How AI is reshaping SOX, ICFR, and Internal Audit for the next era of assurance
How may artificial intelligence (AI), especially generative AI and agentic technologies, reshape Sarbanes-Oxley (SOX) compliance and internal control over financial reporting (ICFR) by 2030 and beyond? This article explores how these technologies could transform the design, execution, monitoring, and assurance of internal controls, helping SOX leaders, finance executives, risk and compliance professionals, and audit committees prepare for the next wave of change.
SOX is no longer evolving at the margins. It is shifting from a periodic compliance exercise to a continuous, automated, and increasingly predictive capability embedded within the business itself.
This white paper outlines the five points of view that KPMG believes will define the future of SOX:
A new SOX frontier: auditing AI itself
As organizations embed AI models, generative AI copilots, and autonomous agents into financial workflows, a critical new mandate will emerge, providing meaningful assurance over the AI systems themselves.
The integrity of financial reporting will depend, in part, on the integrity of the models that underlie it.
The rise of “self-healing” controls
The next generation of controls will be preventive, embedded, and increasingly self-healing. Rather than waiting for a control to alert users that a server does not have the correct configuration, tomorrow’s control environments will be configured to identify, flag, and in some cases automatically correct this anomalous condition in real time before it can introduce the possibility of errors in financial reporting.
Synthetic data as a risk intelligence tool
Among the most innovative applications of AI in the ICFR context is the use of synthetic data, artificially generated datasets that mirror the statistical properties of real transaction populations, to anticipate where control gaps and risks may emerge before live data is ever involved.
Synthetic data testing allows organizations to pressure-test that window in advance.
From sampling to full population testing
Where appropriate, digitally enabled testing will allow both management and external auditors to examine 100 percent of transactions within scope, not on an annual basis, but continuously.
Continuous, real-time assurance
Full population testing is not an end in itself; it is the enabler of something even more valuable: continuous, real-time assurance over the control environment.
From auditor to strategic advisor
The ICFR function of the future will require professionals who are simultaneously fluent in accounting standards and AI systems, risk frameworks and data science, traditional audit methodology, and emerging technology risk.
This is a shift from assurance to insight.
The Future of SOX: A point of view for 2030 and beyond
How AI is reshaping SOX, ICFR, and Internal Audit for the next era of assurance
Download PDFThe opportunities presented by AI in the SOX and ICFR context are real and significant. But they arrive alongside a set of challenges that are equally real and should not be minimized.
1
2
3
4
Organizations that approach this moment strategically, investing in technology, talent, and governance infrastructure now, stand to reap significant benefits.
Full population testing and continuous monitoring will fundamentally raise the level of assurance available over the control environment.
As AI assumes a greater share of transactional audit work, data collection, testing, exception identification, the professionals who make up the ICFR function will be freed to focus on higher-value activities: control design advisory, risk management strategy, governance oversight, and the kind of qualitative judgment that no AI system can replicate.
Most significantly, AI-enabled continuous monitoring transforms the ICFR function from a reactive to a proactive posture.
Craft a bold AI strategy. Develop a clear and ambitious roadmap for how your organization will adopt, scale, and govern AI within your ICFR programs.
Invest in talent. Begin cultivating and recruiting AI-literate talent within your audit, compliance, and risk functions now.
Conduct a controls clean-up. Before layering AI onto an existing control environment, invest the time and effort required to ensure that environment is sound.
Focus on measurable outcomes. Deploy AI solutions that are linked to your enterprise’s strategic priorities and can demonstrate measurable results.
Establish robust governance. Build the governance infrastructure, policies, standards, oversight mechanisms, and change management processes that will allow your AI initiatives to scale responsibly.
Redesign for AI-enabled capacity. Fundamentally rewire your ICFR strategy and operating model to incorporate AI agents as core contributors alongside human professionals.
Foster organizational agility. The organizations that will thrive in the AI era are those that can move quickly, learn continuously, and adapt at pace with an evolving technology landscape.
AI does not reduce the need for SOX, it raises the stakes. As financial processes become more digital, more automated, and more dependent on intelligent systems, organizations will need controls that are stronger, faster, and more adaptive than the ones that carried them through the last two decades.
KPMG offers a range of capabilities to help organizations modernize their SOX programs and prepare for an AI-enabled future, including:
Whether your organization is exploring the first practical uses of AI or pursuing broader transformation, KPMG can help you move with greater clarity, confidence, and control.
