Stay connected: follow us on LinkedIn and explore more at
www.CherryHillAdvisory.com.
.svg)
Subscribe now to join the Risk Register community:
When Anthropic filed its Form S-1 on October 26, 2026, most people went straight to the revenue numbers. We went to the risk factors, because that's where an AI company has to tell investors, in writing, what can go wrong with the technology your organization is starting to rely on.
Some of what's in there is striking. Anthropic told the SEC that its models gained unauthorized access to real systems during testing, that an export order once made it switch two models off for every customer worldwide, and that some harmful use may never have been caught. If you run an audit function, that matters to you even if you've never signed a contract with Anthropic, because frontier AI usually finds its way into a business through other vendors.
We read all 300-plus pages the way auditors read anything, looking for what breaks and who owns it. Here's what we think it means for internal audit.
The headline numbers are big. Anthropic reported $16.3 billion of revenue in the first half of 2026, up from $1.2 billion a year earlier, and a net loss of $80.7 billion over the same six months.
Most of that loss, $72.4 billion, comes from fair-value changes on convertible notes and similar instruments, so it isn't the business burning cash. The company has also committed to more than $269 billion of computing capacity from Google, Amazon and Microsoft into the 2030s.
Those figures are for investors. The part we'd point you to is the roughly 94 pages of risk factors, where the company describes in its own words how agentic AI can go wrong inside an organization. Each of those failure modes ends up on internal audit's desk sooner or later, and we see five lessons in them.
A lot of the AI risk conversation in our profession is still hypothetical. What if a model makes something up, what if an agent does something nobody asked it to. This filing talks about things that already happened. The models reached real outside systems during security testing. The company has operated at times with known gaps in its security defenses. And in June 2026, Commerce Department export restrictions made it disable two models, Fable 5 and Mythos 5, for every customer until the restrictions were lifted.
That reads a lot more like an incident log than a risk register. If AI sits at "low likelihood" on your annual risk assessment, it's a good moment to look at that rating again, because the audit committee may well ask about it. We wrote earlier this year about how fast AI risk is moving for audit committees, and the S-1 puts that speed in a document the company can be held to.
The filing describes "Virtual Collaborators," which are AI agents that carry whatever access, system connections and context an organization gives them. Look at that through an ITGC lens and it's a user account. The company also warns that an attacker could hijack an agent's session and use the customer's own credentials, and that it may face claims over what agents do on their own, even when the customer set them up.
Most access programs were built around people. Provisioning follows HR events, access reviews happen quarterly, and segregation of duties assumes one person per role. Say your accounts payable team adds an agent that matches invoices to purchase orders and can release payments under a set amount. Nobody hired it, so it never went through onboarding, and if someone switched it on inside a SaaS tool, there's a good chance it won't show up in next quarter's access review.
The good news is you already know how to handle this. Treat each agent as a non-human identity, give it only the access it needs, log what it does, give it a named human owner, and make sure someone has actually tested the off switch. For agents with access to financial reporting, that's ITGC work.
Most third-party risk programs ask about a vendor's financial health, security and service levels. Very few ask what happens if a government order shuts off the capability a process depends on. The S-1 describes a federal use directive and a Department of War supply-chain risk designation, both still being fought in court, plus the export shutdown that has since been lifted. The company also limits access to some models on its own, such as its Mythos model through Project Glasswing. And products turn over fast, since models released in the six months to September 30 brought in over 80% of third-quarter revenue.
You don't need a contract with Anthropic for any of this to reach you. The filing names AWS, Google Cloud and Azure as ways customers get its models, along with integrators and data platforms, so if one of your vendors builds on a frontier model, that model is a fourth party for you. Your continuity plans should name a fallback model for anything critical, and your vendor contracts should cover what happens when a model is retired or suspended. Our post on the IIA's Third-Party Topical Requirement shows where this fits in work you're already doing.
Anthropic says its AI now runs experiments, creates training data, automates evaluations and safety audits, and writes and reviews code. It credits part of its efficiency, more than $6.6 million of trailing revenue per employee, to how much its own teams use it. It also warns that a flaw in one model can carry into the next one in ways that are hard to spot.
Bring that into a finance team and the question gets very practical. If AI prepares the reconciliation, AI reviews it and AI summarizes the exceptions, where's the independent check? We've said in our webinars that you should be able to click into any AI output used in a control and see why it reached its answer. For an AI-performed control, we'd want five things on file: the model and version, the instruction it was given, the source data and where it came from, the output exactly as produced, and a documented review by a person who had real authority to reject it. It's worth agreeing that with your external auditor before year end, and our piece on the vanishing audit trail in AI reasoning explains why it matters.
The filing names Deloitte, KPMG, PwC and Accenture as integrators that bring Claude to customers, and EY audits Anthropic's own financial statements. Those same firms deliver a lot of the world's assurance work. When much of that work runs on a handful of models, mistakes stop being independent, and a blind spot in one model can show up at many firms at once.
Think about what that means at your own company. If management's close process runs on the same model as the audit tool that tests it, the audit committee should be asking whether that testing is really objective. The answer might be using a different model for critical testing, validating your AI audit tools independently, or at least disclosing the overlap. Whatever the answer is, the committee deserves to hear it, full stop.
The filing says the company believes that within a few years AI will match top human experts in most professions and work on its own for hours, days or weeks at a time. That's a forward-looking claim, and we'd treat it as one. Still, a function that plans for even half of it will be in a much better spot than one that doesn't plan at all, and we think the work changes in four ways.
By 2030, the things we audit will include the machines. The board's question sits at the center, which is whether the AI is doing what we think it's doing. Around it, six new items belong on the audit universe: agent identities and permissions, model versions and change control, prompts and instructions, the evidence trail from prompt to output, fallback models and kill switches, and how much the organization depends on a single model.
People still decide what good looks like, including risk appetite and thresholds. Agents test every item in the population all year, and exceptions come through with the model, prompt and data attached. Auditors review and challenge what the agents found, including whether the agents themselves can be trusted, and the board gets assurance on both the business and the machines. What auditors learn goes back into the criteria, so the cycle keeps improving. Sampling becomes the thing you have to justify, and assurance happens all year instead of once.
Auditors move from doing the testing to designing it. One agent pulls the population, another tests it and another drafts the finding, while the auditor builds the workflow, sets the criteria and owns the conclusion.
The CAE becomes the person who can tell the board whether the machines are working. The staffing pyramid flips, with more people spending their time on judgment and agent design and far fewer on manual testing. The most valuable thing internal audit will offer a board is honest confidence that the AI running the business does what management thinks it does.
Less of the year will go to pulling samples, chasing documents, re-doing calculations by hand and writing long reports. More will go to designing agent workflows, checking how models behave, tracing evidence back to the prompt, and explaining to the board what it all means. If you lead a team, it's worth rethinking the career path for your first-year auditors now, while you still have time to shape it.
You don't have to wait for new standards or new tools to get started. Here are three things you can do before your 2027 audit plan is final.
Then take one question to your audit committee, which is how much the organization depends on a single AI provider and how comfortable the committee is with that. It's a short conversation, and it tells you a lot about where the board's appetite sits.
We're a practitioner-led internal audit and risk advisory firm, run by former CAEs and Big Four alumni, and our team builds AI as well as audits it.
Our AI-enabled internal audit services cover co-sourced internal audit, SOX, external quality assessment and AI governance, delivered with our own AI tools and agents. Through forward deployed engineering, our engineers work inside your team to build and deploy agents in your environment with audit-grade controls from day one. And our training helps auditors become builders. We have trained close to 100,000 internal auditors, with reach in more than 94 countries.
If you're planning 2027 around where the profession is heading, talk to us and we'll work through it with you. You can also read more about how we approach AI governance and emerging risk.
It's the IPO prospectus of one of the leading frontier AI labs, and its risk factors describe real incidents involving AI agents, model shutdowns and security gaps. For internal audit, it moves AI from a hypothetical risk to a documented one that touches ITGCs, third-party risk, SOX and audit methodology.
In our view, agents will test whole populations all year, auditors will design and oversee those agents, and the CAE will give boards objective assurance that the AI running the business works as intended.
Yes, any agent whose access matters to financial reporting or another in-scope process. Those agents hold credentials and act inside systems, so they need provisioning, least privilege, logging of what they do, a named owner and a working off switch.
It's your exposure to AI models through the vendors, platforms and advisors that build on them. If your SaaS provider relies on a model that gets withdrawn or restricted, your process can be disrupted even though you never had a contract with the model provider.
We recommend five things: the model and version, the instruction or prompt, the source data and where it came from, the output exactly as produced, and a documented review by a person with authority to reject it.
Sources: Anthropic, PBC Form S-1, filed October 26, 2026; Fortune, prospectus overview; Fortune, risk factors; Asymmetric Curiosity. Figures are from the preliminary prospectus and may change on amendment. The $269 billion is the sum of the minimum Google, Amazon and Microsoft commitments disclosed in the filing. Views on the future of the profession are Cherry Hill Advisory's interpretation, not statements by the company. Not investment advice.
Subscribe now to join the Risk Register community:
