Closing the Gap Between AI Governance & Internal Controls

The gap between written artificial intelligence (AI) governance policies and internal controls for middle-market organizations is becoming a board-level question. When an audit committee chair asks for evidence of AI oversight, they’re usually looking for more than a policy document.

That distinction is at the center of a growing challenge across the middle market. Boards have approved AI use policies; chief financial officers, chief risk officers, and risk leaders have signed off on governance frameworks; and many organizations have published ethics statements. Yet, employees may be using publicly available large language models at the same time to draft items such as vendor contract summaries, financial close commentary, customer-facing communications, and pricing analysis, outside any sanctioned workflow, without an approved vendor relationship, and beyond the reach of any operating control.

This can result in AI governance existing largely on paper, creating exposure for public filers, companies preparing for a transaction, and private companies subject to System and Organization Controls (SOC) examinations or lender scrutiny.

What Does COSO’s GenAI Guidance Mean?

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) released “Achieving Effective Internal Control Over Generative AI” this year,1 noting that having an AI policy is not the same as controlling AI risks. COSO’s guidance is built on the same five-component framework that finance and accounting teams already use for internal control over financial reporting, and it applies those components directly to generative AI (GenAI), treating GenAI risk as an extension of existing internal control obligations rather than a separate category.

COSO’s Internal Control Framework

Control Environment
Risk Assessment
Control Activities
Information & Communication
Monitoring Activities

For middle-market companies, this framing matters across several fronts. Public filers operate under SOX Section 404, where the SEC and PCAOB point to COSO as the preferred internal control framework for financial reporting. Service organizations issuing SOC 1 and SOC 2 Reports map their control environments to COSO principles, and customers are increasingly asking how AI is governed inside those reports. Regulated institutions such as community banks and insurers already apply Supervisory Letter (SR) 11-7 model risk management standards that align closely with COSO’s integrated framework. Boards that have spent years applying COSO to financial reporting now face the same obligation applied to AI-enabled workflows.

A policy that lives in a document repository but has no monitoring mechanism, no training reinforcement, and no escalation path isn’t a functioning control.

Shadow AI Use Is on the Rise

The pace of AI adoption is outpacing governance documentation in many organizations. COSO notes that GenAI “is moving into boardrooms and day-to-day operations far faster than traditional governance models anticipated.” Organizations already are using AI-enabled tools to help automate reconciliations, accelerate analysis, and support decision making at a scale, which is compressing timelines and reshaping workflows.

The readiness gap is considerable, and teams are facing it with tighter capacity. The Institute of Internal Auditors’ “2026 North American Pulse of Internal Audit” report notes that more internal audit functions are reporting budget and staffing declines, while SOX, compliance, cybersecurity, IT, and operational risks remain major audit-plan priorities. For AI governance, that means organizations may need to prioritize controls that produce evidence, clarify ownership, and can be reviewed without adding unnecessary burden to already constrained teams.2

In some cases, employees may not be waiting for approval committees to authorize tools they can access in a browser tab. This behavior, commonly called “shadow AI,” refers to the use of unapproved GenAI tools within an organization, and it’s increasingly common. Unlike traditional shadow IT, which typically involves unauthorized software procurement or infrastructure, shadow AI leaves almost no footprint in standard IT audit logs. There’s no installation record, no procurement request, and no vendor contract. The output enters a workflow, influences a decision, and leaves almost no traceable evidence that AI was involved.

Professionals from Forvis Mazars have observed that related to cybersecurity in regulated environments, organizations are struggling to govern AI adoption at the current pace, and that some governance frameworks are falling behind how AI tools are being used. This can present risk for audit committees and technology and finance leaders.

What Do Stakeholders Want to See?

Whether the questions come from an external auditor scoping SOX or SOC work, a private equity sponsor conducting a quarterly portfolio review, a lender refreshing covenant compliance, or a cyber insurance underwriter validating control attestations, the inquiry is generally the same. Stakeholders are seeking evidence. Specifically, they’re looking for the:

Control Environment: Does the tone from the board and senior management reflect a genuine commitment to AI governance, or is it aspirational language without operational follow-through?
Risk Assessment: Has the organization identified where AI-generated outputs are entering decision workflows, including vendor selection, financial reporting, customer communications, and pricing?
Control Activities: Are there procedures in place that can help prevent or detect unauthorized AI use, not just policies that prohibit it?
Information & Communication: Do employees understand what tools are approved, what is prohibited, and how to escalate concerns?
Monitoring Activities: Is the organization actively reviewing AI tool usage, model outputs, and workflow integration on a recurring basis?

An organization that can’t answer those questions with documented evidence is not in a defensible position, regardless of what its governance framework may indicate. COSO’s updated guidance makes this point directly by noting that GenAI introduces risks from model drift, prompt-based manipulation, and opaque reasoning that can compromise the integrity of operations, reporting, and compliance if not addressed with active internal controls. Written policy does not address those risks. Operating controls do.

Turning AI Governance Into Operating Controls

More documentation isn’t necessarily the answer, but rather control engineering can be, designing governance so that evidence is generated automatically, not assembled retroactively. In practice, this means shifting from policy-as-governance to mechanism-as-governance. Examples include:

Automated prompt logging that captures AI tool interactions at the workflow level, creating a reviewable record without relying on employee self-reporting.
Data masking protocols that can prevent sensitive customer, vendor, or financial data from being entered into non-sanctioned AI tools.
Human-in-the-loop (HITL) review checkpoints at decision points where AI-generated outputs influence financial reporting, contracts, pricing, or customer communications, with timestamped approval records.
Bias and accuracy testing routines embedded in model workflows so that validation is a built-in function rather than a periodic project.

Credible AI governance depends on controls that can show how AI is used, reviewed, and monitored.

Five Steps to Help Strengthen AI Controls

Inventory AI tool usage across business lines, including unapproved and browser-accessible tools, not just sanctioned platforms.
Identify where GenAI-generated content enters business decisions, such as financial reporting, vendor selection, customer communications, or pricing.
Assess your control environment against COSO’s five components, with attention to whether controls are designed and operating, not just documented.
Brief your audit committee on shadow AI exposure ahead of the next external audit, SOC Examination, or board diligence cycle.
Engage internal audit, or an outsourced internal audit source, to include AI governance in the next risk assessment cycle, with specific attention to monitoring information and communication.

How Forvis Mazars Can Help

Our IT Risk & Compliance team works with organizations to help assess AI governance frameworks against examination-ready standards, identify control gaps, and build operating controls that support efforts to produce auditable evidence. Our skilled professionals are committed to delivering an Unmatched Client Experience^® and helping you prepare for what’s next. If you have any questions or need assistance, please reach out to a professional at Forvis Mazars today.