CFOs must claim the agentic record before the next renewal locks it away

This HFS Point of View is for CFOs, finance transformation leaders, and F&A sourcing executives contracting for control of the agentic execution record at renewal.

CFOs who outsource finance operations face a gap that did not exist three years ago. Invoice matching, collections triage, and reconciliation now run as configured workflows, creating an agentic record of how the work was actually done. That record sits on the provider’s platform, while what reaches the CFO is a quarterly scorecard. Since agents approve invoices, release payments, and set provisions, they operate financial controls, creating an attestation exposure, rather than a reporting inconvenience.

HFS believes that CFOs must start contracting for the record at renewal, and this paper sets out the four capabilities to contract for.

Your provider writes a scorecard you use to judge it

The recently released HFS Horizons: F&A Services-as-Software™, 2026, assessed 17 service providers and 6 finance technology partners. Client references rated providers between 4.4 and 4.7 out of 5 across service levels, audit readiness, governance, and talent, and 96% reported business cases at or above plan. Those measures were built for a service people delivered, and none of them would show an agent deciding outside policy. Such tightly clustered scores reveal very little. Four dimensions within 0.4 points of one another near the top of a five-point scale cannot distinguish a strong performer from an adequate one. In effect, every provider passes.

The problem is structural. The party that runs the process also supplies the numbers describing it and reports against measures designed for labor-based services. Service levels show whether work was completed on time. Governance shows whether meetings took place and reports arrived. These measures were useful when people did the work.

Several of the providers we assessed offer model monitoring and drift detection. However, contractual requirements to measure drift against a client-set baseline or to report it to the client at all remain rare. The same gap applies to exception rates: a falling rate may mean the software is resolving more cases, or that it has stopped flagging cases it should, and nothing in a standard governance pack distinguishes the two. The scorecard reports faithfully on a service that is being redesigned around software. The problem is that the measures have not moved with the delivery model.

Codified execution produces two things; your contract pays for only one of them

Services-as-Software codifies a service into a product. The delivery method becomes software, and the commercial construct follows. That codification does two things at once, and your contract prices only one of them.

For your provider, it raises the execution ceiling. A codified process runs the same way on a Monday as on a Friday, improves once for every client at once, and no longer depends on who is on shift.

For you, it creates something outsourcing has not produced before. The process becomes documented as it runs. Well-designed agentic platforms capture, by default, every decision the software takes, every case it declines, and every threshold a person overrides. Whether yours does is precisely what the four capabilities below test. Where it does, the knowledge that once sat in a delivery team’s heads exists as an artifact, and that artifact is the raw material for governance and for your next negotiation.

Process mining promised this a decade ago and delivered it retrospectively on data that had already been through the process. Codified delivery is the first model that returns the knowledge by construction rather than by after-the-fact reconstruction. It helps to separate two layers (see Exhibit 1). Execution is where transactions run. Above it is a control plane that holds the policy defining what the software may decide, the evidence that it decided correctly, the measurement of results, and the means to move elsewhere. The record accumulates in that control plane, and whoever operates it controls access to it.

This delivery model raises a separate sourcing question. Fragmented sourcing imposes an integration tax, and consolidation addresses it. Consolidating execution with one provider is a sourcing decision, while retaining the record it generates is a governance one. The two cannot be settled in the same clause.

Exhibit 1: The gains sit in the execution layer, the record sits in the control plane, and most contracts stop between them

Source: HFS Research, 2026

An agent that operates a control is a control, and you cannot attest to what you cannot see

In most functions, missing execution data is an inconvenience. In finance, it can create statutory exposure.

When software approves an invoice, releases a payment or determines a provision, it operates a control. Management asserts each year that the control environment functions. Your external auditor decides whether to rely on those controls or test around them, based on evidence of how the control was configured and what it did.

The Horizons report names auditability and explainability among the constraints on scaling AI in finance, a qualitative finding drawn from the provider assessments rather than a survey measure. What it does not address is the buyer’s side of that constraint. An external auditor has to understand and test the controls they intend to rely on. When a control is configured and operated inside a provider’s platform, the evidence supporting that reliance does not sit with the enterprise.

If the evidence exists only inside your provider’s platform, your audit position depends on its co-operation. That may hold while the relationship is good. It becomes costly in a dispute and reportable during a transition.

Four capabilities that only work as a set

As a CFO, you must retain four capabilities, whatever else you buy.

• Decision rights: what the software may decide, at which thresholds, and who handles what it declines
• Evidence: the artifacts you retain to support an assertion
• Telemetry: the measurement of the outcome you pay for
• Exit: what you need to run elsewhere, and how long it will take to reach operational parity

The set matters more than any single element. Without decision rights, the numbers have no defined correct answer, so drift and legitimate variation look alike. Without evidence, the numbers cannot support an assertion to your auditor. Without an exit, you can identify a problem but have no means to correct it.

This does not have to be adversarial. The most advanced providers we assessed already offer transferability and reduced client dependency as part of what they sell. A provider unwilling to offer all four is treating your dependency as an asset on its own balance sheet (see Exhibit 2).

Exhibit 2: Four capabilities, and the question that tests each one at renewal

Source: HFS Research, 2026

The Bottom Line: Buy the execution and own the record. Software-defined delivery produces the record you need to govern your finance function, and your provider currently holds it. Renewal is when that becomes negotiable.

1. Ask your provider what execution data it holds and what it will hand over. Do that before drafting the next RFP.
2. Own the telemetry before you sign anything outcome-based.
3. Design each agentic control for attestation before it reaches production.
4. Name one owner for the control plane within your finance team.

A provider that is confident in what the record shows should be willing to hand it over. Ask before you sign, not after.