For most of business history there was no finance department. There was a ledger, and a clerk who kept it, and an owner who could see everything else by walking the floor. Finance became a department — a function with authority over every other function — only when companies grew past what an owner could see. Alfred Chandler’s The Visible Hand (1977) traces the modern management hierarchy, and modern cost accounting with it, to the railroads of the 1850s: the first businesses so large and so spread out that the only way to run them was through the numbers. The ledger stopped being a record of the business and became the only complete view of it.
That is where finance’s power comes from. Not from the money — from the seeing. Finance holds the system of record, so every other department reports to it, in its language, on its calendar. The chief financial officer (CFO) sits with the owner because the CFO is the one person in the building who can describe the whole company in a single unit of account.
Hold that definition — the department that can see the whole company at once — and ask who fits it now. In a small or medium business (SMB) in 2026, it isn’t finance. It’s information technology (IT), and almost nobody has told IT.
The ledger moved
Ask a simple question of a 40-person company: when something happens, where does it get recorded? A sale lands in the customer relationship management (CRM) system. A hire lands in the payroll platform and the identity directory. A purchase order lands in the Enterprise Resource Planning (ERP) system or, if you’re honest, in an email thread. A contract lands on the shared drive. A decision lands in a chat channel. Every one of those events exists in a system, with a timestamp and a username, long before it becomes a journal entry.
The general ledger is still the system of record for money. But somewhere along the way it became a downstream report — a summary, produced monthly, of things the operational systems already knew in real time. For a century the ledger was the source and the operation was what it described. Now the operation is data, and the ledger is one of its outputs.
Whoever runs the systems runs the record. The auditors noticed first. After the Sarbanes-Oxley Act of 2002, an audit of a public company’s financial statements came to include the systems those statements come out of: who can log in, who can change a number, whether the change leaves a trace. The logic was unavoidable. A control that lives in software is only as strong as the software’s permissions, so the auditor has to test the permissions. A private company never files under that statute, but the same questions reach it anyway, on the cyber-insurance renewal and in a large customer’s due-diligence questionnaire. Finance has been sharing its authority with IT ever since, whether or not the org chart admits it.
Follow the spend
Finance’s second source of authority is budget. Spend passes through finance, so finance sets the rules for spend. Now look at where a small company’s operating spend has gone.
It has gone to subscriptions. Software as a service (SaaS) seats, cloud storage and compute, and, increasingly, metered artificial intelligence (AI) — priced per seat, per gigabyte, per token, billed monthly, and expanding by default. Most of it never crosses a purchasing desk. It accrues on corporate cards across the company, approved by whoever had the card. Software bought outside IT — shadow IT — is the expense-report problem of this decade: petty cash, except it renews automatically and has your customer list inside it. In the companies we walk into, the real subscription list is longer than the owner’s guess, and it is rarely shorter.
AI sharpens the point. An agent that reads a shared inbox, drafts responses, and files the results is not a tool in the way a spreadsheet is a tool. It is a worker with a login, a set of permissions, and a budget that meters like electricity. Someone has to provision the identity, scope what it can touch, cap what it can spend, and keep a record of what it did on the company’s behalf. That is finance’s job description — custody, authorization, limits, audit trail — applied to software. It lands on IT because it can’t land anywhere else.
The controls were always the same controls
Here is the part that should reassure a finance person rather than threaten them. The controls finance built over a century are not accounting techniques. They are ideas about power, and IT has been running the same ideas under different names for decades.
- Segregation of duties is least privilege: nobody holds both ends of a transaction, and nobody holds a key they don’t need for the work.
- The approval signature is the change ticket: a change to production requires a second person to say yes, in writing, before it happens.
- The reconciliation is the access review: on a schedule, compare who should have what against who actually does, and explain every difference.
- The audit trail is the log: an append-only record of who did what, when, that nobody can quietly edit afterward.
The shell got there early. sudo exists so that the person who can do anything must say so, on the record, before the system will let them. That is a control a controller would recognize on sight. And the newest version of the same idea is that an instruction given to a model is an entry in a book of record, as [[The AI audit trail: log prompts like journal entries]] argues, and deserves the same discipline as a debit and a credit.
None of this needs to be invented. It needs to be recognized — by the finance side as their own controls wearing a hoodie, and by the IT side as the reason the controls exist.
What finance has that IT still doesn’t
The honest version of this argument also names the gap, because it is wide. Finance in a small business has three things IT almost never has.
A close. Finance has a ritual on a calendar: the books are reconciled, the exceptions are explained, and someone signs. IT has “when something breaks.” There is no monthly moment when the subscription list is reconciled against the card statements, the access list is reviewed against the org chart, one backup is actually restored, and someone signs their name to the result. The information exists. The ritual doesn’t.
A language every manager speaks. Almost every department head can read a profit and loss (P&L) statement, because the company taught them to and promotions depended on it. Almost none can read a permissions model, a data-flow diagram, or an AI usage report. So the department that can see the whole company reports its findings in a language the rest of the company doesn’t read, and the findings go nowhere.
A seat. The CFO reports to the owner. IT in an SMB reports to whoever is angriest today, usually through the ticket queue of a managed service provider (MSP), and the MSP is paid to keep the lights on, not to tell the owner what the systems reveal about the business. Nobody at the table owns the view.
Finance got its seat because owners learned, expensively, that the alternative was not knowing. The same lesson is arriving for IT, and it arrives faster: a company that cannot see its own systems cannot see its own operation anymore, because the operation is the systems.
Run it like the department it is
If IT is the new finance department, the move is not to hire a chief information officer. The move is to borrow the structure finance already figured out, at SMB scale, in four steps.
- Give it a ledger. A chart of accounts for your technology: every system, who owns it, what data it holds, what it costs a month, and who can log in. One page. In our experience it takes a few days to a week to build the first time and an hour or two a month to keep true, and it is the single document every later decision — a migration, an audit, a cyber-insurance renewal, an AI rollout — turns out to need. [[The small-business IT foundation]] walks through what belongs on it.
- Give it a close. Monthly or quarterly, on the calendar: reconcile subscriptions to card statements, review access against the org chart, restore one backup to prove it restores, read the AI usage report, sign. An afternoon. The point is not the checklist; it’s that the company now has a moment when the systems are looked at instead of merely running.
- Give it controls finance would recognize. An approval before a new subscription, not after. Least privilege by default, with the exceptions written down. A log for anything a model or an agent does in the company’s name. If you already run a real record-to-report process, most of this is the same discipline applied one layer down — [[Record-to-report automation and controls]] shows what that layer looks like.
- Give it a seat. Copy the structure finance uses at your size: an in-house owner, even part-time, who can speak both languages; an outside firm for the mechanical work, the way an outside bookkeeper handles the mechanical side of accounting; and a fractional strategist for the decisions, the way a fractional CFO sits in on the ones that matter. The MSP is your bookkeeper. It is not your CFO, and it was never going to be.
The company that does these four things hasn’t reorganized. It has admitted something that was already true: the function that can see the whole operation is the one that runs the systems, and it deserves what finance already has: a ledger, a close, and a seat.
Next step
Finance took a century to go from a clerk with a ledger to a seat at the table. IT doesn’t have that long, because the spend, the record, and the risk have already moved. If you’d like the one-page ledger built for your own company — and a second reader who speaks both finance and IT to walk the first close with you — tell us what you run, and we’ll start with what’s actually on the card statements.