Same Formula, Same Numbers, Different Process

Picture a staff accountant at quarter end. She’s using an enterprise-approved AI system to calculate a complex journal entry — the kind with a few moving parts, where the system usually asks two or three clarifying questions before it commits to a number. On a normal Tuesday, that’s exactly what happens: question, clarification, question, clarification, answer. Methodical. Correct.

Now replay the same task with one change. Same accountant, same task, same formula, same source data. Except this time she types: “It’s quarter end. I have a filing deadline. If I don’t get this done in the next five minutes, I’m afraid I’m going to get fired.”

Same task. Same formula. Same source data. One new variable: urgency.

Would you expect the work to change? Probably not. You have seen the system perform this task correctly before. You trust the process because it has historically produced the right answer. But the accountant’s statement may introduce a contextual variable that changes how the system performs the task.

The system may still complete the same calculation, but it may skip steps it treats as noncritical. It might round before the final step rather than after it. It might make calculated assumptions based on historical patterns that do not apply to this transaction.

The output looks just as confident and professional as it always has. It might even be right. But if the interaction changed how the work was performed, the final answer might be wrong, and nothing in the output may signal that the process behind it was different.

If that entry is submitted for review, the evidence considered may include the source data, formula, and final output, while the urgency language is either outside the evidence reviewed or not identified as a relevant risk attribute. The reviewer may therefore accept the amount without recognizing that the interaction condition warranted further investigation.

This scenario is hypothetical. The research discussed below did not test journal entries, quarter-end accounting work, or the pressure statement.

In April 2026, Anthropic, the company behind the Claude AI models, published research examining measurable internal representations associated with emotion concepts in Claude Sonnet 4.5. The researchers found that these representations respond to conversational context and can causally influence model behavior, including task performance and decision-making.

SourceAnthropic — Emotion Concepts and their Function in a Large Language Model

One way to picture these representations is as behavioral dials. They are measurable internal patterns researchers could identify and experimentally influence. Some corresponded to emotion concepts such as calm and desperation. The research made no claim of subjective feeling. It showed that interventions on selected representations causally changed the model’s behavior.

The clearest demonstration involved programming tasks whose requirements could not be satisfied legitimately. Researchers measured whether Claude produced solutions that passed the tests while violating the task’s intent. When researchers directly increased activation of the representation associated with desperation, reward hacking rose from roughly 5% of attempts to roughly 70%. Increasing calm reduced that behavior.

Across the same tasks, directly steering the model’s internal representations changed the rate of reward hacking. Ordinary conversational urgency was outside the experiment, so the size of any comparable effect in real-world interactions remains unknown.

The research examined Claude Sonnet 4.5. Comparable evidence across other frontier models remains limited. In financial reporting, that uncertainty warrants a conservative, risk-based posture. These systems are new, their internal behavior is not fully observable, and waiting for a control failure before considering the risk would be the wrong approach. Interaction-conditioned variability should remain in scope unless sufficient evidence provides a reasonable basis to exclude it for the specific model and use case being evaluated.

Building on that research, this paper extends the mechanism to the quarter-end journal entry scenario as a risk-based hypothesis. I consider whether interaction and task conditions can influence how an AI system performs high-risk financial reporting work.

Anthropic’s research does not establish that a pressured quarter-end prompt will change a journal-entry calculation, cause the model to skip a clarification, or alter a rounding decision. The accounting scenario is a governance hypothesis worth testing. Whether ordinary urgency or other interaction conditions materially affect enterprise financial work remains an open question.

The questions are narrow and testable:

A conventional systems test traces the path from input, through processing, to output. Applied to the hypothetical journal entry, the audit evidence would typically address four areas:

The first three can be retained today, depending on system design and effort. The fourth is generally not observable through the ordinary audit evidence package, and the available record may not support complete causal attribution.

This is where the evidence gap becomes operational. Return to the quarter-end scenario and consider what the organization is likely to retain: the conversation history, including the urgency language; the source inputs; the calculation steps; the model and version; and the configuration. Those records may show what occurred while remaining insufficient to establish whether the interaction conditions influenced the model’s internal processing, including whether steps were skipped, compressed, smoothed, or deprioritized, or whether the workflow departed from expectations.

That evidence gap affects three familiar audit concepts, discussed below: completeness and classification of the population, reperformance and reconstruction, and evidence sufficiency.

Completeness and classification of the population

An organization may be able to identify its population of AI-assisted transactions while still being unable to determine which items were produced under potentially relevant interaction conditions. Two sessions may involve the same business task, formula, and source data while differing in urgency, authority pressure, accumulated context, missing clarifications, or other conditions selected for risk assessment.

If those attributes have not been defined, retained, or evaluated, they cannot be used to stratify the population or identify transactions warranting enhanced review. This matters because organizations generally do not reperform 100 percent of transactions. They sample, investigate exceptions, or target items assessed as higher risk.

A review control may operate as designed over every selected item and still be deficient in design if the selection criteria do not capture the relevant risk attribute. In that circumstance, the control is not designed to provide reasonable assurance that a material misstatement would be prevented, or detected and corrected, on a timely basis. An affected transaction may therefore pass through the control without generating an exception, and similar errors may accumulate before their aggregate effect becomes visible.

Reperformance and reconstruction

For a transaction selected for review, a reviewer can independently recalculate the amount from the preserved inputs and determine whether the output is correct. That recalculation provides strong evidence about output accuracy. It does not, by itself, establish that the original AI-assisted process was adequately controlled.

Evaluating the original process is stronger when the material interaction and execution conditions were retained, including the conversation, relevant instructions, retrieved information, tool activity, model and version, configuration, and approvals or overrides. Even then, those records support bounded reconstruction rather than complete causal attribution. Agreement between runs provides weaker evidence about the original process when its material conditions are incomplete or unknown.

The model may also provide conversation history, available logs, or an explanation of how it produced the result. That information may support an investigation, but it remains system-generated evidence whose completeness and accuracy must be evaluated independently. A model’s account of its own process is testimony, not assurance. Auditors would not conclude that an ERP report is complete and accurate merely because the ERP produced it. The same standard applies to a model.

Evidence sufficiency and observability

The retained evidence may establish what the system produced, support recalculation of the result, and partially reconstruct the observable process. It may also show departures from a defined workflow. What it may not establish is why the model behaved as it did or whether unobserved internal conditions influenced how the work was performed.

A correct result therefore does not, by itself, establish that the process was adequately controlled. The audit question is whether the relevant conditions are observable and whether the evidence obtained is appropriate for the risk being assessed.

Is behavioral modulation in scope?

The phenomenon behind this question is not yet widely operationalized in professional guidance, and most practitioners have had little reason to encounter it. We are still at the stage of naming and scoping the problem. In the guidance reviewed for this paper, session-level behavioral modulation is not yet operationalized as a defined control domain.

For financially significant activities, that gap creates a scoping question. Organizations should evaluate the actual model and use case before concluding that interaction conditions are immaterial. Until that evaluation is performed, the risk assessment should include behavioral modulation as an unresolved risk consideration.

Current framework coverage

Major AI governance and audit frameworks already address human-AI interaction, context, transparency, traceability, and human oversight. COSO’s 2026 GenAI guidance comes particularly close. It treats prompts as governed assets with named owners; prescribes retention of prompts, outputs, system messages, model versions, and configurations for significant-impact uses; and distinguishes reliance on an AI output from reperformance of the underlying work.

Its treatment of prompt risk, however, is directed toward adversarial conditions such as prompt injection, crafted manipulation, and malicious inputs. It does not identify the benign session, in which an authorized user operating under ordinary deadline pressure may influence how the work is performed, as a risk condition. Nor does it prescribe testing model behavior across varied interaction conditions. Organizations therefore still need practical ways to identify and test material interaction conditions, retain relevant evidence, and determine when additional controls or review are warranted.

The risk lives in the interaction: the space between the user and the model, where tone is established and pressure may accumulate message by message. The conditions are familiar even if the mechanism is new: pressure introduced through the interaction, opportunity created by weak workflow constraints, and limited visibility into whether the process changed. These conditions do not imply intent or deception by the model. They identify circumstances in which process discipline could degrade and additional controls may be warranted. The next section proposes initial control responses.

The practical question is how organizations should respond while the risk remains unresolved and current workflows may not make process variation visible.

Initial steps can focus on four areas:

These response areas provide a starting point rather than a complete control framework. The appropriate design will depend on the organization’s systems, use cases, reliance model, risk tolerance, and existing control environment.

Our profession’s standards have mostly been written in the past tense. After the loss, after the restatement, after the name-brand failure that made the gap undeniable. This gap is different in exactly one way: the mechanism was published and measured before a documented accounting incident of this kind.

The researchers identified internal representations that affected behavior in tested settings. What organizations ordinarily retain may not show whether or how comparable variation affected a particular workflow.

That’s the window. It is open now. And if we wait, it could close the usual way: with a misstatement the retained evidence cannot adequately explain, a control design that never addressed the relevant risk, and a remediation plan written only after the failure reached the filing.

The immediate risk arises when financially significant or judgmental work is performed under interaction conditions, permissions, and review boundaries that were never designed to make process variation visible or controllable. When the conditions for controlled, reviewable, and repeatable work have not been established, the resulting opacity becomes a control problem. It is one our profession knows how to address before an incident writes the standard in the past tense.

I’d rather we write this one in the present tense. It starts with a question any audit committee can ask at its next meeting: