If AI codes and routes our invoices, what controls do we need over the AI?

It means a person with authority reviews and can override AI output before it has financial effect - the AI suggests coding, predicts approvers, or flags risks, and a human approves the result. The control value depends on the review being real: the human must see what the AI did, have the context to evaluate it, and demonstrably correct errors. A human who clicks through 200 AI-coded invoices in ten minutes is in the loop ceremonially, not substantively - which is why complacency monitoring (correction rates, review time, sampling re-review) belongs alongside the loop itself.

The trail should distinguish machine action from human action: which fields the AI populated, what the human changed (before/after values), and who approved the final state. That separation is what lets you answer the auditor's real questions - "what did the approver actually review?" and "how accurate is the automation?" - from the record rather than from assertion. It's also the data that makes accuracy testing possible: corrections are your error measurements.

Yes, when the surrounding controls hold: humans approve before financial effect, the system logs AI vs. human actions, access and change management over the automation are controlled, and management tests output accuracy. Auditors evaluate it as an automated control plus a management review control - established categories, applied to newer technology.

Fix both layers: correct the recurring error (retrain or set the vendor's coding default - a learning system should stop repeating a corrected mistake), and make the review layer measurable - track correction rates by approver, sample approved invoices for re-review, and flag reviewers whose correction rate is implausibly near zero.

Sample AI-coded invoices periodically, re-perform the coding judgment, and record an error rate by field type; investigate systematic patterns (specific vendors, GLs, entities) rather than chasing single misses. Documented sampling, thresholds for action, and evidence of follow-through are what make it a testable control rather than an informal habit.

Ask: Does the audit trail distinguish AI-populated from human-entered values? Can we see before/after on corrections? What does the system show the approver about why it suggested coding or an approver? How does it learn from corrections, and is that learning scoped to our data? What happens when confidence is low - does it guess or route to a human?

Confidence should drive behavior: high-confidence suggestions can streamline review while low-confidence items get flagged or routed for closer attention. Whether the raw score is displayed matters less than whether the system behaves differently when it's unsure - a system that guesses silently at low confidence is the real risk.

Automation bias is the tendency to accept machine output with less scrutiny than a human's work would get. Design against it by making review effortful where it matters (exceptions surfaced prominently, not buried in pre-filled forms), measuring correction behavior, sampling "clean" automated output, and keeping accountability explicitly human - the approver owns the decision, whatever suggested it.

Stampli's AI is embedded in the workflow with humans in control by design: it evaluates structured ERP-aligned invoice fields, suggests coding, predicts approvers, and flags duplicates and variances - and people review, correct, and approve. Stampli AI performs on average 87% of finance work across 2,700+ unique fields, with all suggested entries subject to human review and approval before posting to the ERP. Published workflow rules override AI suggestions for routing, every action is captured in the invoice's activity record, and the AI learns from corrections - so accuracy is both monitored and improving as a byproduct of normal review.