Accounting Firm AI Governance Checklist

Accounting firms are adopting AI through multiple paths at once: ChatGPT, Claude, Microsoft Copilot, tax and practice-management platforms, document tools, spreadsheets, client portals, and AI-enabled SaaS.

That creates a simple governance problem. Staff may be using AI before the firm has agreed what client data can be used, what outputs must be checked, and who owns the risk.

Use this checklist to create a practical starting point.

Download the Accounting Firm AI Governance Checklist for workshop use.

1. Tool Visibility

Confirm the firm knows which AI tools are in use.

Check:
- Staff use of ChatGPT, Claude, Gemini, and similar tools
- Microsoft Copilot licences and pilot groups
- AI features inside tax, accounting, payroll, practice-management, document, CRM, and reporting platforms
- Personal accounts versus firm-managed accounts
- Client portal or workflow tools with AI features
- Browser extensions and meeting assistants

Assign an owner for the AI tool register and review it regularly.

2. Client Data Boundaries

Accounting firms handle information that should not be casually copied into AI tools.

Set rules for:
- Client financial statements and management accounts
- Tax file numbers and other identifiers
- Payroll and employee data
- Bank statements and transaction files
- Working papers and reconciliations
- Business plans, valuations, forecasts, and cash-flow material
- Client correspondence and portal records
- Firm pricing, templates, and internal methodology

Where AI use is permitted, define whether data must be de-identified, summarised, synthetic, or approved first.

3. Approved Use Cases

Start with lower-risk use cases that still deliver value.

Examples:
- Drafting internal checklists
- Improving readability of non-sensitive client education material
- Creating meeting agendas from non-confidential notes
- Summarising vendor documentation
- Drafting internal training material
- Producing first-draft templates for review

Use extra review for client-specific analysis, tax-related drafts, financial commentary, calculations, recommendations, or report content.

4. Human Review Before Client Use

AI output can be plausible and wrong.

Before material is used in client work, reviewers should check:
- Numbers, formulas, assumptions, and source data
- Tax, accounting, and reporting context
- Client-specific facts and restrictions
- Confidentiality and privacy considerations
- Whether the output overstates certainty
- Whether the output is appropriate for the client relationship

The firm should be able to show how important outputs were checked.

5. Vendor And SaaS Settings

AI features inside existing platforms can be easy to miss.

Ask vendors:
- What client or firm data is processed by the AI feature?
- Is data used to train or improve models?
- Can training or product improvement use be switched off?
- Where are prompts, files, outputs, and logs stored?
- How long is information retained?
- What administrator controls and exports are available?
- How are feature changes communicated?

Record the answer in the tool register.

6. Copilot And Microsoft 365 Exposure

If Copilot is being piloted, review what licensed users can access.

Check:
- SharePoint sites for clients, service lines, HR, finance, and leadership
- Teams workspaces and channels
- OneDrive shared folders
- Mailboxes and shared mailboxes
- External sharing links
- Old client folders and archived content
- Broad groups with access beyond the intended team

Copilot readiness is partly a permissions and content-governance question.

7. Incident And Exception Handling

Create a simple path for unclear or accidental AI use.

Record:
- What happened
- Which tool was used
- What data may have been entered
- Whether client or personal information was involved
- Who reviewed the issue
- What action was taken
- Whether guidance needs to change

This should be simple enough that staff actually use it.

8. Leadership Evidence

Leadership should be able to inspect:
- AI tool register
- Approved and restricted use cases
- Vendor setting notes
- Staff guidance
- Copilot permission review notes
- Review examples for client-facing outputs
- Exception and incident log
- Action tracker for unresolved risks

The goal is practical governance that supports adoption while reducing avoidable exposure.

Contact Summit Guard to discuss a focused AI governance starting point for your firm.