Every control comes down to one question from the auditor: Where’s the evidence? Finance teams know how to answer it for manual reviews and system reports. As AI starts drafting variance explanations and matching journal entries, the answer also has to show how the software reached its result. Internal controls over financial reporting (ICFR) already give teams the structure for that. Scoping, walkthroughs, and deficiency evaluation still apply, and new guidance from COSO shows how to extend each one to AI. In this guide, you’ll learn how ICFR works from scoping to deficiency evaluation, where AI fits in your control framework, and what to document so auditors can trace every AI-assisted output. What Is Internal Control Over Financial Reporting? ICFR is a process that gives reasonable assurance that financial statements are reliable and follow the applicable accounting framework, such as US GAAP or IFRS. AS 2201, the Public Company Accounting Oversight Board (PCAOB) standard for auditing ICFR, defines it as a process that the principal executive and financial officers design or supervise, and that the board, management, and other personnel carry out. The bar is reasonable assurance because every control system has limits. People make mistakes, employees can collude, and management can override controls. Safeguards reduce those risks, but they can’t remove them. Responsibility splits three ways. Management owns ICFR, the audit committee oversees it, and external auditors test it and attest to it where required. Section 404 of the Sarbanes-Oxley Act (SOX) sets those requirements. SOX 404(a) calls for management’s annual assessment of ICFR, and SOX 404(b) calls for auditor attestation on that assessment. Since the Dodd-Frank Act added Section 404(c), non-accelerated filers skip 404(b) but still owe 404(a). How ICFR Works From Scoping to Deficiency Evaluation Scoping runs from materiality to components AS 2201 calls for a top-down approach. Teams start with materiality, identify significant accounts and disclosures, and then pinpoint the assertions at risk, such as existence, completeness, and valuation. Scoping ends with the locations and business units that fall in scope. Process understanding starts with one transaction A walkthrough follows one transaction from initiation to the general ledger. It shows where a misstatement could arise and which controls address that risk. According to AS 2201, walkthroughs usually combine inquiry, observation, inspection of documents, and reperformance of controls. Controls differ in precision Precision decides how much weight a control can carry. Some entity-level controls, like the control environment, shape other controls only indirectly. Others monitor lower-level controls but can’t address a risk on their own. A control can stand alone only when it operates precisely enough to prevent or detect a misstatement in a relevant assertion on time. AS 2201 holds compensating controls to the same bar: precise enough to prevent or detect a misstatement that could be material. Reports and spreadsheets need support A control that relies on a report or spreadsheet inherits that report’s weaknesses. Control owners need to document why the information is relevant and reliable, meaning complete and accurate. AS 1105 holds auditors to the same test for company-produced information. In KPMG’s 2025 study of reported material weaknesses, missing documentation of completeness and accuracy shows up among the financial close problems. IT general controls hold the rest up IT general controls (ITGCs) cover access, change management, and operations. Automated controls and system reports depend on them. One company in the KPMG study reported a material weakness in automated controls and related ITGCs, and it also deemed ineffective the manual controls that depended on those applications. Deficiency evaluation has three tiers Control deficiency: a control’s design or operation can’t prevent or detect misstatements on time Significant deficiency: less severe than a material weakness, but still important enough to merit attention from those who oversee financial reporting Material weakness: a reasonable possibility that controls won’t prevent or detect a material misstatement on time One material weakness means ICFR isn’t effective. Severity depends on two factors: the likelihood that controls fail and the size of the potential misstatement. A deficiency can be severe even if no misstatement occurs, and deficiencies that touch the same account can add up to a material weakness. AS 2201 lets teams judge likelihood without assigning a percentage, so professional judgment makes the call. Why AI Changes the ICFR Conversation AI enters ICFR in two ways. It can act as a control, through anomaly detection on journal entries, automated reconciliations, or evidence collection. It can also create risk for a control, through generative AI in the close or shadow AI, meaning AI use outside formal IT oversight that nobody inventoried. On 23 February 2026, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) released Achieving Effective Internal Control Over Generative AI. The publication builds on COSO’s 2013 framework. It maps AI risks to the same 17 principles and adds a six-step roadmap: govern, inventory, assess, design, implement, and monitor. Deloitte’s summary points to two shifts behind the guidance. Teams move from rule-based technology to probabilistic models with variable outcomes, and from point-in-time assurance to continuous monitoring. Those shifts make Principle 9, on significant change, especially relevant. COSO places changes to a model, its training data, prompts, retrieval connectors, and vendor updates under that principle. Prompts and thresholds count as configuration, so they need the same rigor as any controlled system setting. Where AI Strengthens ICFR Good AI controls also make ICFR stronger. The biggest opportunity is documentation. KPMG’s 2025 study found that for nearly every reported material weakness (98% in FY25), at least one root cause involved missing documentation, policies, or procedures. AI that links each conclusion to its source evidence builds that trail as the work happens. Population-level testing is another opportunity. COSO notes that, when implemented properly, AI can strengthen monitoring, documentation, and validation work that would be impractical to do by hand at scale. In internal audit monitoring, that can mean testing a full population instead of a sample, with exceptions routed to a person. Close and disclosure controls benefit too. Trullion’s Financial Statement Validation checks the math, ties summary tables to footnotes, and flags year-over-year changes and differences between versions, so reviewers start from a verified draft. AI can also ground work in the right guidance. Trullion’s Knowledge Room brings accounting standards, regulations, and a firm’s own methodology into one layer, so agents check work against current guidance and prior conclusions. Through all of it, it is important to remember that judgment stays human. Materiality, deficiency severity, and management’s conclusion on effectiveness belong to people. Build Controls You Can Defend ICFR’s objective stays the same: reliable financial reporting with evidence behind every conclusion. AI adds new sources for that evidence, in the form of model lineage, logs, and named reviewers. Teams that build that trail now walk into fieldwork ready to show auditors how each AI-assisted output came together and who stands behind it. In accounting and audit, every output needs a trail. That’s why, at Trullion, we’ve developed auditable AI that keeps each conclusion traceable, defensible, and owned, so teams can adopt AI with the same confidence they bring to every other control. To learn more, read our article on Why Accounting Needs Auditable AI or talk to our team today. FAQs What is the difference between ICFR and SOX? ICFR is the set of controls and processes that supports reliable financial statements. SOX is the 2002 federal law behind many of its requirements. Section 404 requires management to assess ICFR each year, and 404(b) adds auditor attestation for accelerated and large accelerated filers. SOX also covers other areas, such as Section 302 certifications. What is the difference between a control deficiency, a significant deficiency, and a material weakness? A control deficiency exists when a control’s design or operation can’t prevent or detect misstatements on time. A significant deficiency is less severe than a material weakness, but it merits attention from those who oversee financial reporting. A material weakness creates a reasonable possibility that controls won’t prevent or detect a material misstatement on time. Severity depends on likelihood and magnitude, and deficiencies that affect the same account can combine. Who is responsible for internal control over financial reporting? Management owns it. The principal executive and financial officers design or supervise ICFR, and the board, management, and other personnel carry it out. The audit committee oversees financial reporting and internal control. External auditors test ICFR and, where SOX 404(b) applies, attest to management’s assessment. Do private companies need ICFR? SOX 404 applies to SEC registrants, so private companies don’t have to comply. Many build ICFR anyway. BDO notes that private equity buyers, investors, and banks look for strong controls, and that early work gives companies practice before an IPO.