Every scheduled reporting agent needs a run-level control

Scheduling converts an AI task into a recurring control execution

Workiva announced Agent Studio on September 15 and said organizations will be able to customize agents, enrich them with company knowledge, and schedule recurring automations. The same announcement names BEA surveys, US Census surveys, and Country-by-Country Reporting as examples of regulatory work moving into the platform. These are announced capabilities and directions, not evidence that a customer has reduced errors or that a control operated effectively.

The change still matters. A person running an assistant once can inspect the request, sources, and output in context. A scheduled agent may wake after a rule changed, an entity joined the group, a mapping was edited, a source extract arrived late, a credential expired, or a prior exception remained open. If the system simply repeats the last prompt, it can produce a polished report from the wrong population.

COSO's current GenAI internal-control roadmap calls out model drift, configuration changes, opaque reasoning, cyber exposure, and reporting integrity. PCAOB AS 2301 ties control reliance to design and operating effectiveness; AS 1215 emphasizes documentation that demonstrates procedures, evidence, and conclusions. These principles do not turn every management report into an audit workpaper. They make the operating point clear: repeatability means reproducing controlled inputs, logic, exceptions, review, and release - not reproducing text.

A September 21 r/InternalAudit discussion asked what teams accept as evidence of “human review” for AI-assisted decisions. That question is more important than the product label. A generic approval click proves that someone touched a workflow. It does not show what they checked, whether they had authority, which version they reviewed, what they re-performed, or how they resolved exceptions.

Make the run packet the system of record

The packet should let a qualified reviewer reproduce a material field without opening the agent's chat history. It begins with a run manifest and ends with the regulator or authority's receipt.

run_id: REG-2026-CBC-Q3-0042
obligation: OECD country-by-country reporting package
entity_scope_version: group-perimeter-2026Q3-v7
period_end: 2026-09-30
rule_set:
  authority: supplied-official-guidance
  effective_date: 2026-07-01
  version: cbc-schema-v4
source_cutoff: 2026-10-08T18:00:00Z
workflow_commit: 84d7a0b
model_resolved_version: vendor-model-2026-09-12
expected_sources: [consolidation, tax-provision, payroll, legal-entity-master]
submission_authority: role:global_tax_reporting_director
ai_submission_permission: false

The manifest is not decorative metadata. If the rule version, source cutoff, entity perimeter, mapping, or model changes, the packet needs a new version. Approval attaches to the output hash and packet hash, not a mutable folder named “final.”

Use a twelve-stage workflow with hard stop conditions

1 obligation -> 2 authority/effective date -> 3 source freeze
  -> 4 field lineage -> 5 deterministic checks -> 6 judgment register
  -> 7 owned exceptions -> 8 draft + packet -> 9 substantive review
  -> 10 exact-version approval -> 11 separate submission -> 12 reconciliation

Freeze obligation and authority: confirm that the organization has the obligation, identify the responsible legal entities, period, authority, form, jurisdiction, due date, certification, retention, and submission channel. AI may organize supplied rules; it should not decide legal applicability.

Bind effective rules: record the instruction, schema, definitions, code lists, and organization policy that apply to the reporting period. Do not use the newest document automatically. A current webpage may describe next year's filing while the current run remains under an earlier specification.

Freeze the population: reconcile expected source systems and entities to the extracted run population. Include zero-activity entities, failed interfaces, late feeds, manual records, exclusions, and prior-period carry-forwards. A successful agent run over an incomplete dataset is a failed control.

Build lineage and checks: link each field to record IDs, transformations, formulas, assumptions, units, and mappings. Reperform schema, required-field, duplicate, sign, unit, currency, cross-foot, roll-forward, mapping, and total checks independently from the model narrative.

Separate judgment: classification, permanent-establishment questions, tax positions, allocations, estimates, materiality, disclosure wording, and legal interpretation belong in a judgment register with evidence and named owners. The model can draft alternatives; it cannot approve one.

Route exceptions: each exception needs an owner capable of closing it. Data owners fix extracts. Accounting owners resolve mappings and calculations. Tax or legal owners resolve interpretation. Technology owners resolve version and access failures. The agent never closes the exception it created.

Review, release, reconcile: the independent reviewer documents procedures on the exact packet. A separate submission owner confirms the approved hash in the official channel, submits, and captures the receipt. Rejections, regulator questions, and amendments link back to the original run rather than overwriting it.

Define evidence of human review before the first run

“Human in the loop” is a system diagram. Evidence of review is a record of a competent person exercising authority on a specific version. The reviewer should not merely reread the AI's summary.

Use targeted review. A source owner confirms the extract and control totals. Accounting re-performs formulas, mappings, and roll-forwards. Tax, Legal, or Compliance resolves rule interpretation. Technology verifies version, access, and change evidence. The Controller or reporting owner approves the exact artifact. One person clicking through every stage is neither efficient nor credible segregation.

The Institute of Internal Auditors advises practitioners to verify AI-generated information at the source and preserve human judgment and accountability. That does not require manually repeating every machine step. It requires choosing review procedures proportionate to risk and recording enough evidence to demonstrate what happened.

Worked example: a quarterly country-by-country package

A scheduled agent prepares a quarterly package using consolidation, tax-provision, payroll, and legal-entity data. The first draft cross-foots, all required columns are populated, and the narrative explains the largest year-over-year movements. The dashboard shows green.

The source reconciliation finds that a newly acquired entity exists in the legal-entity master but not in the tax-provision extract. A mapping inherited from the prior period assigns one branch to the old parent jurisdiction. A currency conversion used the current daily rate rather than the period-approved rate table. The narrative says the changes reflect operating growth, but part of the movement comes from the missing entity and rate difference.

The agent did not fail because its prose was poor. It failed because the run did not prove population completeness, mapping currency, and policy-bound calculation. The corrected run retains both versions, the exceptions, owner resolutions, before-and-after differences, reviewer procedures, final hashes, submission receipt, and any regulator response.

Failure modes that make scheduled automation unsafe

A governed platform can provide valuable access, workflow, lineage, and audit features. It cannot prove that a person supplied the correct scope, that an official rule applies, that a reviewer understood the issue, or that the final portal artifact equals the approved packet. Keep those assertions explicit.

Run a 30-day pilot on one low-judgment obligation

Week 1: choose one recurring obligation with stable rules and no autonomous filing. Map owners, calendar, source systems, population, official instructions, fields, mappings, calculations, judgments, controls, submission channel, and prior-period exceptions.

Week 2: build the run manifest, source register, lineage ledger, deterministic checks, exception schema, reviewer procedure template, and exact-version approval mechanism. Reproduce the last completed report without submitting it.

Week 3: seed failures: missing entity, stale instruction, late source, duplicate row, wrong unit, wrong sign, changed mapping, unsupported narrative, failed interface, version alias change, suppressed exception, and post-approval edit. Confirm each blocks, routes, or becomes visible.

Week 4: run a parallel current-period preparation. Compare cycle time, reviewer effort, exception precision, late inputs, control-total differences, unsupported fields, post-review changes, and retrieval time. Ask Internal Audit/SOX to challenge the evidence without taking ownership.

Scale only after the team can reproduce a material field, explain every exception, prove the reviewer procedures, and match the approved hash to the submission receipt. For cross-process auditor requests, use the external-audit evidence workflow. For source authenticity and document lineage, use the source-document verification workflow.

FAQ

Should the agent have filing credentials?

No for this workflow. Keep preparation and submission separate. The submission owner verifies the approved artifact inside the official channel and captures the receipt. This reduces the chance that a model, tool, or compromised workflow can turn a draft into an external representation.

Can we rely on the same approval every quarter?

No. The control design can repeat, but each period has new rules, populations, data, exceptions, judgments, and output. Approve the exact run packet and artifact, not the template.

How much should a reviewer reperform?

The amount depends on risk, materiality/tolerances supplied by authorized owners, control design, prior results, and applicable standards. Record the rationale, fields or samples, procedures, differences, and conclusion. The AI should not decide sufficiency.

What if the regulator rejects the file?

Capture the rejection as a regulator response linked to the original run. Classify whether the cause was data, rule, schema, mapping, calculation, judgment, approval, or transmission. Correct under change control, rerun affected checks, obtain new approval, and preserve both submissions.