Governing ERP, AI and Third-Party Risk as One Operating Model
Finance transformation is entering a more complex phase. Organizations are modernizing core ERP platforms while software vendors introduce AI capabilities into business applications. At the same time, regulators are examining the management of third-party dependencies and the governance of AI systems.
The CFO question is no longer simply whether the new technology works. It is whether Finance can demonstrate that process ownership, data, controls, implementation partners and business outcomes remain connected as technology and operating models change. This connects directly to how ZMC approaches finance transformation engagements: as an integrated operating-model problem, not a series of isolated workstreams.
On September 11, 2026, U.S. banking agencies proposed revised third-party risk management guidance designed to help institutions tailor oversight to the assessed risks of individual relationships. The guidance is proposed and non-binding—not a new final compliance requirement. For a core finance transformation, its relevance lies in how institutions evaluate material dependencies on ERP vendors, cloud providers, systems integrators and managed-service partners.
NAIC meeting materials document a 12-state pilot of its AI Risk Evaluation Supplement. The pilot examines how insurers describe and evidence AI-related governance and controls; participating states retained flexibility in how they used the supplement. It was continuing through September when the August materials were prepared. This is not a nationwide final examination requirement.
Oracle announced a native builder for agentic applications inside its Fusion Applications environment. Workday identified agentic finance as a focus for its upcoming October Rising event. SAP published a customer example of generative AI supporting finance analysis. These are evidence of vendor direction and announced capabilities, not independent proof of productivity, financial returns or successful deployments across regulated institutions.
Finance typically owns accounting requirements and intended outcomes. Technology manages architecture and integration. The systems integrator executes the build. Risk, compliance and internal controls assess exposure. Procurement and vendor management oversee commercial terms. Each group can report progress while critical dependencies between groups remain unresolved.
Consider AI-assisted account reconciliation. Whether a tool can flag exceptions is only one part of readiness. A controlled implementation must also establish which data it can use; whether it may draft, route or execute; who approves material exceptions; how actions are logged; what happens after a vendor update; and who owns the process once the implementation team exits.
ZMC perspective: these are operating-model decisions. A transformation office should surface them before they become testing defects, control gaps or post-go-live operating problems.
Translate the business case into operational measures—such as close-cycle performance, reconciliation exceptions, manual effort, forecast responsiveness and control evidence—and assign accountable business owners.
Address fragmented data definitions, unresolved master-data ownership, reporting dependencies and unnecessary process variation before assuming AI will deliver value.
Match approval boundaries, access permissions, testing, monitoring, exception handling and evidence retention to what the AI-enabled workflow can actually do and the consequences of an error.
Link vendor and SI obligations to finance outcomes, resilience assumptions, change controls, acceptance evidence, transition planning and escalation rights—not only contractual milestones.
Maintain an integrated view of critical-path dependencies, decision latency, budget and change-order exposure, control readiness, operational handover and measurable benefits after go-live.
New technology may enable better operations, but value depends on the decisions made about process design, data quality, controls and adoption.
Ownership should hold across design, testing, release, incident response and ongoing operations—not end at a workstream boundary.
Program reporting should include business outcomes and control evidence alongside conventional cost and schedule metrics.
A practical first step is a targeted health check of one material finance transformation or AI-enabled workflow. Examine the business case, dependency map, finance-data ownership, controls, third-party responsibilities, critical decisions and measurable readiness evidence. The output should be a small set of executive decisions—not another inventory of disconnected observations. ZMC’s Finance Transformation Health Check is designed around this kind of focused, decision-oriented assessment.
The objective is not more governance. It is governance that connects the right decisions, the right owners and the right evidence to measurable business outcomes.
ZMC Consulting helps organizations connect finance transformation strategy with disciplined execution, technology modernization, governance, controls and measurable business outcomes. Connect with us to discuss your transformation priorities.
Download the companion PDF for this insight.
Founder, ZMC Consulting
Michael is a finance systems and enterprise transformation executive with more than 15 years of experience in finance transformation, ERP modernization, program governance, process optimization and technology-enabled operating-model change.
