Latest / Fintech Conversations with Fexingo: Banking, Payments, and Financial Software Companies / How AI Auditors Rewire Financial Controls
Transcript
- Lucas: If these conversations are useful for what you're building or running, know that we don't run ads here. A small group of listeners chips in monthly through buy me a coffee dot com slash fexingo, and that's literally what funds making this many of these shows possible. Luna: Right, so if you want to keep the lights on and the audio crisp, that link is up top. Let's get into it. Lucas: For decades, the standard model for financial control was retrospective. You spent twelve months collecting receipts, reconciling ledgers, and then, maybe six weeks after the quarter closed, an auditor would come in with a sampling methodology to check if you had done it right. It was a system built on trust, verified by suspicion, but executed long after the fact. Luna: And now we're seeing those checks happen in milliseconds, not months. Is the shift really about speed, or is it about preventing the error before it hits the ledger? Lucas: It's both, but the real story is the move from sampling to full population testing. Traditional audits rely on statistical samples because checking every single transaction is too expensive. But when you deploy AI agents that sit inside your accounts payable workflow, they can evaluate one hundred percent of transactions against a set of predefined rules in real time. If a vendor code doesn't match an approved master list, the payment doesn't go out. Period. Luna: That sounds like a firewall, but how do you handle the exceptions? If the AI blocks everything that doesn't fit the rule, you end up with a lot of false positives clogging up the approval queue. Lucas: You hit on the exact friction point. Early versions of this technology were rigid, basically creating a bureaucratic bottleneck where legitimate invoices got stuck behind algorithmic caution. The newer generation uses natural language processing to understand context. So if a procurement manager approves a $50,000 emergency repair outside the normal range, the agent logs the justification, checks the manager's authority level, and allows the flow, but flags it for a secondary review if it exceeds historical norms for that department. Luna: So it's less about saying no and more about tagging risk levels. Does that change the job description for internal auditors? Lucas: Massively. The role is shifting from checker to configurator. Instead of spending their time verifying that a receipt matches an invoice, auditors are now defining the logic trees that the AI follows. They're setting the parameters for what constitutes a 'high-risk' vendor or an 'unusual' payment pattern. It requires a much deeper understanding of business process than just knowing GAAP standards. Luna: But isn't there a danger in handing over too much autonomy to a black box? If the AI misses a novel fraud scheme, who owns the liability? Lucas: That is the million-dollar question, quite literally. The industry consensus right now is that human oversight remains non-negotiable for high-value transactions. The AI handles the volume; the humans handle the nuance. But the problem is that as the AI gets better at catching the obvious stuff, the remaining exceptions become rarer and harder to spot. Auditors might start trusting the system too much, leading to complacency in reviewing those final ten percent of flagged items. Luna: Exactly. It's the automation bias problem. If the machine says green ninety-nine percent of the time, we stop looking for the red flag in that last one percent. Lucas: Precisely. And this brings us to the regulatory side. The Securities and Exchange Commission has been clear that relying on automated controls doesn't absolve management of responsibility. You still have to validate that the controls are operating effectively. But validating an AI agent is harder than validating a spreadsheet. You can't just glance at a cell; you have to interrogate the model's training data and its decision boundary. Luna: So the audit trail itself changes. It's not just a record of what happened, but a log of why the algorithm made a decision. How transparent are these systems being forced to be? Lucas: Transparency is becoming a feature, not just a bug. Leading fintech providers are now offering explainable AI dashboards. When an agent blocks a payment, it doesn't just say 'rejected.' It says 'rejected because vendor tax ID mismatch detected in third-party database.' This level of granularity gives auditors the evidence they need to prove control effectiveness without having to reverse-engineer the code. Luna: That makes sense. But does this create a barrier to entry for smaller companies? Implementing this kind of infrastructure must be pricey. Lucas: It used to be, but cloud-based solutions have democratized access. A mid-market company can now subscribe to an ai driven compliance module for a fraction of the cost of hiring two additional junior auditors. The economics are compelling. You're trading fixed headcount costs for variable software costs, which scales with revenue rather than growing linearly with complexity. Luna: I wonder if this will lead to a standardization of fraud patterns. If everyone uses similar AI models, won't bad actors just learn to game the same algorithms? Lucas: That's a valid concern. Adversarial attacks are real. If a fraudster knows that your AI looks for specific keyword combinations in email subjects, they'll simply change the wording. The arms race between attackers and defenders is accelerating. The firms that win aren't necessarily the ones with the most complex AI, but the ones with the fastest feedback loops to update their rulesets when a new threat emerges. Luna: So agility matters more than raw power. It's about how quickly you can pivot the logic when the landscape shifts. Lucas: Correct. And this agility extends to regulatory changes. When a new anti-money laundering rule drops, manual processes take months to implement across global offices. An ai driven system can often be updated centrally and deployed globally in days. That speed is a competitive advantage in maintaining compliance across multiple jurisdictions. Luna: Let's talk about the data quality issue for a second. Garbage in, garbage out. If your underlying ERP data is messy, the AI is just going to automate the mess faster. Lucas: Absolutely. This is why the implementation phase is so critical. You can't just bolt AI on top of a broken process. You have to clean the data first. Many organizations underestimate this step. They expect the AI to fix structural issues in their chart of accounts or vendor master files. It won't. It will only enforce the rules you give it on the data you provide. If the input is flawed, the output is confidently wrong. Luna: Confidently wrong. That's the phrase I'll remember. It's dangerous because it sounds authoritative. How do you train finance teams to spot when the AI is confident but incorrect? Lucas: By encouraging skepticism. The best programs I've seen involve regular 'audit simulations' where teams intentionally introduce errors to see if the AI catches them. It keeps the human operators engaged and reminds them that the tool is a assistant, not an oracle. It reinforces the idea that they are still ultimately responsible for the integrity of the financial statements. Luna: Do you think this will eventually replace traditional external auditing altogether? Or will it just change what external auditors focus on? Lucas: I don't think it will replace them entirely, at least not in the near term. External auditors provide a legal shield and a stamp of credibility that investors demand. But their role will shrink significantly. They will move from substantive testing to assessing the design and operating effectiveness of the internal AI controls. They'll be auditing the auditors, essentially. Verifying that the logic trees are sound and that the override protocols are robust. Luna: It feels like we're moving toward a world where the primary audit happens inside the company, continuously. The external part becomes a verification of that internal process. Lucas: Yes, continuous assurance is the endgame. Instead of a snapshot once a year, you have a live feed of compliance health. Investors could potentially access real-time dashboards showing control metrics, though regulatory frameworks are lagging behind this technological capability. We're likely five to ten years away from mainstream adoption of real-time public reporting based on these AI systems. Luna: Five to ten years is a long time in tech. What's the biggest hurdle stopping that adoption today? Is it regulation or just investor appetite? Lucas: It's mostly liability. Who is on the hook if the real-time dashboard is wrong? Companies are hesitant to expose themselves to that level of transparency until the legal precedents are clearer. Until there's case law establishing that an ai generated control report is legally sufficient, most CFOs will stick to the conservative, annual cycle. Fear of litigation outweighs the benefit of efficiency. Luna: So the innovators are leading, but the followers are waiting for safety. That's a classic enterprise software adoption curve. Lucas: Exactly. And this dynamic plays out in other areas of fintech too. The early adopters gain a cost advantage and better risk visibility, which pressures the laggards to catch up. Eventually, the market moves so fast that staying manual becomes a competitive disadvantage, forcing the reluctant players to adopt. Luna: We saw that with mobile payments. At first, it felt optional. Now, not accepting mobile payments is weird. Maybe continuous AI auditing becomes similarly mandatory. Lucas: I think it will. Because the volume of transactions is only going to increase. Manual checks simply cannot scale to meet the throughput of modern e-commerce and digital banking. The math forces the transition, regardless of how uncomfortable it makes the traditionalists feel. Luna: So the question isn't if it will happen, but how badly it will hurt during the transition for those who delay. Lucas: Right. And the pain points will be around talent. Finance departments are short on people who understand both accounting principles and machine learning logic. Bridging that skills gap is probably the hardest operational challenge for the next few years. Luna: Upskilling the existing workforce versus hiring new blood. Which path are most companies taking? Lucas: A mix of both. They're bringing in data scientists to build the tools, but they're also sending accountants to boot camps to learn how to interpret the outputs. The ideal profile is emerging: the hybrid finance technologist. Someone who can speak the language of the ledger and the language of the algorithm. Luna: That's a rare breed. Are universities even teaching that combination yet? Lucas: They're trying, but curriculum development lags behind industry needs. Most programs are still siloed. You study accounting or you study computer science, rarely both. This is going to drive a premium on experienced hires who have self-taught this intersection. For now, that talent is scarce and expensive. Luna: Expensive talent for expensive problems. It seems like the ROI on AI auditing is clear, but the execution risk is high. Lucas: High, but manageable if you take it step by step. Start with expense reports. Move to vendor payments. Then tackle more complex areas like revenue recognition. Don't try to boil the ocean. Prove value in low-risk areas first, then expand the scope as confidence grows. Luna: Pragmatic implementation. Avoiding the hype cycle. It's always good to hear a grounded perspective on these transformative technologies. Lucas: Transformation is noisy. Execution is quiet. The companies that succeed are the ones focusing on the quiet parts: data hygiene, user training, and iterative improvement. The flashy announcements are easy; the boring work is hard. Luna: The boring work is where the real control lies. I suppose that's fitting for an episode about financial controls. Lucas: It is. And as we look ahead, the integration of these systems with broader ESG reporting is another frontier. Imagine AI agents automatically verifying carbon credit purchases alongside financial transactions. The connectivity potential is vast. Luna: One unified system for all compliance. That's the holy grail. Do you think we'll ever see a single platform that handles all regulatory reporting? Lucas: Eventually, perhaps. But fragmentation might persist due to jurisdictional differences. Different countries have different data residency laws and reporting formats. A global solution will likely be a federation of local nodes rather than one monolithic platform. Luna: Federated intelligence. That sounds like the future of distributed governance. Interesting angle to leave us with. Lucas: It is. As long as the data stays secure and the logic remains transparent, we're moving toward a more resilient financial infrastructure. The question is whether we build it carefully enough to withstand the shocks of tomorrow.