Most Indian boards are now asked to approve GenAI tooling budgets. The papers that reach them often list hours saved, faster close, or reduced outsourcing. They rarely show, in the same document, which controlled outputs will be touched, what residual failure modes remain, and which human still owns the final number or narrative. The result is a decision that feels progressive and is later difficult to defend when an auditor, a regulator, or a successor CFO asks how a particular figure was produced. A well-written board paper separates the productivity claim from the control gap so that the board can approve the former only after it has accepted the latter.
Indian CFOs operate under simultaneous pressures. Statutory auditors under the Companies Act, internal audit, audit committees, and, for listed entities, the expectations that accompany BRSR and SEBI disclosures all assume that management can reconstruct how a material number or narrative was produced. Generative tools sit outside traditional ERP controls. They do not post to the ledger. They produce a draft classification, a variance explanation, or a first-cut cash-flow narrative that a human later adopts or rewrites. When the board paper collapses the productivity story and the control story into one paragraph, the board cannot see the trade-off it is being asked to accept.
Separating the two columns forces clarity. The productivity column states what the tool is expected to change: cycle time, outsourcing cost, or the volume of routine drafting. The control column states what remains unchanged: the human who still owns the output, the evidence of review that will still be retained, and the residual risk that has been accepted. This separation is especially useful in emerging-economy settings where ERP systems are mature but AI-specific model-risk frameworks are still being written. The board does not need a full model-risk management system on day one. It needs to see that management has not treated the tool as invisible.
The same separation also protects the CFO. When a later query arrives, the paper already records that the board was shown both the expected gain and the residual gap. The decision is therefore joint rather than a finance-only experiment that later has to be explained after the fact.
Three claims appear frequently in Indian finance GenAI papers. Each is legitimate. Each becomes dangerous when it travels without its companion evidence.
The first is the time-saving claim. “Variance narratives will take half the time.” The companion that must travel with it is the statement of which narratives will still be re-performed against source data and which will be accepted after a lighter review. Without that companion, the board cannot know whether the time saving comes from removing re-performance that was previously a control.
The second is the quality or consistency claim. “The model produces more consistent first drafts.” The companion is the definition of consistency that matters for the controlled output. Consistency of language is not the same as consistency of classification logic or of numerical accuracy. The paper must state which of those dimensions will be tested and by whom.
The third is the cost-avoidance claim. “We will reduce reliance on external drafting support.” The companion is the residual work that remains inside the company: prompt design, output review, exception handling, and the archive of what was accepted. If that residual work is not named, the cost saving is overstated and the control gap is understated.
The paper does not need a full technical specification. It needs a short set of facts that let a non-specialist director ask a follow-up question.
These five items fit on a single page. They can be presented as a short table or as five labelled paragraphs. What matters is that they appear in the main paper rather than only in a technical appendix that directors may not read.
Indian teams that already maintain a living GenAI use register can extract the relevant rows for the processes in scope and attach them as an annex. The board paper then becomes the decision document; the register remains the operating record. The two should cross-refer so that later reviewers can move from the decision to the contemporaneous evidence without searching a shared drive.
Residual risk is often either understated (“the model is accurate”) or overstated (“AI is unpredictable”). Neither formulation helps a board decide. A usable residual-risk sentence has three parts: the process, the residual failure mode, and the compensating control that keeps the failure mode from reaching the final output.
Example: “Monthly variance narrative is drafted with assistance from a company-account model; residual risk is an invented reference to a prior-period adjustment; compensating control is the detailed variance review performed by the reporting manager against the ERP extract before the pack is issued.” That sentence can be read by a director who does not follow AI developments. It also gives the audit committee a concrete item to sample later.
The paper should present two or three such sentences for the processes in scope, not a single generic statement. It should also state the decision the board is being asked to make: approve the pilot under the stated residual risks, require additional compensating controls before approval, or defer until the residual risks can be reduced. A paper that only “notes” residual risk leaves the decision ambiguous.
For companies that already run a formal risk-acceptance process, the residual-risk sentences can be mapped to the existing risk register. The board paper then shows that GenAI residual risk is being treated with the same discipline as other operational or financial-reporting risks, rather than as a special category that sits outside ordinary governance.
Indian listed companies face a patchwork of expectations rather than a single AI regulation. The board paper does not need to claim compliance with a non-existent comprehensive statute. It needs to show that the proposed use has been considered against the expectations that already apply.
Three mappings are practical. First, to the audit committee’s responsibility for the integrity of financial reporting. The paper can note that AI-assisted processes will be included in the internal-audit plan for the next cycle and that the statutory auditor will be informed of the processes in scope during planning. Second, to the management-representation process. The controller’s sign-off on the monthly or quarterly pack can include a short confirmation that the residual risks accepted by the board for AI-assisted processes remain acceptable. Third, for companies that prepare BRSR or respond to ESG rating questionnaires, the paper can note that any AI use that affects reported sustainability metrics will be logged in the same data-lineage file used for BRSR Core assurance.
These mappings do not require new policies. They require the board paper to name the existing control or reporting process that will absorb the new tool. When a later regulator or rating agency asks how the company governs AI, the answer can point to a board decision, a residual-risk acceptance, and a link to an existing control rather than to a generic AI policy that has never been tested.
The same approach works for unlisted companies and for group subsidiaries. The paper can be adapted for the parent’s risk committee or for the local board, provided the residual-risk sentences and the human-owner statements remain specific to the processes that will actually run in that entity.
The board decision is only the first step. The paper should also prescribe the language that will be used in the next two or three audit-committee or board-risk packs. A usable follow-up extract has three lines: the process name, the residual-risk sentence that was accepted, and the date of the last review of that process. The extract does not need to restate the original productivity claim. It needs to show that the residual risk remains under review.
The paper should also set a review date. A six-month review is usually sufficient for a pilot. At that review the CFO reports whether the residual failure modes materialised, whether the compensating controls operated as described, and whether the pilot should be continued, expanded, or stopped. The review does not need to claim that the tool has delivered the full productivity benefit. It needs to confirm that the control gap has not widened.
For the audit committee, the same extract can be accompanied by a short internal-audit observation: whether the human-review evidence for the processes in scope was available and whether any exceptions were escalated. This closes the loop between the board decision and the operating evidence. When a successor CFO or a new audit-committee chair later reads the file, the sequence is visible: decision, residual-risk acceptance, operating review, and internal-audit sample.
Indian companies that already maintain a living GenAI use register can make the register the source of the quarterly extract. The board paper then points to the register as the living record; the register points back to the board decision as the authority under which residual risk was accepted. The cross-reference keeps both documents from drifting.
Use the following checklist before the next board or audit-committee paper on GenAI tooling is finalised.
The checklist is deliberately operational. Completing it once produces a board paper that separates productivity from control. Completing the review step keeps the separation alive. The result is not a perfect inventory of every prompt. It is a decision record that lets an Indian CFO answer, with evidence, the question a director, an auditor, or a successor will eventually ask: what gain did we expect, what residual failure mode did we accept, and who still owns the final output?
Further reading on DrDPKlass: earlier notes in the AI & Business series address the living GenAI use register, the containment of shadow tools, and the stress-testing of GenAI cash-flow forecasts. The board paper described here supplies the decision document that makes those operating controls governable.