How Indian Finance Controllers Should Contain Shadow GenAI Before Client Data Leaves the Spreadsheet

Indian finance teams did not wait for a board-approved generative-AI programme. Associates already paste ageing schedules into personal chat accounts, managers rewrite management commentary on a phone at 11 p.m., and shared-service centres run vendor-reconciliation exceptions through a free browser tab the IT inventory has never seen. That is shadow GenAI. It is not the same problem as a sanctioned copilot inside the ERP, and it is not the same problem as a hallucinated citation in a board note. It is unsanctioned use of a model on data the company is accountable for. This briefing is a containment playbook for controllers, FP&A heads and shared-service leads who cannot ban phones and cannot pretend the paste is not happening.

The setting is Indian and emerging-economy practice: listed issuers with a thin IT security team, NBFCs whose credit files sit in Excel, CA firms whose engagement letters never mentioned a chatbot, and campus finance cells that process fee ledgers on the same laptop used for personal accounts. Enterprise contracts with data-residency clauses are real for a few large groups. They are not the median desk. Containment has to work where the median desk is.

Further reading on DrDPKlass: how CFOs should govern sanctioned GenAI in finance operations, and how teams should sweep hallucinated citations before a file leaves the desk. Today’s note sits upstream of both: stop the unsanctioned paste before you govern the official tool or sweep the official draft.

1. Shadow use is already inside the close

A useful definition is operational, not philosophical. Shadow GenAI is any generative tool — chat, image, code, or spreadsheet add-in — that a finance person uses on company, client, borrower, student or vendor data without a named owner, a data rule, and a retention story the controller can repeat. If the tool is on an approved list but the paste violates the data rule, it is still shadow use. Approval of a brand is not approval of a payload.

Three pressures make the behaviour rational. The close calendar has not lengthened. Official tools arrive late, while the pack is due on Thursday. Personal accounts feel private, and they are not: a free tier may train on inputs or sit in a jurisdiction the engagement letter never contemplated. The associate is trying to finish the pack, not to leak a debtor list.

Assume four jobs are already touched: management commentary, AP and AR exception narratives, first drafts of audit-query replies, and Ind AS questions that include real numbers. Credit desks add borrower narratives. Campus finance adds fee-defaulter lists. CA firms add client trial balances. If the policy says none of this happens, the policy is a wish.

The cost of waiting is asymmetric. A wrong variance sentence can be corrected in the next pack. A debtor file, a salary register or a borrower’s bank statement that left the building cannot be recalled from a consumer model. Containment is a data-exit problem first and a quality problem second.

2. Map the four doors data leaves through

Shadow use is not one door. Indian finance teams leak context through four doors, and each door needs a different control. Mapping them takes one afternoon if you ask the people who actually prepare the pack, not the people who wrote last year’s IT policy.

Run a twenty-minute standup with AP, AR, FP&A, treasury and the company secretary’s MIS cell. Ask three questions only: which tool did you open last month; what did you paste; did the output enter a file that left finance. Write the answers in a register. Do not collect confession as misconduct on the first pass. Collect pattern. Silence means you signalled punishment. Repeat with team leads one-to-one.

Name the register the Shadow Lane Log. Columns that matter: team, tool name as the user calls it, data class pasted, whether output entered an external file, whether the chat can be deleted, and whether a sanctioned alternative exists today. A log without the last column becomes a shame list. A log with it becomes a build list.

Left the building means the content reached a system the company does not control, even if nobody outside the team can see the chat. A prompt in a consumer account is a disclosure to the provider under ordinary readings of confidentiality. A screenshot on a personal messaging app is a second disclosure. Treat both as exits.

3. Classify what staff are allowed to paste

A total prohibition is easy to write and impossible to supervise. A classification is superviseable. Indian controllers can run three classes without hiring a privacy office.

Class C is the narrow set a sanctioned tenant may accept: internal policy text, already-published annual-report language, and aggregated figures that would not move a price or identify a person. Class C is not “anything already in the MIS pack.”

Write the classes on one page, with examples from your own close. “Do not paste personal data” does not stop an associate who thinks a debtor name is not personal because it is a company. Show a redacted ageing beside a forbidden one, and a covenant paragraph with the borrower renamed “Borrower North.” People copy examples. They do not copy principles.

Price-sensitive information needs its own line for listed issuers. Unpublished revenue, margin, exception items and deal status are Class A even when no individual’s name appears. A privacy-only card misses the listing heading. NBFCs should add borrower-level exposure and SMA or NPA status as Class A. CA firms and campus fee offices should copy the same card: a fee-default list and a client GSTIN tied to a ledger are not prompt toys. Trust is not a control. The engagement letter is.

4. Stand up one sanctioned lane this quarter

Containment fails when the alternative is “wait for the group AI programme.” The programme will slip. The close will not. Stand up one sanctioned lane before the next quarter close, even if it is narrow.

A minimum lane has five parts. A work account on a tenant the company pays for, with training-on-your-data switched off if the vendor allows that switch. A named owner in finance, not only in IT. A paste rule that repeats the three classes. A log of who has access. A kill switch the owner can use the day a vendor term changes. If a paid tenant will not arrive this quarter, the lane is “no paste of any live file; dummy file only; output reviewed by a second person.” That is slower. It is still a lane.

Pick one high-volume, low-classification job. Good first jobs are rewriting a variance sentence from a human-prepared bridge with no names, turning manager bullets into a board paragraph, and explaining a reconciliation step on the dummy company. Bad first jobs are a full debtor file, a tax opinion, or an auditor reply from a pasted working paper. Those need the citation sweep and the evidence test in earlier briefings. They are not onboarding tasks.

Shared-service centres add a shift problem. The person who pastes at 7 p.m. often missed the town hall. Put the class card on the close checklist or the AP queue, not only in email. Budget the lane in rupees you can defend: a modest per-seat subscription for the people who prepare external packs is cheaper than one client dispute about a leaked trial balance. If the CFO will not fund seats, write that decision in the Shadow Lane Log. Unfunded risk should not hide inside “we have a policy.”

5. Test a prompt the way you test a journal entry

Finance already tests a journal on source, preparer, reviewer and purpose. A prompt that produces language for an external file deserves the same shape. Shadow use skips all four. Restore them without turning every sentence into a project.

1. Source. What file did the numbers come from, and was it Class B or Class C? If the preparer cannot name the file, the output does not enter the pack.
2. Preparer. Who ran the prompt, on which account, on which date? A personal account fails this test even if the words look clean.
3. Reviewer. Who read the output against the source bridge, not against the prompt? Models smooth awkward truths. A dip in collection efficiency becomes “broadly stable” unless a human keeps the verb.
4. Purpose. Which paragraph in which outgoing file will carry the words? Output with no destination is how draft results wander into a chat history.

Keep a prompt register for repeated jobs. Each row stores the allowed input class, a dummy prompt and the reviewer role. Do not store live client numbers in it.

The model will invent a “one-off” for a variance the bridge does not support, turn a provision movement into an operational improvement, or cite an Ind AS paragraph you did not check. The reviewer test is a reverse trace: every adjective in the outgoing sentence must point to a line in the source. If it does not, cut the adjective. That is a citation sweep applied to narrative.

A generated formula that reallocates cost centres is a journal in disguise. Re-perform it on ten rows. A macro that “cleans” vendor names can merge two vendors and hide a duplicate payment. Sample the merge. Shadow add-ins fail because nobody re-performs.

6. Contract, DPDP and client confidentiality

Controllers are not the general counsel. They still have to know which sentence in which contract their paste may break. Three Indian frames show up again and again, and none of them is satisfied by “we used AI responsibly” in a footnote.

First, client and borrower confidentiality. Engagement letters, facility agreements and vendor contracts usually restrict disclosure to advisers under a duty of confidence. A consumer model provider is rarely that adviser. Pasting a trial balance can be a breach even if the answer was correct. Read the remedy clause, not an ethics slide.

Second, personal data. The Digital Personal Data Protection Act, 2023, and the rules around it, expect purpose limitation and security safeguards. Salary rows, fee-defaulter lists, proprietor KYC and employee bank details are personal data in ordinary language. A free chatbot is a weak safeguards story. If the class card does not say “personal data,” add the words. Staff understand PAN. They do not always understand “DPDP.”

Third, listing obligations. Unpublished price-sensitive information is not a prompt input. The company secretary belongs on the class card. An associate can create a bad insider-trading control narrative without trading a share, by placing unpublished numbers where a provider could see them. You do not need a proven leak. You need a plausible exit.

Paste rule we can defend: no client, borrower, employee or student identifier; no unpublished result; no document the engagement letter would not let us email to an unnamed vendor. Dummy files and already-published text only, unless the work tenant and the contract both allow the class.

A prompt typed in an Indian shared-service centre about a Gulf or African receivable may export data the local contract did not allow to leave. Ask where the prompt sits at rest. If nobody can answer, stay on dummy data. Shared passwords to a single “AI login” fail the leaver process. Named seats are how you remove access on the Friday someone resigns. The lane owner should re-read the training and retention clause each quarter. A switch that was off in April may be opt-out by October. Put that re-read on the close calendar.

7. Minute residual risk before the audit committee asks

Boards will ask whether finance is using AI. “Not really” is now false in most Indian teams. A better answer is a one-page residual-risk minute the controller can table.

The minute should state four facts. Shadow use was inventoried on a named date, by standup rather than by a firewall fantasy. Classes A, B and C are defined. One sanctioned lane exists, with an owner and a kill switch, or the lane is explicitly unfunded. Residual risk is named: personal phones, leaver accounts, and any Class A paste already contained. Do not claim zero residual risk.

Internal audit can test this without becoming the AI department. Sample ten external paragraphs: can the preparer show the source bridge and the account used? Sample devices for unapproved extensions. Sample leavers: was the work-tenant seat removed in the same week as ERP access? Those tests fit an ordinary plan. They do not need a model-risk framework you do not have.

If a Class A paste is discovered, contain first. Ask for deletion if the tool allows it, record that provider backups mean deletion is incomplete, inform the client or the company secretary if the class requires it, and tighten the lane. A show-cause notice as the first move teaches the next associate to hide the phone.

Faculty who send students into articleships should teach the class card as a professional skill. A commerce graduate who can redact a bridge before asking a model for wording is more employable than one who only produces fluent paragraphs. That skill belongs beside internal control, not in an optional workshop after placement.

8. Field checklist and closing brief

Use this list at the next close. Tick in ink.

1. Shadow Lane Log opened, with AP, AR, FP&A, treasury and secretarial MIS represented.
2. Four doors mapped: personal account, extension, phone photo, shared prompt file.
3. Class A / B / C card issued with your own examples, including price-sensitive numbers and personal data.
4. Dummy company file placed on the shared drive; personal accounts pointed only at that file.
5. One sanctioned lane named, owned, and funded — or the unfunded decision written down.
6. Prompt register started for the one job you allowed, with preparer and reviewer roles.
7. Engagement letters, facility agreements and listing duties checked against the paste rule.
8. Leaver checklist includes the work-tenant seat, not only the ERP login.
9. Quarterly vendor-term re-read scheduled; kill switch described in one sentence.
10. Audit-committee minute drafted: inventory date, classes, lane, residual risk, next action.

Shadow GenAI is what finance teams do when the official programme is slower than the close. Containment is a classification, a dummy file, a named lane, and a minute that tells the truth about phones. The paste window is the new cash box. Count it before a client or a regulator counts it for you.