Dive Brief:
- Finance teams may soon be building their own software with little to no coding experience, but CFOs will need strong governance frameworks to mitigate potential operational and compliance risks, according to Boston Consulting Group analysts.
- ”Vibe coding” — where users create software applications by describing desired functionality in natural language rather than writing code themselves — could move into mainstream finance use cases including forecasting, anomaly detection and document review, analysts at BCG’s Center for CFO Excellence said in a recent report. But this could quickly introduce new risks without proper controls, they said.
- “Done right, AI-driven [code] development gives finance teams a faster path to the applications they have always needed and rarely had the resources to build,” the authors said.
Dive Insight:
The term “vibe coding” was coined by Andrej Karpathy, co-founder of OpenAI, in a February 2025 post on X.
Coding agents such as Claude Code and OpenAI Codex can write and execute code, work with structured data and build applications from natural language instructions, BCG analysts wrote.
“Innovation in this space is quickly expanding the breadth of capabilities that agent-driven coding platforms provide,” they said. “This allows both finance analysts and IT departments to accelerate development cycles.”
BCG predicted that finance organizations will increasingly adopt these tools as AI coding agents become more capable of generating, testing and deploying applications with limited human engineering input.
This could enable faster development of tools for tasks such as variance analysis, anomaly detection, forecasting models and management reporting — areas where many finance teams still rely heavily on spreadsheets or manual processes.
But the authors cautioned that the same accessibility that makes vibe coding attractive also introduces new risks if adoption outpaces governance.
In a March report, researchers at the Cloud Security Alliance, a non-profit dedicated to cybersecurity, said organizations are integrating AI-generated code at scale into production systems, while governance frameworks remain early-stage.
“The security risks of AI-generated code are not random or edge-case in nature — multiple independent research efforts have found consistent, reproducible failure patterns,” the CSA report said.
On top of security issues, vibe coding could open the door for auditability risks, BCG warned. It could also trigger “AI sprawl” across finance departments, creating complexity and management challenges for CFOs.
“A CFO who allows the team to build freely without a governance framework risks trading ‘shadow Excel’ for ‘shadow code’ — undocumented scripts and applications that exist outside official systems and lack proper oversight,” the authors said. “Shadow code is far harder to see until something breaks.”
BCG’s analysts said AI-coded applications should not replace core platforms for accounting, planning and reporting, but should instead sit on top, making data and insights more accessible, usable and easier to interpret.
In addition, they said leaders should choose initial use cases carefully, favoring areas where the risk is manageable. The authors also stressed that coding agents cannot replace human judgment.
“CFOs still need employees who can interpret results, apply policy and make decisions in ambiguous situations,” the post said.
