AI agents for finance teams: what works and what doesn't

Most of the discussion about AI agents for finance teams is either fantasy or fear. The fantasy is an agent that closes the books. The fear is that it will, badly. The useful version is narrower and duller: an agent that does the assembling, checking and ranking that currently eats the first three hours of a controller's day, and hands a human something to decide on.

That framing is not modesty. It follows from a property of finance work: most of the cost of being wrong lands on someone outside the team — a customer, an auditor, a bank — and lands late.

AI agent (in a finance context)

A system that pursues a stated goal over multiple steps, choosing which tools to call — query the ERP, read a report, draft a message — rather than executing one fixed instruction. The multi-step autonomy is what makes it useful and what makes guardrails necessary.

What AI agents for finance teams actually do well

Five jobs, each with the same three-part shape: what the agent does, what it must never do unattended, and how a human stays accountable.

1. Collections triage

• Does: pulls the open AR ledger every morning, ranks accounts by overdue value against promise-to-pay history and payment behaviour, groups invoices by dispute reason, and drafts the next chase message for each account in the right tone for that relationship.
• Never unattended: sends anything to a customer, puts an account on credit hold, releases a hold, agrees a payment plan, or writes off a balance.
• Accountability: the collector reviews a ranked worklist and sends what they approve. Track the outcome the same way you would with a human-built list — CEI tells you whether the ranking is actually collecting more, which DSO alone will not.

This is the highest-return agent job in most finance teams, because the underlying work is genuinely mechanical. Sorting the ageing by value within bucket, matching against last month's promises, and noticing that four of the top ten are the same dispute — none of that needs judgement, and all of it gets skipped when the day is busy.

2. Close-prep checks

• Does: runs the same list of pre-close checks every period. Unposted transactions, unapplied cash older than five days, sub-ledger to GL differences, suspense and clearing account balances, intercompany mismatches, missing accruals against last period's pattern, items received not billed.
• Never unattended: posts an adjusting entry, closes a period, changes a mapping, or reclassifies anything.
• Accountability: the output is an exceptions list with the query behind each line, delivered before the close meeting. The accountant who owns each account clears each item and signs it off.

The value here is consistency rather than intelligence. A checklist that runs identically every period, unaffected by who is on holiday, catches the item that would otherwise surface as an audit adjustment eight months later.

3. Variance narrative drafting

• Does: compares actual to budget and to prior period, identifies which variances exceed your materiality threshold, decomposes them where the data allows (price against volume against mix), and drafts the first version of the commentary with the numbers already correct.
• Never unattended: ships commentary to the board, an investor or a lender; attributes a variance to a cause it cannot evidence; or restates a number to fit a story.
• Accountability: the FP&A analyst owns the narrative and rewrites the causal claims. The agent is allowed to say revenue fell 8.4% on volume with price flat. It is not allowed to say why, because the why lives in conversations it was not in. Budget vs actual variance analysis covers how to build the story properly.

4. Exception monitoring

• Does: watches for defined conditions continuously and alerts. Orders over a threshold for customers on credit hold, purchase prices deviating from standard beyond a tolerance, duplicate vendor invoices, margin below floor on a quote, inventory adjustments over a value, a customer's payment behaviour deteriorating two periods running.
• Never unattended: blocks a shipment, cancels an order, holds a payment, or emails a supplier.
• Accountability: each alert routes to a named role with a stated response time, and unactioned alerts escalate. An alert nobody owns is noise with a queue.

5. Reconciliation prep

• Does: assembles both sides of a reconciliation, proposes matches for the obvious pairs, and produces a short list of genuine unknowns with everything needed to resolve each one attached.
• Never unattended: posts the reconciling entries, forces a match, or clears an item because it is small.
• Accountability: a human accepts or rejects each proposed match and posts the entries. The reconciliation is signed by a person, as it always was.

Good agent jobs and bad agent jobs

The pattern is consistent enough to be a rule. Agents belong where the work is assembling and ranking, where errors are visible immediately, and where undo is free.

Why the line sits where it does

Three properties decide whether a task is safe to delegate, and they matter in this order.

1. 1.Reversibility. Can you undo it in one action, with nobody outside the team knowing it happened? A ranked list is fully reversible. A posted journal in a closed period is not, and a transmitted payment is not at all.
2. 2.Visibility of error. Will the mistake announce itself? A wrong worklist ordering is obvious to the collector reading it. A wrong accrual is invisible until the audit.
3. 3.Who carries the consequence. If the cost lands on a customer, a lender or a regulator, a human decides. Internal-only mistakes are cheap; external ones are not, and they are the ones that end up in a letter.

How a human stays accountable

“Human in the loop” means nothing unless the loop is specified. Six things make it real:

• A named owner per agent. Not a team. One person who reviews its output and switches it off when it drifts.
• Output arrives as a draft. Explicitly labelled, in a state that requires an action to become real. Never pre-approved, never auto-sent.
• Shown work on every number. The query behind each figure, visible without asking. If a controller cannot see how the number was derived, they cannot own it, and they will be asked to.
• An audit trail of every run. What ran, what it read, what it produced, what the human did next. This is what you hand an auditor who asks how the exceptions list was produced.
• Periodic sampling. Re-derive ten of the agent's outputs by hand each month. Not because you distrust it, but because schemas change and a checklist tied to a renamed field fails silently.
• A kill switch. One control, reachable in seconds, that stops the agent without a support ticket. If pausing it requires a vendor, it is not paused.

Before you deploy one

The failure pattern is deploying an agent onto a process nobody has written down. It automates the confusion.

1. 1.Write the task down as a procedure a new hire could follow, including the definitions. If you cannot, the agent will invent them.
2. 2.Fix the definitions the task depends on. What counts as overdue, what counts as material, what counts as open. These will be encoded whether or not you choose them.
3. 3.Run the agent in parallel with the human process for two cycles, and compare the outputs line by line. Two cycles catches period-end effects one cycle hides.
4. 4.Decide the escalation rule before go-live: what makes the agent stop and ask instead of proceeding. Absence of this rule is how quiet errors accumulate.
5. 5.Set the review cadence and the owner, and put both in writing where the audit committee can read them.

What this doesn't do

It does not replace accountants. It removes the assembly work that sits in front of judgement — the exports, the pivot tables, the chasing of the one person who knows where a field lives. The judgement itself is the job, and it is the part that gets squeezed when four hours go on preparation. Every hour of report-building that comes back is an hour available for the work you actually hired for; the reporting time savings calculator puts a number on how much of that your team is spending today.

It also does not fix a data problem. An agent reading a wrong AR ledger produces a well-organised wrong worklist, faster than before. Grounding comes first: see what grounded ERP AI means, and read the AI and ERP security checklist before you give any agent a credential.

How ERPray approaches agents

ERPray connects read-only by default through a least-privilege role you create, so an agent starts with no ability to change anything. Every answer carries the exact SuiteQL that produced it, which is what makes review possible rather than theoretical. Write access is enabled by you, per record type and per field, and every write shows a preview, takes your confirmation, writes an audit entry, and can be undone in one click. Every query and change is visible in a governance console. The free plan at launch includes one agent; more come with Pro.