Finance Is Deploying AI Agents Faster Than It Can Govern Them

Finance spent years building controls around people.

A preparer enters a journal. A reviewer approves it. A buyer requests a purchase. An authorized manager releases it. A tax professional signs off on a filing position.

AI agents complicate that model because software is beginning to occupy the space between recommendation and action.

That is no longer theoretical.

A 2026 Censuswide survey commissioned by Avalara covered more than 1,500 CFOs and senior finance leaders in the United States, United Kingdom, India and Australia who had deployed, piloted or actively evaluated AI agents in financial processes during the prior year.

The results describe a governance system under pressure.

92% of respondents reported moderate or significant career pressure to demonstrate ROI from AI-agent investments. 71% said deployment pressure is focused primarily on speed. Only 7% said their organization prioritizes governance over speed.

And 30% had not updated internal controls within the previous year to reflect agents taking or recommending actions.

Finance has spent decades insisting that systems change should trigger control change.

Agentic AI is testing whether it follows its own rule.

The problem is not that agents are intelligent

The governance challenge is easier to understand if the word “AI” is temporarily removed.

Imagine finance hires a new worker.

The worker can read invoices, inspect ERP records, draft decisions, call software tools and sometimes execute actions. It can work continuously and operate across thousands of transactions.

Before granting access, finance would ask basic questions.

Who manages this worker? Which systems can it access? Which actions require approval? How is its work reviewed? What evidence does it leave? What happens when it makes a mistake?

Those questions do not become less important because the worker is software.

They become more important because the software can scale.

Speed is winning the budget conversation

The Avalara research is vendor-sponsored and its respondents were specifically organizations with recent agentic-AI activity, so it should not be treated as a census of all finance functions.

Within that population, however, the tension is stark.

Half of respondents said they face significant career pressure to demonstrate ROI; another 42% reported moderate pressure. Half said their initiatives had produced only limited measurable ROI so far.

That creates a dangerous incentive.

Finance leaders are being asked to show value before the operating model for safe deployment is mature.

The result can be a portfolio of pilots optimized for visibility rather than control.

An agent that drafts an analysis is relatively easy to pilot. An agent that updates master data, recommends tax treatment or initiates a payment requires a different standard.

The word “agent” covers both.

Governance has to distinguish them.

Autonomy needs a tiering system

The simplest useful control is to classify agents by what they are allowed to do.

1. 01Observe — The agent reads approved data and summarizes or analyzes it.
2. 02Recommend — The agent proposes an action but cannot execute it.
3. 03Prepare — The agent creates a transaction, journal, workflow or communication for human approval.
4. 04Execute within policy — The agent can take defined actions under thresholds and rules.
5. 05Orchestrate — The agent coordinates other agents or systems across a process.

The higher the tier, the stronger the identity, authorization, monitoring and evidence requirements should become.

This is an editorial framework, not a regulatory standard.

But finance needs something like it because a generic “human in the loop” policy is too vague.

A human who receives 5,000 agent-generated approvals is not meaningfully in the loop.

The audit-evidence gap is already visible

Forty-four percent of Avalara respondents said they were only somewhat confident they could explain an AI agent’s actions to an auditor or regulator.

That should concern controllers.

Traditional finance controls rely heavily on evidence: who approved, what changed, which source supported the decision, what policy applied and when the action occurred.

Agentic workflows can make that lineage harder.

An output may depend on a model, prompt, retrieved document, ERP field, external data source and tool call. The model may later change. The prompt may be updated. A connected tool may return different information.

A simple chat transcript is not enough.

Finance needs transaction-grade evidence.

For a material agent action, the record should identify the agent, version or configuration, initiating user or workflow, data sources, tools invoked, recommendation, human approval where required, final action and exception path.

If the company cannot reconstruct the action, it cannot claim the action is controlled.

Segregation of duties gets stranger when software has multiple roles

Consider an AP agent.

It reads an invoice, identifies the supplier, checks a purchase order, recommends coding, prepares a posting and proposes payment.

In a human process, those activities may be deliberately separated.

If one agent performs all of them, has segregation of duties been collapsed?

Not necessarily.

The control can be implemented through tool permissions and approval gates rather than separate people. One agent identity might be permitted to prepare a posting but prohibited from releasing payment. Another service may enforce the approval.

But the architecture has to be explicit.

Finance cannot assume existing role design automatically applies when the actor is an agent operating through APIs.

The permissions review should happen at the tool level.

“Human oversight” can become control theater

Finance software vendors frequently promise human oversight.

The phrase sounds reassuring and says very little.

Where exactly does the human intervene?

Before the agent accesses sensitive data? Before it recommends a journal? Before the journal posts? Only when a confidence score falls below a threshold? After the transaction is already executed?

Oversight that occurs after an irreversible action is monitoring, not approval.

Oversight that requires a reviewer to rubber-stamp hundreds of routine recommendations may be technically human but operationally meaningless.

Controllers should define the purpose of the human step.

Is the reviewer validating accounting judgment? Confirming identity? Approving a policy exception? Checking source evidence?

If the organization cannot state what judgment the human contributes, the control should be redesigned.

Finance needs an agent register

Most companies maintain inventories of applications, bank accounts, privileged users and key controls.

Agents deserve the same treatment.

A finance agent register should contain the business owner, technical owner, use case, autonomy tier, systems accessed, data classification, tools permitted, model/provider, approval requirements, monitoring metrics, materiality threshold and current production status.

This sounds administrative.

It is foundational.

Without an inventory, the CFO cannot answer how many agents can touch financial data, which can act, which are experimental and which have been retired.

Agent sprawl can become the next spreadsheet sprawl—except the spreadsheet usually does not call an API and change the ERP.

ROI measurement must include control cost

One reason governance gets pushed behind deployment is that AI business cases often measure only gross benefit.

Hours saved. Faster cycle. Lower headcount need. More transactions processed.

A finance-grade ROI calculation should include the cost of making the agent safe.

That means testing, monitoring, exception handling, audit evidence, security review, model changes, human approval and incident response.

Those costs do not invalidate the use case.

They reveal which use cases are actually economical.

An agent that saves 500 hours but creates 400 hours of review is not a breakthrough.

An agent that saves 500 hours while producing better evidence and reducing exceptions might be.

The controller is becoming an AI operating-model owner

CIOs and data teams will own much of the technical infrastructure.

Finance still owns the financial consequence.

That gives controllers a larger role than they had in the first generation of enterprise AI pilots.

They understand materiality, evidence, authorization, segregation of duties and exception management. Those concepts map directly onto agent governance.

The controller should therefore be involved before an agent enters production, not asked to document the control after launch.

This is especially important for close, tax, AP, AR and treasury processes where an agent can affect recorded results or cash.

Governance can accelerate deployment

There is a temptation to frame all of this as a reason to slow down.

That misses the point.

A reusable governance model can make deployment faster.

If the company has autonomy tiers, standard agent identities, approved tool patterns, evidence requirements and predefined human-approval rules, every project does not need to reinvent the risk framework.

Controls become a platform.

That is the same lesson finance learned from cloud security, ERP roles and payment authorization.

Standardization creates speed.

The next internal-control framework needs software actors

The core finance control model was built around accountable people operating systems.

The emerging model includes people, deterministic workflows and probabilistic agents operating together.

That requires a different vocabulary.

Who initiated the action? Which software actor interpreted the request? Which tools did it call? What authority did it have? Which human judgment remained? What evidence proves the path?

Those are internal-control questions, not AI-ethics abstractions.

The companies that answer them well will not necessarily deploy fewer agents.

They may be able to deploy more.

The objective is not to keep humans clicking every button.

It is to make sure that when the button disappears, accountability does not disappear with it.

The core survey was commissioned by Avalara, which sells tax and compliance automation, and sampled finance leaders with recent agentic-AI activity; its results are not generalized to all finance organizations. The five-tier autonomy ladder is a The Finance Observer editorial framework, not benchmark data or a regulatory standard. No information published after September 6, 2026 is used and no quotes are invented.