This review examines how Artificial Intelligence (AI) and advanced analytics are used to prevent and detect corporate financial misconduct, and whether that capability translates into organizational control. Following the PRISMA 2020 protocol, 53 publications issued between 2015 and 2025 were retrieved from Scopus, Web of Science, and ScienceDirect and coded along four dimensions: technology family, governance mechanism, misconduct focus, and empirical setting. The corpus is analyzed with an explicit quantitative apparatus. Within this corpus, a log-linear count model places annual growth at 60.8% ( β ^ 1 = 0.475 , z = 6.64 ), a doubling time of 1.46 years; 64.2% of the corpus appeared in 2024 and 2025, and the estimate is reported as a pattern in the selected corpus rather than a growth rate of the field. Machine learning dominates the technology side (43.4%, 95% Wilson interval 31.0–56.7), while audit and forensic accounting is the most frequent governance mechanism (45.3%). A descriptive screen of the technology by mechanism matrix, using lift and standardized residuals, flags 7 of 45 cells as departing from the independence baseline, among them machine learning with board governance ( r = + 2.59 ) and data analytics with compliance ( r = − 2.49 ). Because the coding is non-exclusive, these residuals locate where attention has concentrated and are not hypothesis tests or evidence of a causal relation; under a minimum-frequency criterion, only the data analytics with audit coupling is robust, so the association analysis is exploratory. Financial statement fraud absorbs 83.0% of the outcome coding, which confines the review’s firmer conclusions to that category. The misconduct dimension is the least even of the three coded dimensions (Pielou J = 0.62 against 0.94 for technology). A detection-theoretic argument then shows why detection performance alone is a poor guide to control: under a low base rate, precision collapses, and the share of misconduct that reaches remediation is the product of the detection rate and the pass-through probabilities of escalation, investigation, and remediation. We formalize this as a control yield parameter and embed it in an integrative model. The model and its four propositions are conceptual constructions derived from the synthesis, offered for empirical testing rather than established by the review, and each is paired with the parameter a future study would estimate. We set out a research agenda built around field validation, human and machine decision making, and the governance of model risk.
Financial misconduct is one of the clearest symptoms of a failed internal control system. It covers a wide range of behavior, from accounting manipulation and earnings management through to money laundering and bribery. Occupational and corporate fraud has been estimated to absorb roughly 5% of annual revenues, although the figure varies considerably across studies and institutional settings, and it drains resources that would otherwise fund investment and innovation [
1,
2,
3]. What these behaviors share is a familiar combination of opportunity, incentive and rationalization, together with a control system that fails to register the event while it is happening [
4,
5].
Detection, however, is only one part of the problem. Treating it as the whole problem leaves the upstream causes untouched. The issue is a governance one, and every step needs attention: how data are sourced, how they are analyzed, how the analysis is interpreted, and what sanction follows. Technological solutions have recently emerged that can strengthen managerial capacity at several of these steps. Artificial Intelligence and data analytics in particular have been studied as instruments that identify irregular patterns in historical data and propose responses. Machine learning can recover nonlinear relationships between financial ratios and governance indicators that a human auditor would not perceive [
6,
7,
8,
9]. Natural language processing extracts risk signals from annual reports, and in particular from the management discussion section [
10,
11]. Explainable AI improves the interpretability and auditability of these models, which in turn makes their outputs easier to justify and to contest [
3,
12,
13,
14,
15,
16].
Against this background, one might expect that introducing these technologies would be enough to suppress misconduct, either by catching it or by deterring it. The reality is less accommodating. For these systems to change anything, their outputs have to be readable, trusted and open to challenge. The obstacle is therefore organizational rather than technical, and it calls for a deliberate stance from decision makers. The literature has examined the technical relationship in considerable depth, but the link between that technical work and the organizational work remains thin [
17,
18,
19,
20].
Fragmentation of the Existing Literature
Several syntheses of this field already exist. Reviews have documented the effectiveness of detection techniques for financial statement fraud [
13,
21,
22,
23], including related-party knowledge graphs that surface fraud patterns across connected entities [
24], applications of Artificial Intelligence and machine learning [
25], work on fintech and the way misconduct techniques evolve there [
26], money laundering [
27], forensic accounting [
28,
29], and blockchain [
13,
30]. Their common limitation is a technical focus that leaves aside the people who actually use these models and the constraints they operate under.
The empirical literature is segmented in a similar way. One strand tests the direct effect of governance mechanisms on misconduct and reports that adding governance indicators to prediction models improves detection beyond what financial variables achieve on their own [
2,
3,
6,
7]. A second strand works on related parties and firm networks, using knowledge graphs linking managers to institutions and classifiers such as support vector machines to raise performance [
31,
32]. A third mobilizes corporate narrative disclosure, concentrating on the management discussion section and on tone, and combines the resulting features with financial indicators [
10,
11,
33,
34]. A fourth uses internal control and audit variables such as audit quality and audit opinion [
19,
27,
35,
36,
37,
38,
39]. A fifth addresses regulatory monitoring, compliance and anti-money-laundering work, on the assumption that AI can extend board capacity through data-oriented decision making, accountability, and automated analysis [
6,
20]. This review sits at the intersection of four research streams that rarely speak to one another: agency theory, corporate governance, the criminology of misconduct, and technological integration in internal control.
Agency, Information Asymmetry, and the Oversight Problem
Information asymmetry between capital owners and the managers who make daily decisions is one of the roots of corporate misconduct. Read through agency theory, private knowledge of the firm’s true position creates room for opportunistic behavior and for the exploitation of loopholes, whatever their legal status, while monitoring agents receive only a distorted signal [
40]. Governance mechanisms were introduced to contain such behavior and to protect the firm’s resources, and the literature has linked board composition and ownership structure directly to manipulation of financial statements [
41].
Subsequent work has tried to quantify the contribution of these mechanisms. Adding governance variables to machine learning models improves accuracy [
2,
6,
7,
9], and indicators such as CEO characteristics carry predictive content for fraud [
3]. Seen this way, Artificial Intelligence is one possible response to the information asymmetry problem and a mechanism that can be pointed at existing oversight structures to supply continuous and current information about risk, performance, and the openings that fraud exploits [
42,
43].
Opportunity, Rationalization, and the Behavioral Substrate
Alongside the agency perspective, criminology offers the fraud triangle, which organizes the reasons actors engage in misconduct around pressure, opportunity and rationalization, with capability added later [
4,
5]. Two strands follow from it. The first analyzes opportunity through relational networks, on the basis of the argument that a manager’s ties to other structures create openings for fraud [
31,
32,
44]. These studies use graph neural networks and knowledge graphs to predict fraud patterns and report performance gains once managers are linked to other institutions. The second concentrates on rationalization, reading the firm’s narrative through annual reports, language, and proxies such as teamwork culture in order to surface the justifications that often accompany misconduct [
45,
46].
Technology in Practice: Why Capability Is Not Control
Adopting a technology does not by itself produce the outcome the technology promises. It has to be used, repeatedly and under real constraints, before it bears on anything [
47,
48]. When an AI-based detection model is introduced, its control effect depends on whether auditors, directors and compliance officers incorporate it into their routines. This places AI and analytics among the enablers of compliance rather than among its direct drivers, a distinction we formalize in
Section 2.8.
Internal Control as an Integrated Process
The COSO framework treats internal control as a process meant to give reasonable assurance over reporting reliability and compliance, and it decomposes that process into a control environment, risk assessment, control activities, information and communication, and monitoring [
49]. Across these components, the activity grows more complex and more dependent on the availability and quality of information. The literature also warns against over-reliance on rigid processes. Compliance that hardens into routine turns oversight into paperwork rather than control [
50]. In that situation, automated tools generate records without performing any monitoring, and responsibility becomes ambiguous when fraud goes undetected [
20].
AI and Data Capabilities: A Functional Decomposition
To avoid treating AI as a single undifferentiated object, we distinguish seven functional capabilities, each matched to a different control possibility. Prediction and classification estimates the probability of misstatement for a firm-period. Anomaly detection isolates irregular transactions, accounts or reports. Representation learning derives features from raw high-dimensional data. Text and narrative analysis extracts information from managerial communication. Relational and graph reasoning reconstructs the structure of a firm and its concealed connections. Explanation and interpretability make a model output something an expert can dispute. Continuous data processing supports uninterrupted rather than periodic observation.
This entry is adapted from the peer-reviewed paper https://doi.org/10.3390/encyclopedia6110240
