Governance, ethics and AI, with a capstone engagement

The earlier lessons focused on doing analytics well. This final lesson addresses doing it responsibly. Analytics touches personal information, drives decisions about customers and employees, and increasingly relies on artificial intelligence tools whose workings are hard to inspect. Accountants bring professional obligations to this work: integrity, objectivity, competence, confidentiality and professional behavior. The lesson covers data governance and controls over analytical tools, privacy law, professional ethics, and the opportunities and risks of AI, including generative AI. It ends with a capstone that runs one complete analysis of Cedarbrook's receivables through the analytics cycle.

Data governance

Data governance is the set of roles, policies and processes that ensure an organization's data are accurate, secure, available to those who need them and used appropriately. It answers questions that become urgent as soon as several people analyze the same data. Who owns the customer master? Who may change it? Which version of revenue is official? How long is payroll data kept? Without clear answers, every analyst builds a private version of the truth and meetings become arguments about whose numbers are right.

Governance is not bureaucracy for its own sake. Each element addresses a risk that earlier lessons met in practice: inconsistent definitions (lesson 9's KPI dictionary), poor quality (lessons 2 and 3), untraceable transformations (the cleaning log), and inappropriate access (read-only access in lesson 5).

Controls over spreadsheets, scripts and models

Spreadsheets, scripts, queries and models built by finance staff are often called end-user computing. They can be as important to financial reporting as the ERP itself, yet they rarely receive the same controls. Well-known failures illustrate the risk. In 2012, JPMorgan Chase's internal review of its London Whale trading losses found that a risk model relied on spreadsheets with manual copy-and-paste steps and a formula error that understated risk. Smaller versions of these errors happen in finance departments every month.

• Inventory the spreadsheets, scripts and models that feed financial reporting or key decisions, and rank them by risk.
• Use version control so every change is recorded, with who made it and why; tools such as Git work well for scripts and queries.
• Separate inputs, calculations and outputs, and protect formulas and code from accidental change.
• Test new or changed tools against known results, and have someone other than the author review them.
• Reconcile outputs to the general ledger or other control totals every time they are used.
• Document purpose, data sources, assumptions and limitations, so the tool survives the departure of its author.

These controls apply equally to the Python scripts used in this course. A script is more transparent than a spreadsheet, because every step is written down, but it can still contain errors, and only review and testing will find them.

Privacy

Much accounting data is personal information: employee payroll and banking details, customer contacts, expense claims and sometimes health or family information. The United States has no single comprehensive federal privacy law. Instead, sector laws apply: the Gramm-Leach-Bliley Act and the FTC's Safeguards Rule cover financial institutions, a category that can include tax preparers; HIPAA covers health information held by covered entities and their business associates; and Internal Revenue Code section 7216 makes it a crime for tax return preparers to use or disclose tax return information without consent, except as permitted. Around twenty states have enacted comprehensive consumer privacy laws, led by the California Consumer Privacy Act as amended by the California Privacy Rights Act, with rights to know, delete and opt out, and some states regulate automated decision-making. Requirements differ by state, so organizations operating across states must map which laws apply.

Several practices reduce privacy risk in analytics, whatever the jurisdiction. Data minimization means using only the personal data an analysis needs: a margin analysis needs customer numbers, not contact names. Pseudonymization replaces identifiers with codes, keeping the key separately, so analysts can link records without seeing who they belong to. Aggregation reports groups rather than individuals, with care that small groups do not reveal individuals. Access controls, encryption, secure transfer and disposal protect the data throughout. And a privacy review before a new analytics project, or a formal privacy impact assessment where the law requires one, identifies risks early.

Professional ethics

CPAs in the United States are bound by the AICPA Code of Professional Conduct, as adopted or adapted by state boards, with principles of integrity, objectivity and independence, due care and the public interest, and rules including the confidential client information rule. The international code issued by the International Ethics Standards Board for Accountants (IESBA), which shapes codes worldwide, adopted technology-related revisions effective from December 2024 that emphasize that professional competence includes understanding the technology one relies on, and that accountants must consider the risks of over-reliance on, and of automation bias toward, the output of technology.

Ethical problems in analytics are often subtle. An analyst asked to "find support" for a decision already made faces a threat to objectivity. A model that predicts late payment may disadvantage particular groups of customers if its inputs act as proxies for protected characteristics. An analysis that is technically correct but presented without its key limitation can mislead as effectively as a false number. The safeguards are the habits this course has emphasized: start from questions rather than desired answers, document and disclose methods and limits, seek review, and escalate when pressured.

Artificial intelligence and generative AI

AI techniques, from the classification models of lesson 10 to large language models, are now embedded in accounting software and widely available as general-purpose tools. Generative AI tools can draft SQL queries and Python code, summarize contracts and leases, classify transactions, answer questions about policies, draft memos and explain unfamiliar data structures. Used well, they speed up routine work and help analysts learn. Used carelessly, they create new risks.

Frameworks help organizations manage AI risk. The National Institute of Standards and Technology's AI Risk Management Framework, released in January 2023, organizes AI risk management around the functions govern, map, measure and manage, and COSO has issued guidance on applying its internal control framework to generative AI. For an accountant, the practical rules are simple: use only tools your organization has approved, never enter confidential data into tools without appropriate protections, keep tax return information within the limits of section 7216, check every output as you would a junior colleague's work, and remain accountable for the result.

Capstone: an end-to-end engagement

Daniel Reyes has one more request. Cedarbrook's bank has noticed that receivables grew faster than sales in 2025 and wants an explanation before renewing the operating line. Maya runs the full analytics cycle.

• Ask. The bank's question is why receivables rose faster than revenue. The decision: what Cedarbrook tells the bank and what it does about collections. Hypotheses: slower collection from particular customers or regions, a change in terms, disputed invoices, or an error in the receivables subledger.
• Acquire. She extracts open receivable items at December 31, 2024 and 2025 from the ERP and obtains the receivables control account balances from the general ledger.
• Prepare. She profiles the extract, standardizes customer numbers, and reconciles the open items to the ledger before any analysis.
• Analyze. She measures days sales outstanding for both years, builds a 2025 aging by region, and identifies the largest overdue balances.
• Communicate and act. She prepares a short memo for Daniel and the bank, and proposes a collection plan and a dashboard measure to track it.

# Capstone: why did days sales outstanding rise? (simulated open items)
import numpy as np
import pandas as pd
rng = np.random.default_rng(1231)
regions = ["North", "Central", "South", "East", "West"]
rows = []
for year, n in [(2024, 1900), (2025, 1990)]:
    for i in range(n):                               # normal open items
        rows.append((year, f"C{rng.integers(100, 999)}",
                     rng.choice(regions, p=[0.18, 0.27, 0.17, 0.22, 0.16]),
                     round(rng.gamma(2.0, 17)), round(rng.lognormal(8.1, 0.9), 2)))
for i in range(260):                                 # slow payers in West, 2025
    cust = "C390" if i < 120 else f"C{rng.integers(100, 999)}"
    rows.append((2025, cust, "West", round(rng.uniform(55, 150)),
                 round(rng.lognormal(8.1, 0.9), 2)))
ar = pd.DataFrame(rows, columns=["year", "customer", "region", "age", "amount"])
gl_control = {2024: 9_591_505.28, 2025: 11_202_163.72}   # receivables per ledger
for y in (2024, 2025):                                # step 1: reconcile
    diff = round(ar.loc[ar.year == y, "amount"].sum() - gl_control[y], 2) + 0.0
    print(f"{y}: open items {ar.loc[ar.year == y, 'amount'].sum():,.2f},"
          f" difference from ledger {diff:.2f}")
revenue = {2024: 80.8e6, 2025: 85.9e6}               # step 2: measure
dso = {y: gl_control[y] / revenue[y] * 365 for y in (2024, 2025)}
print(f"DSO 2024 {dso[2024]:.1f} days, 2025 {dso[2025]:.1f} days")
ar["bucket"] = pd.cut(ar["age"], [-1, 30, 60, 90, 10_000],
                      labels=["0-30", "31-60", "61-90", "over 90"])
aging = ar[ar.year == 2025].pivot_table(index="region", columns="bucket",
    values="amount", aggfunc="sum", observed=False).div(1e3).round(0)
print(aging.to_string())                              # step 3: drill down
top = (ar[(ar.year == 2025) & (ar.age > 60)].groupby("customer")["amount"]
       .sum().div(1e3).round(0).sort_values(ascending=False).head(3))
print("largest balances over 60 days ($ thousands):", top.to_dict())

2024: open items 9,591,505.28, difference from ledger 0.00
2025: open items 11,202,163.72, difference from ledger 0.00
DSO 2024 43.3 days, 2025 47.6 days
bucket     0-30  31-60  61-90  over 90
region                                
Central  1298.0  933.0  290.0    101.0
East     1171.0  704.0  177.0     77.0
North    1118.0  614.0  148.0     55.0
South    1042.0  574.0  133.0     29.0
West      904.0  452.0  584.0    797.0
largest balances over 60 days ($ thousands): {'C390': 524.0, 'C923': 38.0, 'C856': 33.0}

The open items reconcile exactly to the ledger in both years, so Maya can rely on the extract. Days sales outstanding rose from 43.3 to 47.6 days. The aging shows where: four regions have similar profiles, with most of their balances under 60 days, but West has 584 thousand aged 61 to 90 days and 797 thousand over 90 days, far more than any other region. The largest overdue balance by far belongs to customer C390, Ridge Homes, the homebuilder whose contract lesson 7 identified as the source of West's margin problem, with 524 thousand more than 60 days old.

The story now connects. To win Ridge Homes, West cut prices, and those prices spread to other customers. Ridge Homes is also paying slowly, and other West customers have joined it. The contract that added revenue has cost margin and tied up cash. Maya's memo to Daniel leads with that conclusion, quantifies it, and recommends three actions: put Ridge Homes on a payment plan and hold further shipments beyond its credit limit, review credit approvals in the West branch, and add the share of receivables over 60 days by region to the monthly dashboard so the bank and management can track recovery. Before sending, she has a colleague review her scripts and reconciliations, saves the extract, scripts, outputs and memo together with the date and data sources, and notes the limitations: the analysis covers year-end balances only, and the causes of slow payment need confirmation through conversations with the customers.

Bringing it together

Across twelve lessons, the same disciplines recur. Start with a decision and a specific question. Obtain data and prove they are complete. Prepare data with repeatable, logged steps that flag rather than delete. Query and join with care for keys, cardinality and grain. Describe accurately, diagnose with drill-down and decomposition, and predict with models tested on data they have not seen. Visualize honestly, design dashboards for decisions, and lead communication with the answer. In audit, use analytics on reliable data, set thresholds in advance and investigate what the analytics find. And throughout, protect the data, respect the people behind it, and remain accountable for the conclusions. Tools will keep changing; these disciplines will not.