Share

From Guidance to Governance: Applying COSO’s new GenAI Standards with Confidence

Generative AI (GenAI) is being rapidly adopted across organizations far faster than governance structures, internal controls, and risk management processes can keep pace. Teams are already using AI agents, auto‑reconciliation tools, and AI‑generated analysis in day‑to‑day workflows, but many of these capabilities introduce risks that traditional control models were never designed to address. For executive, compliance, and risk leaders, the practical question is no longer whether AI will affect the control environment. It is how quickly management can identify where AI is being used, determine which use cases create meaningful business risk, and produce evidence that governance and controls are operating effectively.

In February 2026, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) released its first GenAI‑specific internal control guidance, Achieving Effective Internal Control Over Generative AI. The publication adapts the COSO Internal Control Integrated Framework (2013) to the unique risks, behaviors, and scalability of GenAI and introduces an eight‑capability model for organizations to design, implement, and monitor AI‑enabled controls. For many organizations, this guidance is most effective when paired with the NIST AI Risk Management Framework (AI RMF), including NIST’s Generative AI Profile, which helps management connect internal control expectations to broader AI governance, trustworthiness, and risk management practices.

This is particularly critical when GenAI outputs influence financial reporting, disclosures, or the execution of internal controls over financial reporting (ICFR), where accuracy, reliability, and auditability are essential to support management’s assertions and audit reliance.

Why COSO Issued New GenAI Guidance

At its core, COSO’s new guidance leaves organizations with a simple message: GenAI changes how internal controls need to work. These systems are not predictable, rule‑based technologies; they are dynamic, probabilistic, and can behave differently from one day to the next. COSO highlights that GenAI can be “confidently wrong,” evolve rapidly, scale mistakes as quickly as it scales value, and be used by virtually anyone in the business with minimal barriers.

Because of this, organizations can’t rely on traditional internal controls alone. The new guidance requires organizations to update their control environment, risk assessments, control activities, information flows, and monitoring processes to account for GenAI‑specific risks such as hallucinations, bias, model drift, data leakage, and rapid vendor‑driven changes.

COSO’s message is not “slow down your AI adoption.” It’s the opposite: deploy AI but do it responsibly without compromising accuracy and reliability. That means clearer objectives, stronger governance, better traceability, continuous monitoring, and defined accountability for how AI is used across business processes. The NIST AI RMF reinforces this same point through its Govern, Map, Measure, and Manage functions, giving leaders a practical way to connect AI risk management activities to business decisions, regulatory expectations, and control evidence.

What Organizations Need to Rethink

GenAI does not replace the COSO framework; it changes how the framework is applied. COSO’s new GenAI guidance raises the bar for internal controls, while the NIST AI RMF provides a broader risk management lens for trustworthy AI. Together, they help organizations move beyond AI policies and toward evidence-based governance. AI now influences how controls are designed, how evidence is evaluated, and how governance and oversight function. This means rethinking SOX, AI governance, COSO alignment, NIST AI RMF alignment, risk and control design, and enhanced third‑party oversight to keep pace with GenAI adoption.

Here are some key considerations leaders should evaluate:

• SOX / ICFR: GenAI creates new challenges for evidence, review, and reliance. Companies should define when AI is advisory versus relied upon, and strengthen documentation, reviewer competence, and validation practices accordingly.
• GenAI Governance: Effective governance requires named owners, role‑based training, and a forum that can oversee AI risks and approve or unwind changes quickly. The goal is fast, informed oversight that keeps pace with how AI evolves and aligns with recognized frameworks such as the NIST AI RMF.
• Risk Assessment and Control Design:
  • GenAI use cases should be evaluated with defined limits, risk-based safeguards, and review mechanisms designed for outputs that may appear credible even when they are inaccurate.
  • Strong design includes thoughtful human‑in‑the‑loop review points, governed configurations, and testing that accounts for drift and edge cases.
• Vendor and Third‑Party Risk: Vendors that incorporate AI into their services may update models, configurations, or underlying data sources on their own timelines, creating added risk when customers have limited visibility into those changes or their impact on control performance. Organizations should establish monitoring, testing, and contractual guardrails to ensure vendor changes do not undermine control performance.
• Framework Alignment: Many clients are now asking how COSO, the NIST AI RMF, and emerging AI governance expectations fit together. Organizations should avoid treating these as separate compliance exercises and instead map use cases, risks, controls, testing, and monitoring activities across the frameworks to create a single, defensible AI governance model.

Six Steps to Apply COSO’s GenAI Guidance

To operationalize COSO’s guidance and strengthen GenAI governance, organizations should focus on six core activities that build structure, transparency, and control around how AI is deployed. These steps can also support NIST AI RMF alignment by helping management demonstrate how AI risks are governed, mapped, measured, and managed in practice:

1. Establish an AI Governance Structure: Define who owns each AI use case, how decisions are made, and how risks are escalated.
2. Inventory GenAI Use Cases: Identify all active and planned AI use cases, including purpose, data sources, owners, and dependencies. This creates visibility into where GenAI is operating and surfaces any shadow usage that may introduce unmanaged risk.
3. Leverage the COSO Components and NIST AI RMF Functions: Focus on GenAI‑specific data and model output risks such as drift, hallucinations, bias, data exposure, prompt manipulation, and third‑party dependencies, and determine risk criticality.
4. Design and Map Controls: Ensure consistency and audit readiness by developing controls that match the level of risk for each use case, including access restrictions, prompt restrictions, human‑in‑the‑loop checkpoints, validation routines, and governed configurations.
5. Implement and Communicate: Deploy the designed controls and train users on how to interact with GenAI responsibly, interpret outputs, and escalate issues or changes that require review.
6. Monitor and Adapt: Track performance through defined KPIs and KRIs, such as exceptions identified, prompt violations, approved vs. unapproved use cases, etc. and review changes to models, prompts, data sources, or vendor configurations regularly. This is especially important because AI risk management is not a one‑time policy exercise; it requires ongoing evidence that controls remain effective as models and use cases change.

Questions Risk and Control Leaders Should Be Asking

As leaders embark on their AI Governance journey, they should be asking:

• Where is GenAI being used in business processes today?
• Which use cases affect financial reporting, compliance, or customer/stakeholder outcomes?
• Are we relying on AI outputs, or are they only advisory?
• What controls validate AI-generated outputs before use?
• Who owns AI-related risks and control failures?
• What evidence would support management’s conclusions if challenged by auditors, regulators, or the board?
• How do we know vendor AI changes have not impacted our control environment?

How Centri Can Help

Centri helps organizations approach AI risk management by building clearer governance structures, updating internal controls, and strengthening processes where AI influences day‑to‑day operations. Our teams work with management to identify use cases, assess how they intersect with key organizational functions, perform AI RMF assessments across the Govern, Map, Measure, and Manage functions, and develop practical roadmaps to close gaps and support reliable performance.

Whether AI tools are built internally or provided by third parties, Centri helps create clarity, consistency, and confidence in how GenAI is used across the business by aligning governance, risk assessment, control design, monitoring, and evidence practices to leading frameworks such as COSO and the NIST AI RMF.

Editor’s note: This article was originally published on March 4, 2026. It was updated on August 7, 2026.

Rich Sowalsky

Partner | Risk Advisory Practice Leader | CISA

Rich is a Partner at Centri Business Consulting and the leader of the firm’s Risk Advisory Practice. He has more than 17 years of combined experience in risk & internal control consulting, internal audit, IT risk & cybersecurity advisory, Sarbanes-Oxley (SOX) 404 Compliance, Enterprise Risk Management, financial reporting & accounting. He joined Centri in February 2022 and has provided a variety of risk advisory and compliance services for clients across various industries, including insurance, digital assets & fintech, life sciences, financial services, healthcare, technology, and more.. View Rich Sowalsky's Full Bio

Ian O’Connor

Senior Manager | IT Risk & Cybersecurity | CRISC, CISA, AAIA

Ian is a Senior Manager in the IT Risk & Cybersecurity practice at Centri Business Consulting. He has more than 8 years of combined experience in internal control consulting, IT risk, cybersecurity advisory, and risk-based internal audits and accounting. View Ian O’Connor's Full Bio