How Cortex investigates accounts

The investigation model

When Cortex investigates an account, it operates as an autonomous agent with access to a fixed set of data tools. It does not have free-form access to your database. Instead, it can only call specific tools, each returning structured data, and it must reason about what it finds to produce a set of findings and a confidence score.

This constrained design is deliberate. Cortex can read data and create reconciling items, but it cannot post journal entries, modify balances, or take any action that changes your general ledger. Every action it takes is reviewable and reversible by a human.

The 7 data tools

Cortex has access to exactly seven tools during an investigation. Each tool takes structured input parameters and returns structured output.

1. Balance Details

Retrieves the current period's balance breakdown for the account: GL balance, subledger balance, reconciled amount, unreconciled variance, and any prior-period carry-forward items. This is typically the first tool Cortex calls to understand the overall state of the account.

2. Transaction History

Pulls the full list of transactions posted to the account during the current period. Each transaction includes the posting date, amount, description, source system, and reference number. Cortex uses this to identify unusual entries, round-dollar amounts, duplicate postings, or transactions posted near period end.

3. Period Comparison

Compares the current period's balance and activity to one or more prior periods. Returns the period-over-period variance (absolute and percentage), along with a breakdown of what changed: new transactions, cleared items, and balance movements. Cortex uses this to flag unexpected swings.

4. Reconciling Items

Retrieves all open reconciling items for the account, items that explain the difference between the GL balance and the subledger or bank balance. Each item includes its age (days outstanding), category, amount, and any notes from the preparer. Cortex evaluates whether the items are reasonable and whether any are stale.

5. Account Metadata

Returns the account's configuration: account number, name, type (asset, liability, revenue, expense), reconciliation format, assigned preparer, assigned reviewer, materiality threshold, and any custom attributes. Cortex uses the materiality threshold to determine whether a variance is significant enough to flag.

6. Create Reconciling Item

Creates a new reconciling item on the account. Cortex uses this when it identifies a transaction or balance component that should be tracked as a reconciling item but is not yet recorded. The created item is marked as “Cortex-generated” and requires human review before it is considered final.

7. Update Confidence Score

Sets the confidence score for the account after the investigation is complete. This is always the last tool call in a sweep. The score is a decimal between 0.00 and 1.00, calculated using the five-factor formula.

Investigation workflow

Every Cortex investigation follows a consistent six-step workflow. The sequence is not hardcoded. Cortex decides the order of tool calls based on what it finds, but the pattern is highly predictable because the logic follows how an experienced accountant works.

Step 1: Connect context

Cortex begins by calling Account Metadata and Balance Details to understand what kind of account it is examining, what the current balance is, and what the materiality threshold is. This establishes the context for all subsequent analysis.

Step 2: Analyze data

Cortex pulls Transaction History and Period Comparison to examine the account activity in detail. It looks for patterns: large or unusual entries, duplicate postings, transactions near period-end cutoff, and significant period-over-period variances.

Step 3: Review existing items

Cortex calls Reconciling Items to review what the preparer has already documented. It checks whether the items are reasonable, whether any are aged beyond the organization's threshold (configurable, default 90 days), and whether the total of reconciling items fully explains the variance between the GL and subledger balances.

Step 4: Generate findings

Based on the data collected, Cortex generates a structured list of findings. Each finding represents something the reviewer should examine: a variance that needs explanation, a stale item that should be cleared, or a pattern that suggests an error.

Step 5: Create items (if needed)

If Cortex identifies a balance component that should be a reconciling item but is not yet recorded, it uses Create Reconciling Item to add it. These Cortex-generated items appear in the reconciliation with a distinct badge so the preparer can review and accept, modify, or dismiss them.

Step 6: Score and write work paper

Finally, Cortex calculates the confidence score using the five-factor formula and calls Update Confidence Score. It then generates a work paper, a structured narrative summarizing what it examined, what it found, and its overall assessment of the account's reconciliation quality.

Tool calls and responses

Every tool call and response is logged in the investigation audit trail. You can inspect the full sequence for any account by navigating to the account's reconciliation and clicking Cortex > Investigation Log.

The log shows:

• The tool name, input parameters, and timestamp for each call.
• The structured response returned by each tool.
• Cortex's reasoning between tool calls, the intermediate analysis that led to the next tool call or finding.
• The total token usage and processing time for the investigation.

This transparency is essential. If you disagree with a finding or score, the investigation log shows you exactly what data Cortex saw and how it reached its conclusion.

Findings structure

Each finding is a structured object with four fields:

• Type: categorizes the finding. Common types include VARIANCE_UNEXPLAINED, STALE_ITEM, DUPLICATE_ENTRY, CUTOFF_RISK, MISSING_DOCUMENTATION, THRESHOLD_BREACH, and PATTERN_ANOMALY.
• Description: a plain-language explanation of what Cortex found. Written at the level of a work paper note (e.g., “Three reconciling items totaling $47,200 have been outstanding for 120+ days without resolution notes.”).
• Amount: the monetary value associated with the finding, if applicable. For a variance finding, this is the unexplained amount. For a stale item finding, this is the total of aged items. Some finding types (like MISSING_DOCUMENTATION) may not have an amount.
• Recommendation: what Cortex suggests the preparer or reviewer do. Examples: “Investigate the three aged items and either clear or re-document with current status”, “Confirm the $15,000 variance is an expected timing difference and add a reconciling item”, “Review the duplicate $8,500 entries posted on 3/28 and 3/29 for possible reversal.”

Sweep modes

Cortex can run in two modes:

• Full sweep: investigates every account assigned to the sweep. Typically run once per close cycle after reconciliations are substantially complete.
• Targeted investigation: investigates a single account on demand. Use this when a preparer wants a second opinion on a specific reconciliation, or when a reviewer wants Cortex to examine an account that was flagged manually.

Full sweeps are triggered by CORTEX_SWEEP close tasks. Targeted investigations can be launched from any account's reconciliation view by clicking Cortex > Investigate.

What Cortex cannot do

Understanding the boundaries is as important as understanding the capabilities:

• Cortex cannot post journal entries or modify GL balances.
• Cortex cannot approve or certify an entity.
• Cortex cannot delete reconciling items. It can only create new ones.
• Cortex cannot access data outside the seven tools described above. It cannot query arbitrary tables, access emails, or read documents.
• Cortex does not replace human judgment. Its findings and scores are recommendations. The preparer, reviewer, and certifier retain full authority over the reconciliation.

For details on how to interpret confidence scores, see understanding confidence scores. To learn how your feedback improves Cortex over time, see calibrating Cortex with feedback.