Seven things an ICFR framework now expects you to evidence.
Not whether you use AI — whether you could show what it did. Answer seven questions about your own environment and get a workpaper naming the ones you cannot currently evidence, in the order worth fixing them. It is not an audit and it is not an opinion. It is the list you would rather write yourself than have written for you.
Questions derived from the control expectations published in FEI’s AI Framework: Internal Control Over Financial Reporting (June 2026) and COSO’s Achieving Effective Internal Control Over Generative AI (February 2026). FEI sells its framework for $195. These seven questions are free, and so is the workpaper.
Human in the loop
Loading…
Conclusion
This is a self-assessment, not an audit, an opinion or an assurance engagement. Byram Advisory Group is not your auditor. Nothing here was sent anywhere — the workpaper above was assembled in this browser from what you selected.
A Close Teardown is forty-five minutes on your actual close, and you leave with one written page: where the hours go, which entities do not tie, and which of these you still cannot evidence. Free, five a month, no access and no credentials.
The frameworks moved before the guidance did.
FEI published its ICFR framework for AI in June 2026 and COSO its generative-AI internal control guidance in February. Between them they set expectations that most finance functions have never been asked for: that a prompt is a controlled configuration item under change management, that evidence retention covers model versions and parameters, that performance is tested against data where the answer was already known, and that the external auditor sees the design rather than the result.
Big Four guidance has not landed. So the questions arrive from the audit committee before anybody has told you what a good answer looks like — which is the worst order for them to arrive in.
Nothing here is legal or audit advice, and Byram is not your counsel or your auditor. The frameworks are cited so you can read them yourself.