At a glance
- A five-criterion rubric — volume, rule clarity, exception cost, data access and control risk — scores any finance workflow for a first automation pilot, not just the ones a vendor already sells you a module for.
- High volume, clear rules, forgiving exceptions and clean data access make a strong first candidate; a workflow where automating it would let one system both authorize and execute a transaction does not.
- An illustrative worked example scores six common workflows — close tasks, reconciliation, AP exceptions, treasury rate sheets, flux commentary and collections — side by side on the same five criteria.
- Segregation of duties, the internal-control principle that keeps one person or system from both causing and concealing an error, is the backbone of the control-risk criterion.
- Scoring is the first step; turning a score into a pilot means writing the rule down, setting a human-review threshold, and replaying it against a period your team already closed.
Why the first finance workflow matters
A CFO with budget for one pilot usually has several people pitching several different finance workflows. Reconciliation, AP, treasury, the close and collections all make the same case. Too many transactions, too little staff time, too much risk that an error goes uncaught until it's expensive. That case is true of nearly every finance workflow, which is exactly the problem — it doesn't tell you which one to build first.
Picking the wrong first workflow costs more than a failed pilot. It can use up the first real chance a finance team gets to show that automation can be trusted with real transactions, under real review. That chance disappears once the people who have to sign off on it stop paying attention. A scoring rubric turns "which workflow feels most urgent" into a comparison you can defend to the controller, internal audit and the board.
The five criteria below aren't specific to any vendor. They score a workflow the same way whether you're comparing reconciliation software or a tool that drafts collections outreach. Score the workflow first, then let the score point at a candidate.
- A workflow that scores well on every criterion is rare; most trade one advantage for another, which is why the rubric compares workflows side by side rather than passing or failing each one alone.
- Plan one working session with the process owner, the controller and whoever handles the exceptions today to score the candidates — it doesn't need a vendor demo first.
The scoring rubric
Score each candidate workflow against every criterion below, using the five-point scale the table sets out. A high score always means the criterion argues for automating that workflow first. A low score always means it argues for waiting. Keep the scores and the reasons in writing — the reasons are what you'll defend later.
| Criterion | What it measures | Score 1 (weak case to go first) | Score 5 (strong case to go first) |
|---|---|---|---|
| Volume | Transactions or items the workflow handles each period. | A handful of items a month; nothing to gain from automating it yet. | Hundreds or thousands of similar items every cycle. |
| Rule clarity | How completely the correct action can be written down as an unambiguous rule. | The right call depends on judgment that varies from one reviewer to the next. | An experienced accountant could state the matching or exception rule in one sentence. |
| Exception cost | What a missed or wrong exception costs once it reaches a client, an auditor or a regulator. | A miss is expensive, hard to reverse, or visible outside the company. | A miss is caught downstream at little or no cost. |
| Data access | How cleanly the workflow can read what it needs without new access grants. | Data is scattered across systems, inconsistently formatted, or needs new write access to reach. | Data already sits in one system the workflow can read from today. |
| Control risk | Whether automating the step would let one actor both authorize and execute a transaction without a second set of eyes. Segregation of duties — separating who has authority, who has custody and who does the accounting — is what this criterion protects.[1] | Automating it would collapse an authorization duty and an execution duty into one actor, with no compensating check. | The workflow only drafts or flags; a person authorizes, and a separate step executes. |
Scoring six common finance workflows (illustrative)
The table below is an illustrative example, not a benchmark or a client result. It applies the rubric to six common finance workflows side by side to show how the scores diverge. Score your own workflows the same way, with your own volumes and your own control environment, before you compare them to this one.
| Workflow | Volume | Rule clarity | Exception cost | Data access | Control risk |
|---|---|---|---|---|---|
| Close tasks & accrual drafting | 3 — dozens each cycle | 4 — checklist, formulas set | 4 — stays internal | 3 — ERP & planning tool | 5 — drafts, needs sign-off |
| Reconciliation | 5 — thousands of lines | 4 — mostly rule-based | 4 — caught next cycle | 3 — several, messy feeds | 5 — suggests, human approves |
| AP exceptions | 4 — high invoice volume | 3 — tolerances, some judgment | 3 — usually recoverable | 3 — split across systems | 4 — flags only, human release |
| Treasury rate sheets | 2 — small, fixed set | 4 — well-defined rules | 1 — reaches client fast | 4 — few clean feeds | 2 — release collapses checks |
| Flux & variance commentary | 3 — dozens of accounts | 2 — explanation is judgment | 5 — reviewed before final | 3 — ledger & budget data | 5 — draft, authorizes nothing |
| Collections | 5 — every past-due account | 4 — aging rules set | 4 — awkward, rarely costly | 4 — one receivables ledger | 5 — proposes, needs approval |
Each score above is shorthand for a real reason, and for the one step in that workflow that should stay a named person's call regardless of how well the rest of it scores:
- Close tasks & accrual drafting: high volume against an already-written checklist and accrual formulas, and a late task rarely reaches a client or auditor. Keep human-only: final sign-off on each posted entry.
- Reconciliation (transaction matching): thousands of mostly rule-based matches, where a missed break is usually caught and corrected the next cycle. Keep human-only: approving any match above tolerance.
- AP exceptions (invoice, PO and receipt mismatches): high volume with written tolerances, though some mismatches still need judgment and a wrongly approved invoice is usually recoverable. Keep human-only: releasing payment on a flagged invoice.
- Treasury rate sheet validation: clear validation rules and clean feeds, offset by a wrong rate that reaches a client fast and is hard to unwind. Keep human-only: releasing the rate to the client.
- Flux and variance commentary: judgment-heavy wording that a person reviews and rewrites before it ever reaches leadership anyway, so a draft costs little even though it authorizes nothing. Keep human-only: final wording that goes to leadership.
- Collections (past-due follow-up): high volume against already-written aging rules, where a wrong reminder is awkward but rarely costly. Keep human-only: approving write-offs and payment plans.
Read the scores by criterion, not just by row. In this illustrative scoring, reconciliation and collections score strongest, combining high volume with a cheap, easily-caught miss and a design that only drafts or proposes. Treasury rate sheets score well on rule clarity, but poorly on exception cost and control risk. A wrong rate is costly and hard to unwind, and releasing it without a second check would collapse validation and authorization into one step. That favors automating the checks, not the release.
Where not to use AI
Some finance steps shouldn't be a first project at all, no matter how well they score on volume or rule clarity. The clearest tell is the control-risk criterion. If automating a step would let one system both propose and finalize a transaction, it removes a check your auditors rely on. A model being accurate most of the time doesn't restore that check.
GAO's Green Book, the internal-control standard for US federal entities (2025 revision, GAO-25-107721), puts it directly: "Segregation of duties can mitigate the risk of management override. Management override circumvents existing control activities and increases risk of fraud, waste, and abuse. Management mitigates this risk through segregation of duties but cannot absolutely prevent it because of the risk of collusion, where two or more employees act together to commit fraud, waste, or abuse." [1] Removing the second set of eyes to save time works against exactly this protection.
The stakes aren't abstract. In AFP's 2026 Payments Fraud and Control Survey, 76% of organizations reported attempted or actual payments fraud in 2025[2]. The survey drew on responses from 465 corporate professionals across a broad range of industries and organization sizes[2]. Checks remain the payment method most frequently impacted by fraud, with 58% of organizations reporting check fraud, outpacing ACH and wire fraud[2]. This is a reason to keep AP's payment-release step, not just its exception-flagging, under a named human reviewer.
- Final sign-off on any journal entry, adjustment or reserve stays with the preparer and reviewer who own it today.
- Releasing a payment, wire or published rate: draft it, never release it, without a named human step that a different person performs.
- Estimates and judgment calls behind reserves, allowances or unusual items.
- Final wording of anything that leaves the company — board commentary, a client-facing message, a regulatory filing.
- Any step where the same system flags, approves and executes a transaction with no second reviewer in between.
Turning the score into a pilot
A score narrows six candidates to one or two, and gives you language to explain the choice. From there, turn the top-scoring workflow into a scoped pilot before it touches production data.
- Write the rule down
State the matching, exception or drafting rule in one paragraph a new hire could follow. If you can't, the rule-clarity score was too generous.
- Set the human-review threshold
Decide, in writing, what gets auto-approved, what gets flagged for review, and what always needs a named approver — before the pilot runs, not after.
- Replay it against a period you've already closed
Run the rule against transactions your team already reconciled, closed or collected, and compare the result to what actually happened.
- Count what it misses, not just what it catches
A rule that never flags anything isn't accurate, it's blind. Tune it until the misses are ones a person would genuinely accept.
- Keep the release step separate
Whatever the pilot drafts or proposes, route final authorization through the approval path you already have, under your existing change-control process.
- Expand only after the controller signs off
Move to the next-highest-scoring workflow only once this one has run a full cycle under review.
When this doesn't apply
- You don't have a written policy for the workflow yet: write the policy first, then score it, rather than automating an unwritten habit.
- The workflow touches only a few dozen items a period; a checklist or a spreadsheet formula will outperform a build.
- No one in the workflow's approval chain has time to review what a pilot proposes: a pilot without a reviewer is not a control, it's a new risk.
Frequently asked questions
Which finance process should you automate first?
The one that scores well across most of the five criteria at once: high transaction volume, rules an accountant can state in a sentence, exceptions that are cheap to catch downstream, data the system can already read, and a design where a person still authorizes anything that executes. Reconciliation and collections often score this way; score your own before assuming.
Where should a CFO start with AI?
Start by scoring candidate workflows, not by picking the one generating the most complaints. Gather the process owner, the controller and whoever handles today's exceptions, score each candidate on volume, rule clarity, exception cost, data access and control risk, and let the highest, most defensible score choose the pilot.
Is reconciliation or close a better first project?
On the rubric, reconciliation usually scores higher: it has more volume, more rule-based matching, and exceptions a later cycle usually catches. The close scores well on rule clarity for task tracking and accrual drafting, but its judgment-heavy pieces — estimates, unusual items, final commentary — belong in the "where not to use AI" list either way.
Which finance tasks shouldn't use AI?
Skip any step where automating it would let one system both authorize and execute a transaction: releasing a payment, a wire or a published rate, final sign-off on a journal entry, and estimates or judgment calls behind reserves. Draft in those areas if you want; keep the release, sign-off or final wording a separate human step.
How do you score automation readiness in finance?
Rate the workflow low to high on volume, rule clarity, exception cost, data access and control risk, with a high score always meaning the criterion favors automating that workflow first. Write down the reason behind each score, compare workflows side by side rather than pass or fail one at a time, and let the strongest overall case choose the pilot.
Related reading
- 360° AI Blueprint is where this rubric's output feeds into a scoped plan across your finance workflows.
- Financial reconciliation automation covers the deterministic-rules-first workflow behind the reconciliation row above.
- Financial close automation covers the close-calendar and accrual workflow behind the close row above.
- How to scope an AI automation pilot goes deeper on turning a chosen workflow into the pilot steps above.
More in Finance operations
Deal Jacket and Title/Registration Automation for Multi-Rooftop Dealer Groups
Deal jacket and title/registration automation for multi-rooftop dealer groups: a completeness checklist table, audit-gap handling and cross-store standards.
Auto DealershipsFranchise Brand-Standards Audit Documentation: Automating the Paper Trail Behind the Inspection
Franchise brand-standards audit documentation: how an agent turns photos, PDFs, forms and emailed fixes into one packet per location, ready when asked.
Multi-Unit Franchise OperatorsGroup and Folio Billing Audit: Catching the Leak Types a Normal Error Check Misses
A group and folio billing audit for hotel management companies: a leak-type table of rate code mismatches, missing closes, adjustments, orphaned charges.
Hotel Management Companies