AI Vendor Diligence Questions for the Close

Start with five requests

For a first discussion, put five requests to the vendor, then use the full set for the workflow in question:

• Show the feature and its authority: availability, defaults, and whether it suggests or acts. Questions 4 to 6.
• Show the population and the evidence: what was processed, skipped, retained and exportable. Questions 10, 11, 13 and 15.
• State the data commitment: training, providers, retention, and instructions hidden in source documents. Questions 16 to 18.
• Explain the bill and the limit: the billing unit and what happens when the allowance runs out. Questions 19 to 21.
• Demonstrate the fallback: how the feature is switched off and the work continues. Question 26.

Where a firm will build or run the AI, add questions 31 to 36 and 45 to 48 before accepting the team, the savings case or a run-service commitment.

How to use the set

1. Start with an inventory. List the AI features already enabled in the platforms you license and those the vendor proposes. The inventory phase of the close and consolidation playbook describes how, and What We Mean by AI defines the four kinds of AI the questions refer to.
2. Select the questions that apply. Each question carries an “Ask when” condition. A feature that only suggests does not need the questions written for features that post entries; a feature you will rely on in a financial reporting control needs the evidence questions in full. Put the configuration questions to your own administrators as well. Where a firm or implementation partner will build or run the AI, put questions 31 to 36 and 45 to 48 to the firm, and the questions about the features to whichever party builds, configures or operates them. To have the set assembled for you, use the diligence question builder: choose what you are evaluating, the function and what you need to understand, and it orders the questions that apply, with why each one matters.
3. Ask in writing, and ask for evidence. Record who answered, on what date, and which documents support the answer. Each question takes an answer, Unknown, or Not applicable. An Unknown is a finding about what the vendor will disclose, not proof that the control is missing.
4. Revisit the answers at renewal and after material vendor releases.

A vendor’s answer is a vendor-stated claim until documentation, contract terms or an independent report supports it. The set is a starting point for that conversation, not a substitute for legal review of the contract, a security assessment or your own procurement process, and whether a feature suits your organization depends on materiality, reliance and the controls already in place. It is written for AI obtained from vendors and the firms that build or run it; AI built in house raises many of the same questions, though not all. The Research Methodology & Evidence Standards explain how the Center of Eminence separates claims from evidence.

Why the set has no score

CoE | Vendor Intelligence does not score vendors, and the set is built so that it cannot be summed. One concerning answer about who can post entries can outweigh twenty strong answers elsewhere, and the weight of any answer depends on materiality, on whether the organization will rely on the output, and on the controls it already operates. A total would hide the answer that matters. Each question is a prompt for judgment, applied one at a time.

What the questions draw on

The questions are CoE analysis. None of the sources below prescribes this list, and a question here is not a requirement.

• Achieving Effective Internal Control Over Generative AI, a COSO-commissioned publication released on February 23, 2026, which adapts COSO’s 2013 framework to generative AI and states that it contains general information only.
• The NIST AI Risk Management Framework, whose GOVERN 6 category addresses third-party AI risks and whose MEASURE 1.3 subcategory involves experts who did not develop a system in assessing it, and its generative AI profile, NIST AI 600-1, whose actions are suggested, not required.
• The OWASP Top 10 for LLM Applications 2025, on excessive agency and sensitive information disclosure.
• PCAOB AS 2201, Appendix B, on the auditor’s use of a service auditor’s report; it is an auditing standard addressed to the auditor.
• SEC Regulation S-X Rule 2-01 and PCAOB Rules 3521 and 3525, on auditor independence, which apply to the auditors of SEC registrants and to PCAOB-registered firms.
• The interagency Revised Guidance on Model Risk Management, issued with Federal Reserve letter SR 26-2 on April 17, 2026; the letter replaces SR 11-7 and SR 21-8 and is addressed to banking organizations, and the guidance sets no enforceable standards. Footnote 3 of the guidance places generative and agentic AI models outside its scope.
• Professional services firms’ own annual reports filed with the SEC and their published alliance pages, read as the firms’ own statements.

Governance and accountability

1. Who in your company is accountable for the AI features in this product, and what does a new AI feature or model change have to pass before release?

Why it matters. When AI comes from a vendor, much of its governance sits outside the buyer’s view. The COSO-commissioned publication says generative AI obtained from a vendor limits visibility and oversight of training data, model updates, change cadence and underlying control processes.

Ask when: Any AI feature is in scope.

2. Which AI features depend on models, data or services from third parties, and how do you assess and monitor those providers?

Why it matters. NIST’s generative AI profile names value chain and component integration as a risk, including untraceable integration of upstream third-party components and improper supplier vetting.

Ask when: Any generative AI feature, or any feature built on a model the vendor did not build itself.

3. Has an independent party reviewed your AI governance or the AI features themselves, and can we see the scope and the result?

Why it matters. Among approaches it describes as emerging practice for auditable AI control performance, the COSO-commissioned publication lists third-party validation: independent review or certification of AI models and outputs. A review is only as useful as its scope.

Ask when: You intend to rely on an AI feature’s output in a financial reporting control, or the feature acts without a person’s decision.

The AI features themselves

4. Which AI features are in the modules and edition we license, or would license, and is each generally available, in preview or beta, a paid add-on, or limited by edition or region?

Why it matters. The COSO-commissioned publication looks at what an AI system actually does rather than at the latest product name or vendor. Release status, edition and region decide what a team actually has.

Ask when: Any AI feature is in scope.

5. Which AI features are switched on by default, which does an administrator have to enable, and can each be switched off on its own?

Why it matters. Whether a feature is on by default decides whether finance makes a choice at all. Vendor documentation describes both cases: features that do not run until an administrator enables them, and features delivered disabled that a later update can enable automatically.

Ask when: Any AI feature is in scope.

6. Does each feature suggest or act? Can it create, post, approve or change records, and where is that limit enforced?

Why it matters. A feature that acts leaves no person between the output and the books unless the system enforces one. OWASP traces excessive agency to excessive functionality, permissions or autonomy, and recommends enforcing authorization in downstream systems rather than relying on the model.

Ask when: Any feature that can write to a system, or where it is unclear whether it acts.

7. Who can change each feature’s configuration, prompts, thresholds, data connections or model: your company, our administrators or individual users? Can we restrict and log those changes?

Why it matters. Whoever can change an AI feature can change the result finance relies on. Among common control activities, the COSO-commissioned publication lists separating the ability to configure AI settings from the authority to approve or review outputs.

Ask when: Any AI feature is in scope.

8. What will change in these features through your releases, how much notice will we get, and can we test or defer a change before it reaches our production environment?

Why it matters. Under its principle 9, the COSO-commissioned publication says risk assessment must track significant changes, including vendor-driven changes, which may require specific notification obligations or independent verification.

Ask when: Any AI feature is in scope.

9. Is each output generative or deterministic, what does any confidence score mean, and can a past output be reproduced and explained?

Why it matters. NIST’s generative AI profile defines confabulation as the production of confidently stated but erroneous or false content. A confidence score can help direct review, but it ranks a suggestion; it does not show that the suggestion is right.

Ask when: Any AI feature is in scope.

Data, inputs and completeness

10. What data does each feature read, from which modules, documents or outside sources, and what data can it not see?

Why it matters. PCAOB Staff Audit Practice Alert No. 11 (2013) says that if a control uses system-generated information or reports, the auditor should also obtain evidence about the completeness and accuracy of those reports. An AI output is only as complete as the data it was given.

Ask when: Any AI feature is in scope.

11. How can we test that a feature considered the complete population, and how does it report items it skipped, could not process or excluded?

Why it matters. Reviewing what an AI feature produced does not show that it considered everything it should have. The COSO-commissioned publication lists performance testing, using test populations to validate AI accuracy and completeness, among its leading approaches.

Ask when: The feature produces or proposes entries, matches, accruals or other items that feed the ledger.

12. Does the feature learn from our data, including corrections and overrides, and how does it detect and handle changes in our business?

Why it matters. The COSO-commissioned publication describes generative AI as dynamic, with models, prompts and retrieval data that can evolve frequently, so that change control and monitoring should be continuous or moving toward continuous. History is a weak guide when the business changes.

Ask when: The feature uses machine learning trained or tuned on the organization’s data.

Controls, audit trail and evidence

13. What does the system record for each AI output or action, and can we export and keep those records for as long as we need them?

Why it matters. Under its principle 13, the COSO-commissioned publication says processes using generative AI should capture and store prompts, inputs, outputs, source references, model and configuration versions and any confidence scores. Retention is set by each vendor, so ask for it in writing.

Ask when: Any AI feature is in scope; in full when the output feeds a control over financial reporting.

14. Does your service auditor’s report cover the AI features we would use, for what period, and which controls does it expect us to operate?

Why it matters. Where a service organization’s services are part of a company’s information system, as AS 2601.03 describes, AS 2201 treats them as part of the company’s internal control over financial reporting and directs the auditor to include the service organization’s activities when determining the evidence needed for the opinion. Whether a vendor’s report covers a particular AI feature is a question to ask, not something to assume.

Ask when: The feature supports a process within internal control over financial reporting.

15. Can a reviewer see the sources behind each output, and can someone else re-perform or trace it?

Why it matters. PCAOB Staff Audit Practice Alert No. 11 (2013) says that verifying that a review was signed off provides little or no evidence by itself about the control’s effectiveness.

Ask when: The output will be reviewed as part of a control.

Security, privacy and data use

16. Is our data, including inputs, outputs, documents and corrections, used to train or improve any model, yours or a third party’s? Is that off by default, and is the commitment in the contract?

Why it matters. OWASP says application owners should provide clear terms of use that let users opt out of having their data included in the training model. Training on customer data is a contract question, not only a setting.

Ask when: Any generative AI feature, or any feature that learns from customer data.

17. How long are prompts, outputs and logs kept, where are they stored and processed, and can we have them deleted?

Why it matters. OWASP recommends clear policies about data retention, usage and deletion. The answer has to serve two needs at once: keeping evidence for as long as the organization needs it (question 13) and limiting how long sensitive data stays with the vendor.

Ask when: Any AI feature is in scope.

18. Can a feature reach data or take actions beyond the permissions of the user it works for, and how is it protected against instructions hidden in the documents or data it reads?

Why it matters. OWASP warns that restrictions written into a system prompt may not always be honored and could be bypassed through prompt injection. The close runs on invoices, contracts and supplier correspondence that the organization did not write.

Ask when: Generative features that read documents, email or outside data, and any feature that acts.

Commercial terms

19. How are the AI features priced: included in the subscription, sold as an add-on or higher tier, or metered by use? What is the billing unit?

Why it matters. Packaging determines both the cost and which features a team actually has. Where a vendor publishes no price, “quote only” is itself worth recording.

Ask when: Any AI feature is in scope.

20. What happens when use exceeds the included amount: overage charges, throttling, or a feature that stops partway through a critical process?

Why it matters. Close work concentrates at period end, so a usage limit that is comfortable in an average week can bind on the days that matter most.

Ask when: The feature is metered, capped or bundled with a usage allowance.

21. Can the AI features, their packaging or their prices change during the term, and what notice, price protection or right to decline applies?

Why it matters. NIST’s generative AI profile suggests reviewing vendor contracts to avoid arbitrary or capricious termination of critical generative AI services, and considering how responsibility for system changes over time is assigned. A feature on a roadmap is not a feature in the contract.

Ask when: Any AI feature is in scope.

Implementation, support and change

22. What has to be in place before each feature works as described: data history, configuration, integrations, edition and services?

Why it matters. Prerequisites differ from feature to feature, and one that surfaces after signature is a cost the proposal did not show.

Ask when: Before buying or enabling a feature.

23. How will you support our validation before we rely on a feature: a test environment, test data, parallel runs and documented known limitations?

Why it matters. The COSO-commissioned publication’s implementation roadmap includes validating vendor updates before deployment. Validation in the organization’s own environment is what supports reliance; a successful demonstration does not.

Ask when: You intend to rely on the output in a control.

24. When an AI feature produces a wrong or harmful result, how do we report it, how fast will you respond, and will you tell us if an issue found elsewhere affects our outputs?

Why it matters. NIST’s generative AI profile suggests requesting notification and disclosure of serious incidents arising from third-party data and systems, and service level agreements that address incident response and response times.

Ask when: Any AI feature is in scope.

Exit and portability

25. If we stop using a feature or leave, what do we get back and in what format, and what happens to our data and to any model trained on it?

Why it matters. NIST’s generative AI profile lists factors to consider when decommissioning, including data retention requirements and data leakage after decommissioning. Records that support past financial statements may need to outlast the contract.

Ask when: Any AI feature is in scope.

26. Can each feature be switched off without disrupting the work it supports, and what is the fallback if it fails or the vendor removes it?

Why it matters. NIST’s generative AI profile suggests protocols to ensure generative AI systems can be deactivated when necessary, and testing fallback arrangements, acknowledging that fallback may include manual processing.

Ask when: Any AI feature is in scope; in full for features the close depends on.

Close-specific questions

27. For reconciliation and matching: what rules and tolerances govern automatic matches, can a match be undone, and how are unmatched and partly matched items shown?

Why it matters. Among illustrative controls for automated reconciliation, the COSO-commissioned publication lists periodically re-performing reconciliations manually. A matching suggestion does not show that a reconciliation is complete.

Ask when: The feature suggests or applies matches in account, bank or intercompany reconciliations.

28. For journal entries: can the feature draft, create or post entries, under whose identity are they recorded, and do approval workflow and segregation of duties apply to them as they do to manual entries?

Why it matters. PCAOB staff states that auditors should carefully consider fraud risks in journal entries processed through automated systems, because the risk of management override of controls is not limited to manually processed entries.

Ask when: The feature drafts, proposes or posts journal entries.

29. For intercompany and consolidation: does the feature propose or apply eliminations, reclassifications or consolidating adjustments, and are they traceable to both counterparties and reviewed like other adjustments?

Why it matters. AS 2401 says consolidating adjustments and reclassifications generally are not reflected in formal journal entries and might not be subject to the entity’s internal controls.

Ask when: The feature touches intercompany matching, eliminations or consolidation.

30. For close commentary and reporting: are the figures in generated variance explanations, narratives or charts calculated by the system or produced by the model, and can each statement be traced to the records it rests on?

Why it matters. NIST notes that generative AI outputs may include confabulated logic or citations that may further mislead people into trusting the output.

Ask when: The feature drafts flux commentary, management narratives, disclosures or charts.

Professional services and implementation partners

These questions apply when a professional services firm, or a software vendor’s implementation partner, will design, build or run AI in the finance process. They concern who does the work, what the organization keeps, and what it pays afterward. The feature questions above still apply to whatever the firm builds or deploys.

31. Who, by name and role, will design, build, test and run the AI in our finance process, and what AI has each of those people personally put into production?

Why it matters. A firm’s credentials and case studies describe the firm, not the team assigned to the work, and large engagements can draw on subcontractors: Accenture’s annual report, in its risk factors, says large and complex arrangements often require it to use subcontractors or to coordinate with the software and systems of other vendors, including companies with which it has alliances. Deep finance systems or ERP implementation experience is valuable, but configuring a platform is a different skill from building, testing and governing a model; this question shows which one the team has.

Ask when: A firm or implementation partner will design, build, configure or run AI in a finance process.

32. How does your firm decide that someone is qualified to build or govern AI for financial reporting, and who outside the delivery team reviews model risk before anything goes live?

Why it matters. Revised US bank supervisory guidance on model risk, issued April 17, 2026, describes effective challenge by objective experts with the expertise, independence and organizational standing to effect change, yet footnote 3 of that guidance places generative and agentic AI models outside its scope. Under the NIST AI RMF, internal experts who did not serve as front-line developers of a system, or independent assessors, are involved in its regular assessments. With no settled external bar for this work, the firm’s own qualification standard and review are what the organization relies on.

Ask when: A firm or partner will build, configure or validate AI whose output feeds financial reporting or a control.

33. When the engagement ends, what will we own and be able to run ourselves, and what will work only with your firm? On what terms are your accelerators licensed afterward, and what does it cost to leave a run service?

Why it matters. Firms deliver AI in different forms: KPMG describes build-and-operate and build-operate-transfer delivery on client-owned or KPMG-provided technology, and Genpact says it typically enters into master software-as-a-service agreements for its Agentic Solutions. Exit terms vary as well: firms’ annual reports describe both contracts that clients can end on short notice without significant early termination cost and contracts that carry a termination penalty if the client ends them without cause, and they describe these company-wide, not for finance or AI engagements. Together these decide whether the agents, prompts and data pipelines become the organization’s assets or remain a service it rents; question 25 covers the return of data.

Ask when: A firm or partner will deliver agents, models, prompts or accelerators, or proposes to operate any part of the finance process.

34. What will this cost in years two to five, including run fees, platform licenses, AI usage fees and change requests, and how does that compare with the savings case once the internal oversight roles we keep are counted?

Why it matters. A run service can commit the organization for several years: Accenture’s annual report says its managed services contracts typically span several years, and Genpact’s says many of its statements of work run for two to five years. Some fees are tied to the savings themselves: Accenture reports contracts in which part of its compensation depends on measures such as cost savings, and Grant Thornton describes using guaranteed outsourcing savings to finance AI and automation investments. A headcount saving holds only if it does not reappear as run fees, licenses and usage charges, and only net of the reviewers, model owners and control owners the organization still needs.

Ask when: A proposal includes a savings or headcount case, a run or managed service, or platform or usage fees beyond the first year.

35. Do you receive fees, rebates, resale margins or other incentives from the software you are recommending, and do you, or will you, audit our financial statements?

Why it matters. Firms describe close commercial ties to software providers: Accenture’s annual report says a very significant portion of its revenue and of its solutions and services is based on technology provided by its ecosystem partners, and Deloitte cites more than 150 alliances. For an audit client that is an SEC registrant, Rule 2-01 treats financial information systems design and implementation as impairing the auditor’s independence unless it is reasonable to conclude the results will not be subject to audit procedures, and an issuer’s audit committee must pre-approve non-audit services. An incentive does not make a recommendation wrong, but the organization should know of it before relying on the recommendation, and whether an audit firm may do the work is for the audit committee and counsel to conclude.

Ask when: A firm or partner recommends, resells or implements software, or the firm or a member of its network audits the organization’s financial statements.

36. What results from clients like us can you show that someone other than your firm has verified, and by what method?

Why it matters. No AI offering in the directory has independently verified outcomes, whether it comes from a software vendor or a professional services firm. Firms do publish efficiency figures for their AI offerings, such as reductions in manual effort or time saved. A figure the firm reports is a vendor-stated claim until the organization’s own finance or internal audit function, or another independent party, has checked it against a stated method.

Ask when: A firm cites savings, efficiency gains or client results in support of its proposal.

45. Has your firm run this solution, or one built the same way, in its own operations? If not, which clients have run it in production, for how long, and what results can they show?

Why it matters. Large firms now describe using AI on their own work before selling it. Anthropic’s May 14, 2026 announcement says PwC started as “Customer Zero,” putting Claude to work inside its own firm, including for journal entries and variance analysis, before bringing it to clients. EY says that, as “Client Zero,” it first deployed Copilot to 150,000 users, with a productivity gain it reports itself. These are the firms’ own accounts, and the figures are theirs. A firm that has run the same kind of solution in its own finance function, or can name clients that have run it in production, offers evidence beyond a demonstration. A firm that can show neither is asking the organization to be its first production deployment.

Evidence to request. Where the firm uses the solution itself: the process it supports, since when, and who owns it. Otherwise: client references running it in production, for how long and at what volume. In either case, the results measured and who measured them; question 36 covers independent verification.

Ask when: A firm proposes to implement a solution type, agent or accelerator in a finance process.

46. Which foundation models, AI platforms and model providers do your agents, accelerators and tools run on? Who holds the contract with each provider, and what happens to our solution if a provider changes its model, terms or prices?

Why it matters. Accenture’s annual report for the year ended August 31, 2026 says many of its AI solutions and services rely on third-party AI models, platforms and infrastructure providers over which it has limited control. Firms build on several providers at once: KPMG says its Workbench platform is built on Microsoft Azure AI Foundry Services, with agents built to work with a range of large language models, and in February 2026 OpenAI named Accenture, Capgemini, BCG and McKinsey as partners in multi-year Frontier Alliances. Infosys’s annual report names outages, licensing restrictions and changes in pricing or terms among the risks of relying on third-party AI providers. The answer shows whose data-use, retention and change terms actually govern the organization’s data and outputs, and who absorbs the cost when a model is retired or repriced. Question 2 asks software vendors the same about their own features.

Evidence to request. For each agent, accelerator or tool: the model, its version and the hosting platform; who contracts with the provider (the firm, the organization or a platform vendor); the provider’s data-use and retention terms as they apply to this work; and the plan, and who pays, when a model is retired or replaced.

Ask when: A firm’s solution uses generative AI models or an AI platform, whether the firm’s own or a third party’s.

47. What protects us from price changes during the engagement and the run service: rate cards, caps and notice on increases, how changes in software and AI usage costs are passed through to us, and our right to decline or exit?

Why it matters. The software beneath a firm’s solution reprices. Microsoft’s list prices for Microsoft 365 E3 rose from $36.00 to $39.00 per user, and for E5 from $57.00 to $60.00, effective July 1, 2026, and Salesforce raised list prices for its Enterprise and Unlimited Editions by an average of 6% on August 1, 2025. Firms’ own contracts move too: DXC’s annual report says many of its contracts include cost-of-living adjustments, and that its ability to pass through increased costs is limited in some contracts. No firm in the directory publishes the price protection it offers clients, so the terms have to be requested. Question 34 covers the five-year total; this question covers what can change within it.

Evidence to request. The rate card and any indexation clause; the cap and notice period on increases; how third-party license and AI usage charges are passed through, at cost or with a margin; and the right to decline an increase or to exit, with its cost.

Ask when: An engagement or run service extends beyond one year, or the firm’s fees include software licenses or AI usage.

48. What would disrupt delivery or the running solution: an outage, a model retired or a change in terms at a model or platform provider, a subcontractor or delivery center failing, or the loss of key people? What is your continuity plan, and how has it been tested?

Why it matters. The platforms beneath a solution fail and change. Microsoft’s review of an incident on September 30, 2026 records intermittent failures in several Azure networking services across multiple regions, and Anthropic retired Claude Opus 4.1 on August 5, 2026, two months after notifying developers. Delivery is concentrated as well: Accenture’s annual report says large portions of its delivery capability are based in India and the Philippines, and that its business continuity plans may not be effective if catastrophic events occur where many of its people work. Regulators now treat these dependencies as supply-chain risk. The United Kingdom designated its first critical third parties to the financial sector, including Amazon Web Services, Google Cloud, Microsoft and Oracle entities, with effect from July 13, 2026, and the Financial Stability Board’s October 15, 2026 report asks financial institutions to manage third-party AI dependencies with a focus on supply chain and concentration risks and business continuity. The firm’s continuity plan becomes part of the organization’s own.

Evidence to request. The model, platform, subcontractor and delivery-location dependencies of this solution; the firm’s business continuity and exit plans, with the date and result of their last test; the fallback when a model is retired or a provider is unavailable; and key-person and substitution terms (question 31).

Ask when: A firm will run any part of the process, or the solution depends on a third-party model or cloud platform.

Before you sign

Treat each Unknown that touches authority, evidence or exit as a condition of the purchase: resolve it in writing, put the commitment in the contract, or keep the feature switched off until it is resolved. Revisit the answers at renewal and after material vendor releases.

Related research

• What We Mean by AI: the four kinds of AI and the questions that matter more than the label
• AI in the Close and Consolidation: A Workflow Playbook: where each kind of AI meets the close, and the inventory to complete first
• Treat AI Output Like an Unsupported Journal Entry: evidence, support and completeness
• Review Is a Control Only When It Can Catch the Error: designing review to catch defects
• Internal Control Over Generative AI, Applied to the Close: governance, change and monitoring
• Your AI Agent Is an Unlisted Signer: delegated authority and access
• A Chart Is a Claim: presentation and disclosure