Finance automation should make a valid process faster and more observable. If authority, source evidence, duplicate handling, and reconciliation are undefined, automation scales an accounting defect and shortens the time available to catch it.
Map the controlled process first
Write the trigger, required fields, source system, accounting rule, approval threshold, posting destination, evidence retained, reconciliation, and exception owner. COSO separates control environment, risk assessment, control activities, information, and monitoring; a workflow button covers only part of that system.
Use idempotency keys for invoices and payments, least-privilege service accounts, dual approval for beneficiary changes, and immutable event timestamps. A retry must not create a second payable or payment, and a system administrator should not silently gain accounting approval authority.
Quantify the workflow without vendor claims
Worked July 2026 population: 480 invoices take ten manual minutes each, or 80 hours. Automation routes 426 clean items at one review minute and 54 exceptions at twenty minutes: 426 / 60 + 54 × 20 / 60 = 25.1 hours, rounded conservatively to 26.
The labeled saving is 80 - 26 = 54 hours per month. Assumptions: a complete population, no implementation time, no tax, no change in control quality, and USD zero labor valuation because the artifact reports hours rather than fabricated monetary ROI. Record seven suspected duplicates in the exception queue, never auto-delete them.
- Invoices480 count
- Straight-through426 count
- Exceptions54 count
- Duplicates7 count
COSO Internal Control (2026-07). Worked invoice population and routing, not a vendor benchmark.
Run an exception and reconciliation ledger
Artifact: keep columns for event ID, source document hash, vendor, transaction currency, invoice date, accounting date, rule version, confidence, approver, exception code, resolution evidence, posting ID, payment ID, and reconciliation status. Preserve before-and-after values for every override.
Sensitivity: if exceptions double from 54 to 108, review time becomes 372 × 1 / 60 + 108 × 20 / 60 = 42.2 hours and saving falls to 37.8 hours. Queue age, unreconciled value, duplicate rate, and override rate should trigger investigation before throughput targets encourage unsafe approval.
Secure records and respect jurisdiction
NIST CSF 2.0 frames governance, identification, protection, detection, response, and recovery; OWASP logging guidance helps design useful security events without exposing secrets. Encrypt data, rotate credentials, test restoration, and alert on approval or bank-detail changes.
Record-retention, e-invoicing, privacy, data residency, electronic signature, payroll, sanctions, and tax rules differ by country and sector. The IRS page applies to U.S. federal recordkeeping, not Iran or every U.S. state. Configure retention and tax logic only after local legal, tax, and accounting review; preserve original currency and dated exchange rates.
Frequently asked questions
What should be automated first?
A stable, repetitive, evidence-rich process with bounded exceptions and a reversible rollout.
Can AI approve invoices?
It may classify or route, but material approval authority needs explicit policy, testing, and human accountability.
How is success measured?
Cycle time plus exception quality, duplicate prevention, reconciliation completeness, and control evidence.
How long should logs be retained?
Follow applicable accounting, tax, privacy, litigation-hold, and sector rules; no universal period applies.
Answers to the questions this topic usually leaves hanging.
How we sourced this
Every statistic in Automate Evidence and Routing, Not Judgment Away is attributed. Where a number is an estimate rather than a census, the note says so.
- COSO internal controlFramework for controls, information, and monitoring.
- NIST Cybersecurity Framework 2.0Governance and security lifecycle.
- IRS recordkeepingU.S. federal business-record context.
- OWASP logging guidanceSecurity-event logging design and data limits.
Primary sources used for this edition.
The bottom line
Automate one reconciled process behind an exception queue before adding another integration.
If you want the adjacent decisions after Automate Evidence and Routing, Not Judgment Away, start with Financial controls, Revenue recognition, Financial reporting, Financial risk.
