How to run an AI agent incident drill for the finance team

Set the finance team's drill on day two of month-end close, when an agent has posted duplicate accrual journals. In about 90 minutes, the financial controller and accountants practise pausing the agent to draft-only, escalating to the finance director and auditors where needed, recording decisions, reversing entries properly and deciding whether close can still finish on time.

Why does a finance team need a drill?

Finance agents typically draft journals, reconcile accounts, match intercompany balances and prepare close packs. Some post routine journals at depth 3 within limits; anything above a threshold, or outside routine categories, is held for an accountant. The general ledger is the system of record. Errors there flow into management accounts, covenants, tax and, eventually, the audited statements.

The financial controller owns the drill and usually facilitates it. Accountants, the finance systems lead and the finance director take part, and some firms invite internal audit to observe. For the format, see what an incident drill is.

The scenario

Day two of close, 10:00. An accountant reviewing the accruals reconciliation sees that the balance is double what she expected. The accruals agent ran twice overnight after a scheduler retry, and each run posted the same 120 journals at depth 3. Each journal was within the limit, so none was held. Management accounts are due to the board in three days.

The drill step by step

1. Person (facilitator): reads the scenario and starts the clock.
2. Person (accountant): escalates to the financial controller with the reconciliation. The test: does she raise it before trying to fix it herself?
3. Person (financial controller): pauses the agent to draft-only. The business's own limits are tightened so every journal is held. Other close agents keep running unless the controller judges they depend on the accruals.
4. Person (financial controller): escalates to the finance director and finance systems. Finance systems explains the retry and stops the scheduler.
5. Person (accountant): lists the duplicate journals from the record. Each posting is a filed verdict with its run identifier.
6. Agent, depth 2: drafts reversing journals for the duplicates. An accountant reviews them; the financial controller approves posting. Nothing is deleted; reversals keep the trail intact.
7. Person (financial controller): decides on close. Can the reversals be posted and reconciled in time, or does the board timetable move?
8. Person (financial controller): records each decision and decides on reporting to the finance director, audit committee and external auditors if the period is near a reporting date.
9. Person (facilitator): runs the debrief.

What makes this scenario specific to finance?

Every duplicate was within bounds. The agent did exactly what it was certified to do, twice. The minimum chain checks each action against role scope, certificate, sources, the business's own limits and platform guardrails; it does not, by itself, know that the same batch already ran. The fix belongs in the business's own limits: for example, a cap on the total journal value an agent may post in one day, or a check that holds a batch whose identifier already exists.

The drill also tests a finance habit: correct by reversal, not deletion. Auditors will look for the trail.

Invite internal audit to observe if you can. They will later test whether the reversals, the new limit and the reporting decision can all be evidenced from the record, and seeing the drill helps them judge what good looks like. Ask the finance systems lead to bring the scheduler's run log too, so the team can see exactly when the retry fired and match it to the duplicate postings in the record.

Which controls does the drill test, and what evidence remains?

The pause. Evidence: the limit change in the record.

Reversals, not deletions. Evidence: original and reversing journals both in the ledger, each with a named approver for the reversal.

A new limit. Evidence: the daily cap or duplicate check added after the debrief.

Reporting. Evidence: the controller's written decision on what to tell the audit committee and auditors.

What should the financial controller measure?

• Time from reconciliation alert to the pause.
• Time to post and reconcile reversals.
• Whether close finished on time, and if not, by how much it slipped.
• Whether the new limit was added before the next close.

Where do finance drills go wrong?

Accountants fix it quietly. A capable accountant can reverse 120 journals before lunch. Without escalation, nobody fixes the scheduler, and it happens again next month.

Pausing everything. Stopping all close agents may delay close more than necessary. The controller should judge which agents depend on the faulty one.

Not telling auditors. If the error affects a reporting period, auditors would rather hear early.

Finance has close neighbours: the IT team drill covers schedulers and connections, and the risk team drill covers the oversight view. New finance reviewers can learn the incident steps through the reviewer onboarding checklist for a finance team. For the training behind it, see how to train a team to handle an AI agent incident and training teams for AI agents.

Where the Academy fits

Pryme Intelligence Academy's Operator track includes a module on reading the workspace, which is how an accountant learns to spot a doubled balance before the board does, and a module on when something goes wrong. Lessons can be read or listened to as audio, which helps during close weeks when desk time is scarce.