AI Governance Framework for Accountants

AI governance assigns responsibility for your practice’s AI use. Give every approved use an owner, record its limits and check that staff follow them.

A small accounting practice can run this through its existing quality management arrangements. The framework needs to cover AI features inside familiar software as well as separate AI tools.

What AI Governance Means

AI governance is how your practice decides which AI uses are acceptable, who approves them and how problems are found and corrected. A staff policy is one part of that framework.

Responsible AI means using AI with attention to its effects on people, including privacy, accuracy and fairness. Governance turns that aim into assigned work and recorded decisions.

For a regulated practice, responsibility stays with the practitioner. The TPB’s AI guidance requires professional judgement when relying on AI outputs. AI does not replace the practitioner’s analysis of a client’s circumstances.

An incorrect answer can become incorrect advice if staff accept it without checking. Unapproved access can expose client information before anyone reviews the answer. The framework must address both points.

Enterprise AI governance applies the same approach across a larger organisation. A small practice needs fewer roles and documents, while keeping clear authority over each use.

An AI Governance Framework for a Small Practice

Build the framework around an accountable principal and a register of approved uses. The following operating model is a practical starting point, not a regulator-prescribed form or review timetable.

Name the Owner

Give one principal responsibility for the framework and authority to suspend an AI use. Assign a staff owner to each registered use. In a small practice, one person can hold both roles.

The principal approves the boundaries. The staff owner keeps the entry accurate and reports problems. Identify a deputy so leave does not leave approvals unanswered.

Keep an AI Register

Record uses separately when their purposes or permissions differ. One product might be approved for drafting generic correspondence but remain unapproved for reviewing client documents.

Give each entry enough detail for another staff member to understand the decision:

• Product and AI feature, including the model where staff can identify it.
• Business purpose and the people affected.
• Staff owner and approving principal.
• Information permitted and information excluded.
• Connected accounts, files and actions available to the tool.
• Required client permission or disclosure, where applicable.
• Human checks and where their evidence is kept.
• Approval status, restrictions and next review.
• Incident contact and instructions for stopping use.

Keep the supporting assessment beside the entry. Use an AI risk assessment for the individual use instead of treating purchase approval as approval for every task.

Approve the Use Before Client Work

Require staff to describe the task and proposed information before approval. Assess confidentiality and privacy, provider terms, security and the effect of an incorrect result.

Choose an explicit outcome: approved within stated limits, approved for a restricted trial or declined. Keep trial work on invented information until the practice authorises the relevant data handling.

Code item 6 requires client permission before third-party disclosure of information about their affairs, unless a legal duty applies. Build that decision into approval before information reaches the tool.

Define the Output Review

Specify what the reviewer must check for each approved use. For tax research, compare the answer with the relevant legislation and official guidance before it supports client advice.

For a drafted client letter, check the recipient, client facts and requested action. Record the reviewer and corrections with the final work. A generic instruction to use professional judgement leaves the actual checking task unclear.

AI model governance also covers changes to the model or its settings. Reassess an approved use when a change affects output quality, data handling or connected actions.

Review the Framework Each Year

Set an annual review as a practice timetable, with earlier reviews after incidents or material changes. Check whether the register matches actual use and whether staff can find the current policy.

Sample completed work to see whether the required reviews happened. Close unused accounts and remove access that no longer has an approved purpose. Record each issue with an owner and completion date.

Australian Frameworks to Borrow From

Start with the National AI Centre’s Guidance for AI adoption. Its foundations guidance suits organisations beginning with lower-risk uses. Use the implementation guidance for more complex or higher-risk uses.

The Department of Industry, Science and Resources says the Guidance for AI Adoption evolves the Voluntary AI Safety Standard. The earlier standard has 10 guardrails. The newer guidance groups its approach into six practices.

The foundations guidance starts with accountability, impact assessment and risk management. It also covers sharing information and testing and monitoring. Human oversight is the sixth practice.

For your practice, borrow the overall owner and AI register first. Add a route for clients or staff to raise concerns and have a person review the outcome. Cover embedded AI features in the register too.

The implementation guidance adds detail on responsibilities across suppliers, ongoing risk assessment and correcting failures. Use those parts when connected tools or higher-impact decisions make the basic process insufficient.

These frameworks help organise work. The voluntary standard creates no new legal duties. Existing professional obligations and applicable privacy law still govern what the practice does.

How to Implement AI Governance

Roll out the framework over three months, starting with an inventory and ending with evidence that the approval process works. This is a suggested practice schedule.

Month 1: Find Existing Uses

Appoint the principal and ask staff which AI features they already use. Include browser tools and AI features enabled inside existing subscriptions. Record unapproved uses separately and pause client-data uses awaiting assessment.

Create the register and choose the first low-risk use to assess. At the end of the month, each identified use needs an owner and a status, even if that status is awaiting assessment.

Month 2: Approve and Train

Complete assessments for the uses you intend to retain. Set their permitted information and review requirements. Give staff an AI policy template adapted to those decisions, with a clear route for requesting a new use.

Walk staff through an invented task. Ask them to identify an excluded input and show how they would report an incorrect result. Record attendance and fix misunderstandings before approving broader use.

Month 3: Check Actual Work

Inspect a sample of work from each approved use. Compare the information entered with its register limits and find the human review record. Speak with staff about workarounds and unexpected results.

If the record is missing, investigate how the work passed through review and repair that step. If staff are using an unregistered feature, assess it before allowing that use to continue.

The rollout is complete when the principal can trace a sampled job from approved use through permitted input to checked output. Schedule the annual review and assign any remaining corrections.

Governing AI Agents

An AI agent can take actions through connected tools, such as changing a file or sending a message. Govern those permissions separately from permission to generate text.

The Australian Signals Directorate’s agentic AI guidance recommends limiting initial use to low-risk tasks. It warns against broad access and describes prompt injection through material an agent reads.

Prompt injection is an attempt to make instructions inside a document or message redirect the agent. Treat client documents and incoming emails as information to inspect, not authority to change the agent’s task.

For a practice considering a file or messaging agent, require these safeguards before authorising access:

• Restrict access to the approved folders and actions. Keep deletion and changes to bank details outside the initial trial.
• Start with read-only access or draft messages. Require a person to approve the actual recipient and content before a client message leaves.
• Give the agent a distinct account or identity where supported. Remove its access without disabling a staff member’s account.
• Record attempted actions and approvals. Make the person responsible for monitoring them explicit.
• Test refusal of an out-of-scope instruction using invented files. Confirm that the practice can stop the agent and investigate its actions.

ASD’s agentic AI harness guidance explains that permissions must also operate in the software connecting the model to tools. A written instruction alone cannot enforce the boundary.

For example, a fictional agent can draft a missing-document reminder without authority to send it. Its reviewer checks the client and attachment request before approving the message through the permitted sending step.

If an agent attempts an unexpected action, suspend its access and preserve the record for investigation. Restore access only after the owner understands the cause and verifies the repaired boundary.