SAP’s News Center ran a piece this month with a blunt headline: AI agent sprawl is now a board-level issue. Not an IT issue. Not a “we’ll get to it in Q3” issue. A board issue, because most companies deployed AI agents faster than they built any policy for what those agents can touch, who approves their output, and who owns the mistake when one shows up.

Accounting and bookkeeping firms should read that headline twice. You’ve probably got AI touching client bank feeds, drafting journal entries, or summarizing tax positions right now. Maybe it’s a tool your team adopted on their own. Maybe it’s baked into your practice management software and nobody flagged it as “AI” at all. Either way, if a regulator, an insurer, or a client’s lawyer asked you today “show me your written policy on how AI accesses client financial data,” could you produce one?

Most firms in the $1M-$25M range can’t. That’s not a judgment. It’s just where the industry is right now. But the gap is closing fast, and the firms that write the policy before they’re forced to are going to look very different from the ones that write it after an incident.

What “governance” actually means for a bookkeeping or tax practice

Governance sounds like a big word for a 12-partner firm. It isn’t. For a firm your size, AI governance boils down to three written answers.

Data access. Which AI tools can see client bank feeds, payroll data, and tax documents, and under what conditions. Does your bookkeeping AI have read access only, or can it write journal entries without a human reviewing them first. Who at the firm can approve a new AI tool’s access to a client’s data before it goes live.

Client consent. Have your clients actually agreed to AI touching their financial records? Most engagement letters were written years before any of this existed. If a client’s data gets processed by a third-party AI model and something goes wrong, your engagement letter is the first document anyone pulls. If it’s silent on AI, you’re negotiating from a weak position.

Error accountability. When an AI-drafted journal entry is wrong, who’s responsible? The software vendor? The staff member who didn’t catch it? The partner who signed off? Right now, for most firms, the answer is “we haven’t thought about it.” That’s the exact sentence you don’t want to say out loud to your E&O carrier.

None of this requires a legal department or a 40-page manual. It requires a one-to-two page written policy that names the tools you use, what they’re allowed to touch, how clients are notified, and who signs off before anything goes to a client. Firms that have this in place before it’s mandatory get to set the standard. Firms that wait get to comply with whatever standard someone else writes for them, usually a state board, an insurer, or a client’s general counsel.

The cost of waiting isn’t hypothetical

Here’s the part that’s easy to skip past: this isn’t just a compliance exercise. It’s tied directly to the money leaking out of your firm every year.

Firms in your revenue band typically lose somewhere in the $60,000 to $180,000 range annually to a mix of things that all trace back to the same root cause, work that’s manual, inconsistent, or dependent on one person’s memory instead of a documented process. Month-end close eats 30-50% of staff capacity in a four-week window, every single month, for firms that haven’t automated the reconciliation and variance-flagging work. New client onboarding drags on for weeks, and 20-30% of new clients delay a full quarter of billable work because document collection and chart-of-accounts setup take forever. And advisory conversations, the ones billing at 2-3 times your compliance rate, get crowded off the calendar entirely because compliance work fills every open hour.

Here’s the connection most owners miss. You can’t fix the leakage without AI doing more of the manual work. And you can’t safely hand AI more of the manual work without governance rules that say what it’s allowed to touch and who checks its output. Firms that skip the governance step and just bolt on AI tools tend to hit a ceiling fast, usually right around the point where a client asks “wait, did a robot do my tax return” and nobody has a clean answer.

What this looks like when it’s done right

We build agents for firms in this exact spot, and the governance conversation happens before the agent ever touches a live client file, not after.

Take the Month-End Close Agent. It pulls bank, AP, AR, and payroll feeds, reconciles them, flags variances outside a set threshold, drafts the journal entries, and prepares a partner-ready close pack. The governance layer sits underneath all of that. The agent has read access to the feeds it needs and nothing more. Every journal entry it drafts is flagged as AI-drafted until a partner or senior bookkeeper approves it. Nothing posts without a human signature. That’s not a limitation we apologize for, it’s the design. A well-governed agent doesn’t need permission to draft. It needs a clear boundary on what it can post without a person in the loop.

The Client Onboarding Agent works the same way. It runs new clients through a guided document collection workflow, sets up the chart of accounts, and produces a clean opening trial balance, work that normally eats two to four weeks of back-and-forth. The governance question here is consent. Clients know, in writing, that an AI workflow is collecting and structuring their financial data before a human ever reviews it. That single sentence in your onboarding agreement solves 90% of the consent problem most firms haven’t addressed yet.

The Advisory Insights Agent reads each client’s monthly numbers, surfaces three things worth discussing, and drafts the partner’s talking points before the meeting. It never talks to the client directly. It never sends anything without a partner reading it first. That boundary is the accountability answer built right into how the tool works, not bolted on afterward.

Agents like these live inside what we call Omni ops, and the governance thinking isn’t a separate document sitting in a drawer. It’s built into how each agent is scoped from day one, which is exactly the standard the SAP piece argues every board should be demanding of every AI deployment right now.

Building your own policy, even before you touch AI agents

You don’t need to wait for an Omni engagement to start writing your governance policy. Pull together a one-page document naming every AI tool currently touching client data, whether that’s your bookkeeping software’s auto-categorization feature, a tax research assistant, or a document scanner with OCR built in. Note what data each tool can access, who approved it, and whether your engagement letters mention AI at all. If they don’t, that’s your first fix, and it’s a five-minute conversation with whoever drafts your client agreements.

If you want a structured way to work through this for the month-end process specifically, we put together the Month-End AI Close Map for Accounting Firms, a practical worksheet that walks through where AI touches your close process today and where the accountability gaps sit. You can grab the close map here and work through it with your team before your next month-end cycle, no meeting required.

For more on how firms are thinking through the practical side of AI adoption, our blog covers specific implementation questions firms bring to us every week, and the guides section has broader material on setting up AI workflows that hold up under scrutiny.

Why an Omni Audit is the faster path than writing this alone

A written policy is a good start. But the real governance test isn’t the document, it’s whether your actual workflows match what the document says. Most firms find gaps the moment they map their real process against their stated policy, and those gaps are exactly where regulators, insurers, and plaintiffs’ lawyers look first.

That’s what the Omni Audit does. It’s 60 minutes, no deck, no sales pitch dressed up as a workshop. We map your current month-end, onboarding, and advisory workflows, show you exactly where AI is already touching client data (often more places than owners expect), and hand you three outputs, a leakage estimate specific to your firm, a governance gap list, and a prioritized plan for what to fix first. You walk away with something concrete, not a proposal to read later.

If you’d rather see the audit specifically built for firms like yours, see Omni for accounting and bookkeeping and you’ll find the same three-output structure laid out for this vertical. It’s the same audit we use to figure out whether a firm’s leakage sits closer to $60K or closer to $180K, and where governance gaps are quietly making that number worse.

Book a time and walk through this with us directly. Book a 60-min Omni Audit and bring whatever AI tools you’re currently using, we’ll help you figure out what needs a policy today versus what can wait.

The firms that move now set the standard

Every wave of technology regulation follows the same pattern. The early movers who wrote sensible internal rules before anyone forced them to end up shaping what the eventual standard looks like. The firms that wait get handed a standard written by someone who doesn’t understand bookkeeping workflows at all, usually a state board responding to one bad headline.

You’ve got a window right now to write your own rules on data access, client consent, and error accountability, while the rules are still yours to write. Firms that use this window well aren’t just avoiding risk. They’re building the kind of documented, defensible process that makes it easier to bring on new advisory clients, easier to pass a PCAOB-adjacent review if one ever comes, and easier to sleep at night knowing exactly what your AI tools can and can’t touch.

Take a look at the AI audit for accounting and bookkeeping if you want to see where your firm actually stands, or explore our broader insights for more on how firms in this range are approaching AI adoption without creating a liability problem for themselves. And if you’re ready to put a number on what governance gaps and manual workflows are actually costing you, book my Omni Audit and we’ll get you a straight answer in an hour.