This month a software company asked more than 1,500 finance leaders a question I would have liked to ask them myself. Could you explain what one of your AI agents did to an auditor or a regulator? Forty-four percent said they were only somewhat confident they could.

Sit with that as an auditor for a second. Nearly half the finance leaders who have already put agents into their financial processes are telling a survey, in advance, that if I walked in and asked them to account for what one of those agents did, they are not sure they could answer.

That is a potential indicator they handed me before I opened the audit.

What the survey actually says

The report is Avalara’s “Agents of Change,” and it went to more than 1,500 CFOs and senior finance leaders across the US, UK, India and Australia, all of whom have already deployed, piloted, or seriously evaluated AI agents inside financial processes. This is not a survey of the AI-curious. It is a survey of people who have already wired agents into how the numbers get produced.

The headline numbers are worth reading slowly. Ninety-two percent of them feel career pressure to show the agent investment is paying off, and half call that pressure significant. Only 7% say their organization puts governance ahead of speed. Thirty percent have not touched their internal controls in the past year to reflect agents that now take or recommend actions. And then the one I keep coming back to, the 44% who are not confident they could explain an agent’s action to an auditor.

Put those four numbers in a line and a story falls out of them. The pressure is to ship. Governance is what slows shipping down. So governance loses, controls sit untouched, and the people running the show quietly know they cannot fully account for what the agents are doing.

This is not neglect, and that matters

The reflex, when we see a control gap this wide, is to write it up as an oversight. Someone forgot to update the control matrix. Fix the documentation, retest next year, close the finding.

I do not think that reading survives contact with the data. When 92% feel career pressure to prove ROI and 7% prioritize governance over speed, you are not looking at people who forgot. You are looking at people who made a choice, and a fairly rational one given what they are measured on. Speed is rewarded now, in the room, by the board asking where the return is. Governance is rewarded later, maybe, if something goes wrong and it turns out you had your house in order.

That asymmetry is the actual root cause, and it changes how you audit this. A control gap caused by an incentive does not stay closed because you recommended a control. You can hand the finance team a well-built agent-governance framework and watch it erode again by the next quarter, because the thing that produced the gap, the pressure to ship over the pressure to explain, is still sitting there untouched.

The mechanics were the easy part

I have written about the technical side of this twice already. A few weeks ago I argued you should be able to produce a list of every AI agent in your systems, because most functions cannot. And after the computer-use models shipped, I wrote about how an agent operating through a human’s session breaks the audit trail, because the log records the person, not the model.

Both of those are real, and both are, in principle, fixable. You can build an inventory. You can add agent identifiers to the log. The tooling is early but it is coming.

What this survey shows is the reason those gaps keep reopening. It is not that the mechanics are hard. It is that nobody deploying agents into a close process under ROI pressure has a reason to slow down and fix them. The inventory and the audit trail are exactly the kind of work that gets deferred when speed is the thing being scored.

And the capability keeps compounding

None of this is happening in a steady state. On July 24, Anthropic released Claude Opus 5, which went straight to the top of the independent intelligence rankings at roughly half the price of the model it replaced. OpenAI’s new GPT-5.6 family launched in the same window, also cheaper. Every few weeks the agents get more capable and the cost of running them drops.

That is the fuel under the survey. Cheaper, more capable agents mean more pressure to deploy more of them, faster. The governance gap does not hold steady while you catch up. It widens by default, because the deployment side gets a tailwind every month and the control side gets a survey that says 7%.

The part that is ours

Here is why I think internal audit is better placed on this than almost anyone. The survey named us. Forty-four percent of finance leaders told a pollster they are not confident they could explain their agents to an auditor. That is not a risk we have to go hunting for. It is a pre-declared exposure, published, with a percentage attached.

And the test that surfaces it is a question we already know how to ask. Not “is there a policy.” Show me one agent-driven transaction, and walk me through what the agent did, from the evidence alone. That is the oldest move we have. It just points at a new actor now.

What I would do this quarter

I am wary of turning this into a checklist, because the real work is judgment. But if I were scoping it, I would start here.

  • Ask for one worked example, not a policy. Pick a single process where agents already operate, and ask finance to reconstruct one agent-driven transaction end to end from the evidence. Their ability or inability to do it tells you more than any control-design review will.
  • Audit the incentive, not only the control. Find out who owns the return on the agent program and who owns its governance. If they are the same people, or if governance reports into the function being measured on speed, that structure warrants examination in its own right. Treat it as a potential root cause, not a housekeeping item.
  • Put an “explain it to a regulator” gate before go-live. For any agent touching a high-risk financial process, make the ability to reconstruct its actions a precondition for turning it on, not a thing you check afterward.
  • Escalate the pattern, not the instance. If the cause is an incentive, the audit committee is the right audience, because they are the only people who can change what finance leaders are measured on. A single control finding to a process owner will not move a company-wide asymmetry.

So here is the question I would carry into next week. If you asked your CFO to walk you through one agent-driven transaction, start to finish, using only what is in the evidence, could they do it? And if the answer is no, is the real problem the log, or the fact that until you asked, no one in the building was ever expected to be able to?

If you are working out how to bring agent-driven financial processes into your audit plan, I would like to hear how you are approaching it. Get in touch.

Sources and further reading: