In 2025, the PCAOB sanctioned a small New York audit firm. On two audits, the partner did not review any of the workpapers. He never got access to them. He signed off on the audit reports based on conversations with the team, without reviewing them.
That is the same thing that can happen with AI-drafted work. The draft arrives in seconds, and the approval takes one click.
Why a sign-off on AI-drafted work is a claim
For most finance work, the sign-off is the control. Nobody redoes the work. A preparer produces it, a reviewer signs it, and everyone downstream treats that signature as proof the work was reviewed. That covers journal entries, reconciliations, variance memos, tax provisions and audit workpapers.
When AI produces the draft, the signature gets cheaper to give and harder to back up. A reviewer who signs without reviewing is making a false statement, whether the draft came from a staff accountant or a model. The volume is higher, too. A model can produce more drafts in an hour than a reviewer can read in a day.
The same PCAOB order describes a second partner. His regular practice was to sign off as reviewer to clear error messages so the binder could be archived in the system. According to the order, it was unclear whether anyone had actually reviewed the workpapers, and significant changes were made to the workpapers after they had been signed off as reviewed. The system demanded a reviewer sign-off, and a sign-off was supplied.
What the research says about accountability
A 2026 paper in the Journal of Service Management ran six experiments on complacency with AI. The main driver was whether the person was accountable for monitoring the output. People who were not accountable monitored less. Complacency also rose on interdependent teams, where someone else could catch it, and when workers had heavy competing demands.
The participants were service workers, not accountants. Finance is a service industry, and that mix of lots of stakeholders and competing demands sounds familiar. When one person is accountable for monitoring the output, that person does a better job. When it is not clear who is responsible, the work gets passed along and spread across the team, and everyone assumes somebody else did the check.
Four moves to make an AI approval prove itself
Technology can help. The AI and your workflow log when things were completed, so you can see when people sign off, whether they opened the file and approved instantly, or spent time in the system. It is a little bit big brother, but it gives you context on how people actually review. Getting people to treat an approval as a real review is a change management problem, and it takes four moves.
1. One named owner per approval
A person, not a team, not a committee, not the agent. Then define what the approval means. A reviewer who knows another reviewer sits above them may relax, so the expectation has to be written down at every level of review. AI can help here: give it the structure of your team, your workflow and each person’s role, and it can build a checklist where each person signs off that they did what the step required. Once it is signed, lock the record and save the timestamp.
2. Make the sign-off carry content
Record what you changed, and also what went well. One option is a voice memo. Open the workbook and talk through it as if you were briefing an associate: here is the summary page, the checks tie out, the variance to last year looks within normal bounds. If anyone ever asks whether you reviewed it, that recording is strong evidence you did, even when you changed nothing.
3. Build logs around the approval
Record when the AI finishes, when the person starts and when they stop. That gives you context if something goes wrong. It also shows how much review time AI is creating. If AI produces 40 drafts in an hour, you want to know whether your reviewers are now spending their day reviewing.
4. Write the consequences down
People need to understand what happens if they do not follow the guidelines. It is hard to call people out when they are producing acceptable work or clicking things through, and small issues below a materiality threshold can sit until an audit catches them later. When a second-level reviewer flags something and it looks like the first-level reviewer did nothing, the consequence should be easy to find and easy to understand: training, a mark in the 360 review, coaching, and a stronger response if the behavior continues.
The consequence is for signing without reviewing. The company sets the policy with HR and legal, so everyone doing the work is on the same page.
Takeaways
- A signature is a claim. It does not show what work was done behind it.
- Name one owner per approval and write down what a review means.
- Make the sign-off carry content: what changed, what went well, and a recorded walkthrough, backed by logs of when things happened.
- Write the consequences down and tie them to signing without reviewing.
This week, pick one AI-assisted approval in your process and build a small approval system around it: an owner, someone reporting what they did, and a starter set of audit logs.
Want the CPE credit? Take the full lesson on EverydayCPE and earn 0.2 CPE credits: https://everydaycpe.com/courses/technical-management-services/a-sign-off-is-a-claim-prove-it/
Leave a Reply