# Internal controls and audit evidence for AI agents that spend money

Once an AI agent can pay a bill, use a card or post an entry, it is part of your internal control over financial reporting, and your auditor will ask how it is controlled. The frameworks are catching up quickly, and they ask for the same few things: know which agents exist, decide what each may do, keep a person in the loop where the risk calls for it, log what happened, and watch for what shouldn't have.

## What the frameworks say

COSO published "Achieving Effective Internal Control Over Generative AI" in February 2026, building on its 2013 framework. As Deloitte summarizes it, the guidance calls for an inventory of AI use cases mapped to business processes and key controls, human review and segregation of duties scaled to each use case's risk, logging of the model, the inputs and outputs and the approvals, and monitoring for anomalies and unauthorized use. It doesn't use the word "agentic", but an agent that pays or posts is exactly the use case it describes.

In October 2026 the AICPA and the Artificial Intelligence Underwriting Company (AIUC) announced a single CPA-led engagement that combines a SOC 2 report with AIUC-1 certification for AI systems and agents, which several CPA firms already deliver, with a full launch expected in early 2027. If you sell software whose agents move your customers' money, expect your customers to ask for it.

For ACH, Nacha's fraud monitoring rules now apply to every originator of business payments: the first phase took effect on 20 March 2026 and the second on 19 June 2026 (22 June in practice). They ask for risk-based processes that identify entries that are unauthorized or induced by false pretenses. An agent that originates ACH payments on your behalf doesn't change who the originator is, so the monitoring duty is still yours.

## The controls, in practice

**An inventory of agents with a named owner.** Every agent that can spend or post, the cards and accounts it can use, and the person answerable for it. A card should belong to one agent, never be shared with a person.

**A written mandate for each agent.** The most one action may cost, the monthly limit, the payees it may pay on its own, the ones it may never pay, and when a person approves. This is the policy the agent's actions get tested against.

**A check before money moves.** The agent asks, the mandate answers, and the answer is recorded. Above a threshold, a person approves, and that person isn't the one who built or runs the agent, which keeps preparation and approval apart.

**Reconciliation of what the agent said to what the platform shows.** Every card authorization and payment is matched to the action the agent recorded. Spend no action explains, and actions no platform showed, are the exceptions a reviewer looks at.

**Monitoring with a way to stop it.** Alerts within minutes for spend outside the mandate, and the ability to freeze the card from the alert, with a second person confirming where your controls require it.

**Evidence the auditor can replay.** For each period: each agent's spend, how much an action explained, the approvals asked and how they went, the incidents, the freezes and what came back from disputes, with the mandate in force at the time.

## What not to do

Don't rely on a card platform's limits alone: they stop amounts, not wrong purchases. Don't let the agent approve its own exceptions. And don't book agent purchases a second time from your monitoring tool if the card platform already posts them to the ledger; keep the controls evidence separate from the entries.

Veqen's [agent spend](/agent-spend) keeps the inventory, the mandates, the checks, the matching, the alerts and the monthly controls report for agents on Stripe Issuing, Ramp, Brex and Mercury. [Read the docs](/docs/agent-spend).