AI agents for finance: which tasks to hand over, and which to keep

AI agents for finance do not remove professional judgement or sign-off; they change where in the workflow that judgement is exercised.

Day one of close, and the bank reconciliation is stuck on a few dozen unmatched lines. Hand an AI agent the finance tasks whose output can be checked against a record you already trust and reversed before money moves; keep payment release, supplier changes, and material or judgemental journals with a named approver. This guide helps CFOs, controllers, and finance operations managers in UK and EU SMEs make that split task by task, with the permissions, thresholds, and audit trails that make it safe.

Key takeaways

• Hand agents the tasks with a trusted source to check against: document capture, matching within tolerance, routine reconciliations, first-pass forecasts, and anomaly flags.

• Keep payment release, supplier master changes, material or judgemental journals, and tax positions under a named human approver.

• Give an agent the same permission scope as the person it acts for, never more, and keep it off administrator roles.

• Set review thresholds by value and reversibility, and log every agent action next to who approved it.

• Treat any figure the agent cannot trace to a source record as a draft, not a number anyone can post.

What an AI agent is in finance (and how it differs from RPA, a chatbot, and an assistant)

An AI agent is software that reads its environment (perceives) and reasons about a goal. It then takes actions in other systems, choosing which steps to take and in what order.

The useful distinction is who decides the next step:

Rules-based automation (RPA): A person defines every step in advance. The bot re-keys the same invoice fields in the same order and stops when the layout changes.

AI assistant: You ask, it answers. “Which supplier invoices are more than 30 days overdue?” returns a list from your data, but the assistant does not act on it.

AI agent: The agent checks each overdue invoice against its purchase order and goods received note, codes the matches, drafts queries for the mismatches, and routes exceptions to their owners.

An assistant can be wrong and cost you a minute; an agent can be wrong and cost you a posted journal or a sent email. Definitions vary between bodies, so when a vendor says agent, ask which decisions the software takes without a prompt.

Which finance tasks you can hand to an agent, and which to keep

Agents can run the preparation in every finance workflow; approval stays human for judgement calls and actions that are hard to reverse or affect a person. Here is how that split works in practice for each workflow:

Accounts payable gets its own treatment in the AI in accounts payable guide. Across every row, the agent does the work that has a reference record (a purchase order, a bank line, a budget) and surfaces what does not fit. Payment release and fraud decisions are where the human column is widest.

Framed as internal controls finance already runs, the autonomy ladder separates preparation from authority to act:

Suggest only (the agent prepares, a person does): The agent drafts a coding or a match, and a person enters or confirms it. A forecast line follows the same review control, which suits anything new or anything with an unmeasured error rate.

Act with approval (the agent prepares and queues, a named person releases): The agent creates the draft journal or payment proposal in the system of record. A named approver releases it through the normal workflow, which makes this an authorisation control.

Unattended within limits (the agent acts, a person monitors): The agent completes and logs the task and raises only exceptions. This monitoring control needs a tested rule set and a value threshold, with a way to undo each action.

For a UK or EU SME today, the defensible position is this. Document capture, tolerance matching, timing-difference classification, anomaly flagging, and audit document retrieval can run unattended after a month of measured results on real data. Standard period-end journals below a threshold stay on the middle rung. Payment release, supplier master changes, material and judgemental journals, forecast sign-off, and any tax position go no higher than the middle rung, with a named approver.

Worked example: one month-end task from trigger to human approval

Take a UK entity’s bank reconciliation, run through an agent on the first morning of close.

1. Trigger: The month’s final bank feed lands in NetSuite at 06:30 on day one, and the agent starts without anyone raising a ticket.

2. Reasoning: The agent pulls 1,140 statement lines, the month’s card settlements from the spend platform, and open ledger entries from NetSuite. It matches 1,097 lines on amount, date, and reference and classifies 31 of the rest as cut-off items, each with a one-line explanation. Twelve lines stay open.

3. System action: The agent writes nothing to the ledger. It records proposed matches in the reconciliation workspace and drafts a £2,150 accrual against an approved purchase order with no invoice yet. It also proposes a split for a £6,480 customer receipt settling three invoices and opens a task listing the 12 open items for the finance operations manager.

4. Approval: The finance operations manager confirms the matches below the £5,000 review line. The £6,480 split and the £2,150 accrual go to the financial controller, because one exceeds the threshold and the other is a cut-off judgement. The controller approves both in the ERP’s approval workflow, which the team has configured to log the agent as preparer and the controller as approver.

5. Exception: One open line is a £940 direct debit to a payee with no supplier record. The agent escalates it with the bank narrative attached instead of guessing. The operations manager identifies a new insurance premium, a colleague who is not the approver creates the supplier record, and the item matches next month.

How data reaches an agent determines the access you grant:

Exports: read-only, but stale once they leave the system.

APIs: read and write, so the scope you grant matters most.

For example, Spendesk AI Connect uses MCP to give compatible AI assistants read-only access to the spend data each user can already see in Spendesk. Users can search and analyse that data for reporting. It cannot approve a request or create a payment, and it cannot change a record. A controller can ask “which supplier invoices over £10,000 are unpaid and past due?” without widening anyone’s permissions. Spendesk’s integration catalogue lists connector and export routes alongside APIs available for the rest of the stack.

Making AI simpler for finance teams

Spendesk AI makes it easier for finance teams to put AI to work without adding complexity to their existing workflows. By bringing spend data, approvals and financial controls together, Spendesk helps teams spend less time searching for information and more time making decisions. And with AI Connect, getting started can be as simple as asking the right question. Explore our AI prompt library for ready-to-use prompts that help you analyse spending, investigate transactions and find answers faster.

Keeping numbers accurate: Hallucination control

An agent stays accurate about figures when every number it produces is retrieved from a system record and checked back against that record before anyone relies on it.

In ICAEW’s platform test, researchers ran generative AI tools on audit tasks, and none of the models rounded all of the year-on-year percentage changes correctly or consistently.

Researchers found that changing what a model could read changed its accuracy. In FinanceBench, a 2023 US benchmark tested on a sample of its 10,231 questions, GPT-4-Turbo answered 19% correctly with a shared retrieval store. It answered 79% correctly with the full filing in context and 85% with the exact evidence supplied. The researchers tested the same model with different source material.

Apply these controls to every figure:

1. Grounding: The agent reads the ledger, bank feed, and spend platform through a connector, never memory or a pasted spreadsheet. In a Bank of England speech, James Benford described “guardrails that check and reference back the output to source documents”.

2. Verification against systems: Every total the agent produces ties to a control total in the source system before it leaves the workspace. A close pack that does not tie to the trial balance is not finished.

3. Review thresholds: A confidence score below the configured level routes the item to a person, as SAP’s and Oracle’s reconciliation tools do with match proposals. The score records model certainty and never replaces a documented human decision.

4. A stop and an undo: Before the first live month, someone must be able to pause the agent and reverse every action it has taken.

Controls, audit trails, and compliance obligations

The controls that make an agent safe are the ones finance already applies to a new starter: a defined role, no authority to approve its own work, a log of what it did, and records kept for as long as the figures they support. ICAEW makes the same comparison in its guidance on setting up an agent and calls for one human to take responsibility for its access and actions.

• Role-based permissions: The agent gets its own identity and inherits at most the permissions of the person it works for. It never holds an administrator role. Whoever configures its rules should not approve its output, and AI should not review AI.

• Audit logs: Capture the input data, instruction, model and version, output, timestamp, and reviewer in storage that cannot be overwritten. Where AI feeds the financial statements, ICAEW notes that auditors ask how management governs and validates the model. They also ask how management monitors it over time.

• Model documentation and change control: Keep a register of agents and what each may do. Record when each agent’s rules or thresholds changed. A named approver must sign off a move to “unattended”, because it changes a material control.

• Bookkeeping review: In Spendesk’s bookkeeping automation, deterministic rules and machine-learning-based suggestions prepare the general ledger code and other fields, and finance reviews and confirms them before export. Every line carries its receipt and approval history, which helps finance trace who prepared and who approved each transaction.

How to decide which tasks to hand over

Work through these five steps in order, starting from the control each task already carries.

1. Score each task on consequence and reversibility. A coding suggestion or draft match can run unattended once tested; a payment, supplier bank change, or posted material journal stays on “act with approval”.

2. Set review thresholds in pounds and in kind. A value line (journals above £5,000 go to the controller) plus a category line (intercompany, FX, or revenue items at any amount) catches both the large and the judgemental.

3. Name an approver and a deputy for every middle-rung task inside the approval workflow, so the log shows a person rather than a role.

4. Prove the audit trail before go-live by tracing one agent-prepared figure to its source record, approver, and model version.

5. Start read-only and widen scope on measured results, since a month on the suggest-only rung gives the error rate that justifies, or vetoes, the next rung.

All five steps assume the agent can see approvals, receipts, invoices, and payments in one place, which is a practical prerequisite. Spendesk is an all-in-one spend management platform consolidating company cards, expense management, accounts payable, procurement, and budgeting. With those records in one workflow, the split this guide describes (prepared by the system, approved by a named person) can be in place before any agent is connected. Book a Spendesk demo to see how that record looks for your entity structure and approval thresholds.

Frequently asked questions

Human accountability remains in place as an agent’s scope grows. These answers cover ongoing oversight, measuring errors, ownership of mistakes, and what to do when source evidence is missing.

How much oversight do AI agents for finance still need?

Oversight shifts from approving each action to supervising the system, and it never drops to zero. Forvis Mazars’ governance guidance recommends a named business owner, traceability, escalation paths, change control, and periodic recertification, because an agent can take an irreversible action before anyone sees a problem. Monitoring effort should scale with what a wrong output could cost.

How do you measure an agent’s error rate before widening its scope?

Run the agent on suggest-only for a month and compare each suggestion with what the reviewer entered. Track overrides by category and by value. Treat any category with repeated overrides as not ready for the next rung, and keep it on suggest-only until another month of real data shows the overrides have stopped.

Who is accountable when an agent gets a number wrong?

The organisation and the named person who owns the agent stay accountable. The ECB has stated that legal and supervisory responsibility remains with the institution deploying agentic technology, and ICAEW and Accountancy Europe say responsibility for judgements cannot be delegated to a tool. Every agent therefore needs a documented owner before it touches live data.

What should happen when an agent cannot find a source for a figure?

The agent should stop and flag the gap rather than estimate. A refusal costs a reviewer a few minutes, while an invented accrual can reach the ledger. Log refusals and near-misses and review them alongside errors at each close. A rising refusal count usually signals a data or connector problem, such as a missing feed or a narrowed permission.