather than roles, and the common conflict spans two systems, so a single system access review cannot see it.
- Continuous monitoring is abandoned when it raises more exceptions than anyone can work. That is a design outcome, not a discipline problem.
- Measuring your own controls is management activity. It does not replace the independent test that internal audit performs.
AI agents for financial controls test design, not just operation. ChatFin measures the behaviour around a control rather than the existence of its record, because a control that ran every month and never caught anything is a finding rather than a clean result.
That means plotting the value distribution around every approval threshold, evaluating effective access across systems rather than roles within one, and reordering exceptions by what they have actually caught on your own data. Independent verification of the result remains internal audit's job and ChatFin does not substitute for it.
A control that runs is not a control that works
Control frameworks record whether a control operated. They rarely record whether it was capable of catching the thing it was written for. Those are different questions and only the second one matters when something goes wrong. ChatFin is pointed at the second.
| The control says | What gets tested | What is never tested |
|---|---|---|
| Invoices over 10k approved | That approval happened | Whether 9,999 is now common |
| Bank details verified | That a check was recorded | Whether the caller was verified |
| Journals reviewed | That a reviewer signed | Whether the review took ten seconds |
| Duplicates blocked | That the rule ran | What shape of duplicate it misses |
| Access reviewed quarterly | That the review happened | Whether anything was revoked |
Every right hand column is a design question and every one of them is answerable from data nobody looks at. ChatFin measures the behaviour around a control rather than the existence of the control record, which is what separates a control that operates from a control that works. Independent verification of the result is a separate function, covered on AI for compliance and internal audit.
ChatFin measures the behaviour around a control, not the existence of its record, because a control that operated and caught nothing is still a finding.
Threshold controls teach people where the threshold is
Any control with a number in it changes behaviour around that number. This is not fraud in most cases, it is people routing around friction, and it is the single most detectable control design weakness there is.
ChatFin plots the value distribution around every threshold control and reports the bunching ratio, which turns an argument about whether people game the limit into a chart. Where splitting is present it returns the vendor and date pairs rather than the count.
ChatFin plots the value distribution around each threshold and reports the bunching ratio, so gaming the limit becomes a measurement rather than an argument.
Segregation of duties breaks through combinations, not through roles
Access reviews look at roles. Conflicts live in combinations, and a person accumulates combinations over a career through cover arrangements, project access and promotions where the old access was never removed.
| Combination | Why it is a conflict | How it accumulates |
|---|---|---|
| Create vendor and approve invoice | A payee you invented | Covered AP over a holiday |
| Post journal and review journal | Self review | A small team, then it stayed |
| Change bank details and release payment | A redirected payment | Two roles, one leaver |
| Maintain price and approve credit | An unearned credit note | Moved from sales to finance |
| Grant access and hold access | Self provisioning | An admin role from an old project |
ChatFin evaluates effective access across systems rather than roles within one, because the common conflict is one permission in the ERP and one in the banking platform, and no single system review sees both. It also reports how long a conflict has existed, which is usually the number that gets it fixed.
Most control frameworks are too big to operate honestly
Frameworks grow. A control gets added after every incident and almost none are ever retired, so a mid sized company ends up with several hundred controls and the capacity to genuinely perform perhaps a third of them. The rest get signed.
| Symptom | What it means | What to do |
|---|---|---|
| Two controls, one risk | One of them is redundant | Retire the weaker |
| A control with no owner | Nobody performs it | Assign or remove it |
| Never once failed | It cannot fail as written | Redesign or retire |
| Performed the same day monthly | Batched at period end | Test whether it can be |
| Evidence is a screenshot | It proves the screen, not the check | Change the evidence |
The row that matters is the third. A control that has never produced an exception in four years is either protecting against something that never happens or is written so it cannot detect anything. Both are worth knowing and neither shows up in a framework that reports pass rates.
ChatFin reports the exception history of every control alongside its status, so the conversation becomes which controls to retire rather than how to find time for all of them. A smaller framework performed properly is stronger than a large one signed off.
ChatFin reports the exception history of each control next to its pass rate, which turns framework growth into a retirement decision.
Continuous monitoring only works if somebody can act on it
Continuous control monitoring is easy to sell and easy to abandon, and it is abandoned for one reason: it produces more exceptions than anyone can work. Design decides whether that happens.
Rank by what it has cost
An exception type that has never once turned out to be a real problem should stop being raised. ChatFin tracks the outcome of every exception and reorders the list by hit rate on your own data, not by an abstract severity score.
Route to a person, not a queue
Named owner, with the evidence attached and the reason it was flagged. An exception in a shared inbox is a report nobody reads.
Separate the gap from the anomaly
A missing approval is a fact. An unusual pattern is a judgement. They need different responses and mixing them makes the whole list feel optional.
Close the loop
Record the decision and what it was based on. The audit question is never whether the monitoring ran, it is whether anybody acted on it.
ChatFin does those four by default. The measure of a monitoring programme is not how many exceptions it raises, it is what proportion get worked, and that ratio is a design outcome rather than a discipline problem.
ChatFin reorders exceptions by hit rate on your own history, so a control that has never caught anything stops consuming attention.
Where this underperforms
Three.
Across the controls cluster
Design and operation here. Independent verification sits with audit.
Hubs under this pillar
Controls monitoring and fraud detection · Policy compliance and control validation · Payables fraud detection
Covered as sections here
Control design testing · Threshold bunching and splitting · Segregation of duties across systems · Continuous control monitoring · Exception routing and ownership
Independent verification
Compliance and internal audit · Audit testing · Audit evidence
Neighbouring functions
Accounts payable · Expense management
Questions controllers ask about controls
How is this different from internal audit?
Controls is design and operation and it belongs to the controller. Audit is independent verification after the fact and it belongs to internal audit. ChatFin measuring your own controls is management activity, and it does not become assurance because software produced the measurement.
What does threshold bunching tell you?
That people know where the limit is. A distribution of invoice values spiking just below an approval threshold, or one purchase arriving as two same day invoices from one vendor, are both visible in the data. ChatFin reports the bunching ratio and returns the vendor and date pairs where splitting is present.
Why does our access review miss conflicts?
Because it looks at roles inside one system, and the common conflict is one permission in the ERP and one in the banking platform. Being able to change a vendor bank detail in one place and release a payment run in another is a conflict no single system review sees. ChatFin evaluates effective access across systems and reports how long the conflict has existed.
Why do monitoring programmes get abandoned?
Because they raise more exceptions than anyone can work, and the list stops being read. ChatFin tracks the outcome of every exception and reorders by hit rate on your own history, separates a missing approval from an unusual pattern, and routes each one to a named person with the evidence attached.
Test the design, not just the operation.
ChatFin plots the value distribution around every threshold control, reports the bunching ratio and returns the splitting pairs rather than a count.
It evaluates effective access across systems rather than roles within one, and reorders exceptions by what they have actually caught on your own data.
Bring your three largest approval thresholds.
Book a demoSection photograph: a hand holding a pen pointing at a printed bar chart, sourced from Pexels and used under the Pexels licence.
Section photograph: a boardroom of people watching a presenter at a whiteboard, sourced from Pexels and used under the Pexels licence.
All images are served from the Pexels content network. No third party product screenshots, vendor logos or licensed media are used on this page.
Bring your three largest approval thresholds.
We will plot the value distribution around each one through ChatFin and show you whether people are working around the limit.