AI agents can act, which changes the risk

Most accounting firms have already used rule-based automation in some form.

A bank feed imports transactions. A workflow sends a client a document request. A recurring journal posts on the first day of the month. An onboarding checklist assigns tasks when a proposal is accepted.

These workflows follow a defined path. If condition A happens, perform action B. They can break, but their scope is usually narrow and visible.

AI agents are different. An agent can read unstructured documents, decide what information matters, call multiple systems, draft an action, and in some cases carry out that action. It can review a client email, retrieve prior messages, identify a missing payroll report, send a request, update a task record, and prepare workpapers for review.

That broader capability is useful. It is also where firm owners need to slow down.

The discussion in the Communications of the ACM article on the shift from rule-based automation to AI agents gets to the core issue. Enterprise applications are moving from systems that execute rules to systems that can reason through a goal and use tools to pursue it.

For an accounting or bookkeeping firm, tool access can mean access to Xero, QuickBooks Online, payroll platforms, banking data, bill payment systems, tax files, document storage, CRM records, and client communications.

If an agent can update client records or move money without constraints, it has not created efficiency. It has created an unreviewed liability.

The practical question is not, “Can we use AI in our firm?”

You can, and most firms in the $1 million to $25 million range already have several viable use cases.

The better question is, “What should an agent be allowed to do, what must it ask a human to approve, and how will we prove what happened?”

That is the work to do before deployment.

Start with the work that creates pressure

AI agents should be aimed at repeatable operational pressure, not at vague ambitions to automate the firm. Accounting firms have no shortage of that pressure.

Month-end is the obvious example. Many firms see 30% to 50% of staff effort compressed into roughly four weeks across month-end, quarter-end, and year-end periods. The exact pattern varies by client mix, but the result is consistent. Senior people are pulled back into clearing exceptions, chasing documents, reviewing coding, and explaining variances.

At the same time, advisory work gets crowded out. A partner might know a client needs a cash-flow conversation, a pricing review, or a headcount plan. But if the close pack is late, that conversation becomes another task pushed into next month. Advisory rates are often two to three times compliance rates, so this is not only a staffing issue. It is a margin issue.

Client onboarding creates another expensive drain. A new client signs, then documents arrive in fragments. Bank access is delayed. The existing chart of accounts does not match the firm’s standard reporting model. Historical balances need cleaning. The team sends reminders, waits, restarts, and tries to establish an opening trial balance from incomplete information.

We regularly see firms where 20% to 30% of new clients delay billable work by a quarter because onboarding did not reach a clean starting point quickly enough.

These are good agent opportunities because the work has clear inputs, decisions, exceptions, handoffs, and outcomes. It also contains data that needs protection and actions that must be controlled.

This is where Omni Ops comes in. The aim is not to replace the accountant’s judgment. It is to give the team an operating layer that gathers information, prepares work, routes exceptions, and keeps an evidence trail.

What an accounting AI agent should do end to end

An agent needs a defined job. “Help with month-end” is not a job definition. It is an invitation for scope creep.

A well-designed agent has a specific trigger, a fixed set of approved tools, a clear output, escalation rules, and an owner.

Take the Month-End Close Agent.

At the start of the close cycle, it pulls permitted bank, AP, AR, payroll, and general ledger feeds. It checks that expected accounts and files are present. It reconciles transactions against defined matching rules, identifies uncoded or duplicate entries, compares current balances with prior periods, and flags material variances.

It can then draft proposed journal entries, prepare supporting schedules, list unresolved items, and assemble a partner-ready close pack.

That is meaningful operational help. It removes hours of copying, checking, following up, and assembling. It does not mean the agent should post every entry it drafts.

A close agent should be able to:

• Read approved financial feeds and documents
• Match transactions within stated confidence and value limits
• Draft journals and workpaper notes
• Send document requests using approved templates
• Create tasks for exceptions
• Prepare variance explanations based on available evidence
• Route the completed close pack to a reviewer

It should not be able to:

• Post journals above a defined amount without review
• Change a client’s chart of accounts without an authorised approval
• Mark an unreconciled account as complete
• Suppress an exception because it believes the item is immaterial
• Send external advice that has not been reviewed
• Initiate payments, alter bank details, or release funds

The difference between those two lists is the difference between a productive agent and a risky one.

The Client Onboarding Agent is another strong example. It starts when the signed engagement and initial client data are received. It guides the client through a document workflow, tracks missing items, applies the firm’s standard chart-of-accounts mapping, detects inconsistencies in historical records, and creates a draft opening trial balance.

The agent can chase an unanswered request after a set number of days. It can tell the internal team that bank access is still missing. It can classify uploaded documents and attach them to the relevant onboarding task. It can prepare a list of assumptions for a manager to review.

It should not decide that a historical balance is correct simply because it resembles a prior client pattern. It should not change reporting structures without approval. It should not tell a client their books are ready until a responsible team member has signed off.

The Advisory Insights Agent sits further downstream. It reads each client’s completed monthly numbers, surfaces three issues worth discussing, and drafts a partner’s meeting talking points. That might include a gross margin change, a cash conversion issue, or a rise in payroll as a share of revenue.

Its output is a starting point for an adviser, not autonomous advice. The agent should cite the underlying numbers, distinguish facts from inferences, and make uncertainty visible. If a client’s revenue is up 12% but cash is flat because receivables have stretched, the partner needs the numbers and context before speaking to the client.

You can see how these capabilities fit within the broader Omni platform. The point is not an AI chatbot on top of the firm’s systems. The point is controlled operational work that moves through the right approvals.

Guardrails need to be designed before access is granted

Many firms approach AI tools backwards. They connect systems first, test the capability, and discuss controls once the agent has done something surprising.

Do the opposite.

Before an agent receives access to client data or financial tools, build a guardrail register. This does not need to be a 40-page policy document. It needs to be specific enough that a partner, operations lead, and implementation team agree on what can happen.

1. Define the agent’s authority by action

Do not define access only by system. “The agent can access QuickBooks” is not a control.

Define the approved actions inside that system.

For example, the Month-End Close Agent may read transactions, create draft journals, and open review tasks. It may not post a journal, edit prior-period entries, change user permissions, or modify bank details.

For every action, assign one of four levels:

1. Read: the agent can retrieve information.
2. Draft: the agent can create a proposed document, journal, email, or task.
3. Execute with approval: the agent prepares the action, then a named person approves it.
4. Execute automatically: the agent completes a low-risk action inside preset limits.

Most accounting actions should start in the first three levels. Automatic execution should be reserved for low-risk, reversible work, such as creating an internal task when a bank feed has not refreshed.

2. Set dollar, materiality, and confidence thresholds

Not every exception needs the same treatment.

A $42 duplicate software charge and a $42,000 unexplained payroll variance cannot sit in the same approval queue. Build thresholds that reflect the client’s size, the type of transaction, and the potential consequence.

A firm may decide that an agent can suggest coding when it has high confidence and the transaction is below a modest threshold. The proposal still remains reviewable. A transaction involving payroll, tax, owner drawings, related parties, debt, or bank details should route to a person regardless of value.

Confidence is not the same as correctness. An agent can be very confident about a wrong classification if the source information is misleading or incomplete. That is why the rule should be: low confidence escalates, but high confidence does not remove controls in sensitive categories.

3. Separate preparation from approval

This is a basic accounting principle applied to agents.

The system that assembles a close pack should not be the system that approves the close. The agent that drafts a payment request should not approve or release it. The agent that identifies an onboarding gap should not certify that the client is fully onboarded.

Separate duties protect the firm and make review faster. A manager can open a queue and see exactly what the agent prepared, what evidence it used, what rule it applied, and what approval is required.

If your current workflow depends on someone checking a shared inbox and remembering what was agreed in a Teams message, an agent will expose that weakness quickly. That is useful. It tells you where the operating process needs tightening before automation expands it.

4. Keep an audit trail that a partner can read

Every meaningful agent action needs a record.

That record should show:

• The trigger that started the workflow
• The source documents and systems used
• The data retrieved
• The rule, instruction, or policy applied
• The action proposed or taken
• The reviewer and approval decision
• Any changes made after review
• The final outcome

This is not just for a future dispute. It helps during normal operations. When a client asks why a balance changed, your team should not have to reverse-engineer an AI conversation. They should be able to see the source transactions, the draft entry, reviewer comments, and final posting decision.

A useful test is simple. Could a partner explain the agent’s action to the client in under five minutes, using evidence rather than vague system output? If not, the workflow needs more structure.

5. Make exceptions visible, not invisible

The biggest agent risk is not always a dramatic incorrect action. It is quiet failure.

An agent that cannot access a payroll report might proceed using an old file. An agent might match a transaction to a vendor based on a similar name. It might interpret an emailed instruction as approval when the sender did not have authority.

Design explicit stop conditions. If a required source is missing, the workflow pauses and creates an exception. If the source data conflicts, it flags the conflict. If a request falls outside the agreed policy, it routes to the owner.

The agent should be rewarded for identifying uncertainty, not for making every queue disappear.

Approval workflows should match the real risk

A good approval workflow is not a universal “human in the loop” button. If every small action waits for a partner, the agent adds another bottleneck. If nothing waits for approval, the firm has lost control.

Match the workflow to the risk.

For low-risk operational tasks, such as requesting a missing bank statement or creating an internal checklist item, the agent can act automatically. The activity should still be logged.

For work that affects the accounting record, the agent should generally draft and route. A preparer or manager reviews the evidence, accepts or rejects the recommendation, and records a reason when overriding it.

For high-risk actions, such as payment instructions, bank detail amendments, tax submissions, owner-related transactions, or changes to client access permissions, use dual approval and an independent confirmation process. No agent should be the final authority.

It is also sensible to set time-based controls. A manager may approve a standard journal during the normal close window, while out-of-hours changes route to a partner. A payment-related request may expire if it is not approved within a short period, forcing a fresh review rather than allowing an old instruction to proceed.

This is the type of implementation work covered in the AI audit for accounting and bookkeeping. It maps the manual workflow before choosing what the agent will do, where it will stop, and who owns the approval.

The financial case is bigger than labour savings

Accounting firms often assess automation through one lens, headcount reduction. That is too narrow.

The stronger case is capacity recovery and margin protection.

If your firm has annual operational leakage in the range of $60K to $180K, it is rarely sitting in one obvious line item. It is spread across repeated follow-ups, incomplete onboarding, rework after coding errors, senior review of low-value exceptions, late close packs, and client conversations that never happen because the team is still finishing compliance work.

A Month-End Close Agent that cuts preparation work does not eliminate review. It makes review more valuable. Reviewers spend less time finding files and more time assessing anomalies.

A Client Onboarding Agent can reduce the time between signed engagement and first billable output. That protects cash flow and reduces early client frustration.

An Advisory Insights Agent can give partners a repeatable starting point for higher-value conversations. It does not create advisory capability by itself. It clears the operational noise that often prevents the conversation from happening.

For a practical way to map this work, use the Month-End AI Close Map for Accounting Firms. It is a worksheet for identifying the close stages, source systems, reviewer points, exceptions, and actions that should never be automated without approval. You can also download the direct worksheet here.

The best early deployments do not try to automate every client at once. Pick a bounded workflow, use a small client cohort, run the agent in draft mode, compare its outputs with the team’s work, and log every exception. Once the evidence is sound, expand authority carefully.

If you want to identify the right first workflow, the required controls, and the commercial upside, Book a 60-min Omni Audit. In 60 minutes, we work through three outputs: the highest-leakage workflow, the agent design and guardrails, and a practical deployment path. No deck.

Build the controls before the agent becomes indispensable

The danger with useful technology is that teams quickly depend on it before governance catches up.

An agent that saves the bookkeeping team three hours each close will soon be trusted with more. Then it gets access to another system. Then someone asks it to post entries rather than draft them. Then an exception is missed because the workflow was built for speed rather than accountability.

Avoid that path.

Set the agent’s purpose. Limit its tools. Define what it can read, draft, and execute. Make approvals specific. Keep a clear action log. Test the exceptions as hard as the happy path.

This does not slow the firm down. It gives you a way to scale operational capacity without handing control to an opaque process.

You can review the operating model behind this approach at See Omni for accounting and bookkeeping, or look through our wider AI implementation resources as you build your internal plan.

The firms that get value from AI agents will not be the ones that give an assistant unrestricted access to client systems first. They will be the firms that decide, in advance, where judgment belongs and build the workflow around it.

When you are ready to map that against your own close, onboarding, and advisory processes, Book my Omni Audit.