Internal auditors at Brazilian insurers need training to audit agents that triage claims and price risks: how to sample verdicts from the record, test that agent certificates are current, and check that held actions were approved by the right person. The audit opinion and finding ratings stay with them. SUSEP, the LGPD and the ANPD frame the oversight.
What does internal audit cover at a Brazilian insurer?
The audit plan in an insurer follows the money and the promises. Auditors test claims handling, from first notice to payment, looking for leakage, fraud and unfair delay. They test underwriting against the authority limits each underwriter holds, review technical provisions with the actuarial function, examine reinsurance recoveries, and check how commissions flow to brokers and other distributors.
Regulatory work is constant. SUSEP expects insurers to maintain effective internal controls and an independent internal audit function, and auditors produce the reports the board and audit committee rely on. Data protection reviews have joined the plan since the LGPD, because insurers hold health data, financial data and claims histories across their whole book.
How do agents change what auditors audit, and how they audit?
Two things happen at once. The business deploys agents in claims and underwriting, which become new audit objects. And audit can use agents on its own work.
On the audit side, the useful uses are:
- Full-population testing of claims verdicts (depth 1). Instead of sampling 30 claims, the agent reads every verdict filed in the append-only record for a period and flags those where the approver was not on the authority list.
- Workpaper drafting (depth 2). It drafts the test description, population, method and exceptions. The auditor reviews and signs.
- Certificate tracking (depth 1). It lists each business agent's capabilities, the depth Attest certified, and when each certificate lapses, so auditors can see whether any agent acted on a lapsed certificate.
- Management action follow-up (depth 3). Within the audit function's own limits, it sends reminders on overdue actions and logs responses.
For the business agents, auditors need to understand what internal auditors should never let an AI agent do, starting with paying a claim on the strength of an external document alone.
What must auditors learn, and what stays with them?
Auditors need to read the decision chain the way they read a segregation-of-duties matrix. Each action passes five bounds: role scope, certificate, sources, the insurer's own limits and the platform guardrails. The verdict names which bound decided. If an agent paid a claim, the auditor should be able to reconstruct which bound would have stopped it and confirm none did. Our guide on how internal auditors review an AI agent's decisions sets out the test steps.
They also need to understand certification. Depth is earned, not configured: the role sets a ceiling, Attest evidence sets the depth, and the lower wins. Certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day. An auditor who knows this tests the certificate history, not just the configuration screen.
Provenance is the third skill. In claims, a repair estimate emailed by a garage is external. A policy schedule from the policy administration system is sealed. An auditor should test that no payment rested on external evidence alone.
What stays with the auditor: the audit opinion, the rating of each finding, the scope of the plan, and the conversation with the audit committee. Audit's independence also means auditors should not approve held business actions themselves.
Which Brazilian rules shape oversight and literacy?
SUSEP supervises insurers and requires internal controls, risk management and an internal audit function that is independent of the areas it audits. When agents act inside claims or underwriting, they become part of the control environment SUSEP expects the insurer to manage and the auditors to test. Auditors need enough literacy to say whether those controls work.
The LGPD and the ANPD govern policyholder data. Health information is sensitive personal data under the LGPD, which matters for life, health and disability products. The LGPD also gives data subjects the right to request review of decisions taken solely on automated processing that affect their interests, so the insurer must be able to show where a person decided. The append-only record is the evidence auditors will test for that.
Cross-border references help structure the audit approach: the NIST AI Risk Management Framework's four functions, ISO/IEC 42001 for AI management systems, and ISO/IEC 27001 for the security of the systems agents connect to.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
A 90-day training plan for the audit team
Month one: literacy. Every auditor learns how a governed agent decides, what depth means, the four verdicts, and how the record is kept. The head of audit and audit managers should complete this first so the audit plan can be updated.
Month two: one audit. Pick one business use, for example claims triage, and run a pilot audit. Use the record to test full populations of verdicts, test certificate currency, and check approvers. Two auditors use an agent at depth 1 on their own testing and log where it helped and where it missed.
Month three: method. Write the agent audit programme, bank corrections to the audit agent's sources, and agree how findings on agents are rated. Our training plan template for internal auditors gives the structure, and banking corrections keeps the audit agent improving.
Where the Academy fits
Pryme Intelligence Academy's Foundations track gives the whole audit team the vocabulary of depth, the decision chain and certification. Auditors assigned to agent audits benefit from the Operator track, because it teaches how review decisions are made and recorded. Certificates are issued through VerifyDoc.ai, so an auditor can check any reviewer's credential at source by number or QR code.
Questions people ask
Should internal audit hold Operator certificates if it does not operate agents?
Holding the certificate is not required, but the knowledge is. An auditor who has been through review training knows what a good review looks like and can test it.
Can audit use the same agents the business uses?
It is better to keep audit's agents separate, with their own bounds and sources, to protect independence.
What is the first finding auditors usually look for?
Held actions approved by someone without the authority to approve them. Our piece on why internal auditors are the real control explains why, and the guide to AI agent skills by role covers the other roles.