The Official Internal Controls Framework for AI Is Here — What COSO's New Guidance Means for CPA Firm Owners

If you're a CPA firm owner, you learned COSO in your first audit training. The five-component framework — Control Environment, Risk Assessment, Control Activities, Information and Communication, Monitoring Activities — is the backbone of every internal controls engagement you've ever done.

In February 2026, COSO published formal guidance for governing generative AI systems. It's the first time the definitive internal controls framework has been applied directly to AI oversight — and it matters to your firm in ways that most of the noise around "AI governance" doesn't.

This isn't a vendor white paper. It isn't a bar association recommendation. It's COSO. When your clients ask how you govern AI in your practice, there's now a standard you can point to that they'll recognize.

Why This Guidance Arrived Now

COSO didn't publish AI guidance because AI is new. They published it because AI governance in professional services had no authoritative standard — and the gaps were showing up in audit work, client engagements, and insurance claims.

The Journal of Accountancy confirmed coverage of the guidance, framing it as a tool that "creates audit-ready guidance for governing generative AI" — specifically designed so that accounting firms can structure their own AI oversight posture and explain it to clients in terms that carry professional weight.

The profession needed this. Here's what it says.

The Five Components, Applied to AI

COSO's AI governance guidance maps directly onto the existing five-component framework. Here's the translation for a 5-20 person CPA firm:

1. Control Environment

Governance begins at the top. Tone at the top — the principle that says partners model the behavior they expect from staff — applies to AI just as it does to client billing integrity or time reporting.

What this looks like in practice: the firm's owners have a documented position on AI use. Not a paragraph in the employee handbook — a stated standard that partners model visibly. If partners use personal ChatGPT for client work while staff are told not to, the control environment has failed before it started.

2. Risk Assessment

This is where most small firms have the biggest gap, and where COSO is most specific.

AI risk assessment requires the firm to identify and evaluate: the AI tools currently in use (including tools staff use without formal authorization), the types of data those tools process, the vendors' data handling terms, the failure modes of AI outputs in your specific workflows, and the regulatory exposure if those failure modes occur.

For a 10-person CPA firm: this is a two-hour inventory exercise. Go tool by tool. Ask for each one: what data goes in, what terms govern that data, what happens if the output is wrong and it reaches a client? Document it. The risk assessment isn't the policy — it's the foundation for the policy.

3. Control Activities

Control activities are the specific procedures that prevent risk from materializing. COSO's AI guidance identifies three categories of control activities for accounting firms using generative AI:

• Authorization controls: which AI tools are approved for which types of work, and who authorized each
• Output review controls: a human review requirement before any AI-generated content is delivered to a client or filed with a regulatory body
• Scope controls: defined boundaries on what AI tools may do in your workflows — specifically, where AI output becomes the input for client-facing work without additional professional judgment applied

The output review control is the one most small firms have the weakest documentation on. "We always review before sending" is not a control — it's an intention. A documented review requirement with a clear workflow checkpoint is a control.

4. Information and Communication

Your staff needs to know the AI governance policy exists, understand what it requires, and know how to raise a concern when something seems wrong.

COSO is explicit here: governance that isn't communicated isn't governance. The communication requirement has two directions — down to staff (here's the policy, here's what you're required to do) and up to firm leadership (here's what's happening, here's where we've had issues, here's what's changed in the AI tool landscape since we last reviewed).

For a small firm, annual communication is a minimum. Given how fast AI tools are evolving in 2026, semi-annual review is more defensible.

5. Monitoring Activities

Monitoring is how you know whether the other four components are actually working. COSO's AI monitoring guidance asks: are the approved tools still the tools being used? Are output reviews actually happening, or are they being skipped under deadline pressure? Have any AI tools changed their terms of service or data handling policies since you authorized them?

The monitoring frequency that COSO implies for AI is more active than for traditional internal controls, specifically because the AI tool environment changes faster than financial reporting standards do. A quarterly check of your AI vendor terms is now a reasonable governance standard.

The Client-Facing Angle You May Be Missing

Here's the piece most CPA firm owners haven't thought through yet: COSO's guidance doesn't just protect your firm. It gives you a credible professional answer when clients ask about your AI practices.

In 2026, more of your clients are asking. Enterprise clients with procurement processes are starting to include AI governance questions in vendor assessments. Clients who've read about AI errors in financial work are starting to ask their CPA firms directly. Clients undergoing their own COSO-based internal control reviews are noticing that their auditors haven't applied the same framework to themselves.

Being able to say "we've implemented COSO's five-component AI governance framework in our practice, and I can walk you through each component" is qualitatively different from "we're being careful." It's professional. It's auditable. And it demonstrates that you apply to your own operations the standards you use to evaluate your clients.

That's a competitive position, not just a compliance checkbox.

What to Do This Week

You don't need to build a formal governance program overnight. Here's a three-step sequence that gets you from zero to defensible:

Step 1: Inventory (Day 1) List every AI tool currently in use in your firm — including tools staff might be using informally. For each tool: what data does it process, who authorized it, and what are the vendor's data handling terms? This is your risk assessment foundation.

Step 2: Policy (Day 2-3) Write a one-page AI use policy that covers: approved tools list, client data handling rule (which tools can and cannot process client data), output review requirement (no AI-generated content to clients without licensed professional review), and a process for adding new tools to the approved list. You can do this in an afternoon.

Step 3: Communication (Day 4-5) Share the policy with your team. Explain why it exists. Answer their questions. Document that you did it. Schedule a quarterly check-in to review the approved tools list and verify terms haven't changed.

This sequence implements all five COSO components at a scale appropriate for a small firm. It's not a SOX compliance program. It's the minimum viable governance posture that lets you answer confidently when someone asks how you govern AI in your practice.

---

COSO published the standard. The profession has the framework. The only thing left is the two hours it takes to apply it.

Source: Journal of Accountancy — COSO creates audit-ready guidance for governing generative AI