AI agent training for internal auditors in insurance in the US

US insurers' internal auditors need training to test the AI agents now handling claims intake, underwriting referrals and policyholder correspondence. That means testing verdicts and approvals from the record, certificate currency and source provenance, and mapping each use to state expectations. Audit opinion and ratings stay with them. State regulators, the NAIC, NYDFS, HIPAA and GLBA frame oversight.

What does internal audit cover at a US insurer?

The plan reflects a state-by-state business. A multistate carrier files rates and forms in each state, handles market conduct examinations from different departments of insurance, and has to show consistent claims practices wherever it writes. Auditors test claims handling against unfair claims practice standards, underwriting against filed rules, producer licensing and commissions, and premium accounting.

Larger insurers maintain an internal audit function that reports to the audit committee, in line with expectations coordinated through the NAIC. Health and supplemental lines bring HIPAA testing; all lines bring GLBA privacy and safeguards; insurers licensed in New York also face NYDFS's cybersecurity requirements. Third-party administrators and managing general agents extend the audit perimeter beyond the carrier's own staff.

What changes when agents arrive?

Agents land in the busiest workflows, and each is a new audit object with its own certified depth.

• First notice of loss intake (depth 3 within limits). The agent opens the claim, sets up the file and requests standard documents.
• Underwriting referral notes (depth 2). It reads the application, loss runs and inspection reports and drafts a referral for the underwriter, citing the filed guideline.
• Adverse action and denial letters (depth 2). It drafts the letter with the reasons. A person approves and sends.
• Subrogation identification (depth 1). It flags claims where another party may be liable.

For audit's own work, an agent at depth 1 can test full populations from the append-only record, such as every denial letter in a quarter against the approver list, and at depth 2 can draft workpapers.

What must auditors learn, and what stays with them?

The single most useful skill is reconstructing a decision from the record. Every verdict is filed with the bound that decided it: role scope, certificate, sources, the insurer's limits or the platform guardrails. In a market conduct exam, examiners may ask why a particular claim was denied. Audit should be able to show the agent's draft, the sources it relied on with their provenance, who approved it and when. Our guide on how internal auditors review an AI agent's decisions turns that into test steps.

Next, state variation. A denial letter that meets one state's requirements may not meet another's. Auditors should test that the agent's sources include the right state rules and that letters are held for a person where the insurer's limits require it.

Certification is the third. Depth is earned through Attest on the insurer's own past claims, the lower of plan ceiling and evidence wins, and certificates lapse after 90 days. A lapsed certificate means the agent should have been acting at depth 1. Auditors must test the dates.

What stays with the auditor: audit scope, opinion, ratings and the conversation with the audit committee. Our piece on whether AI agents will replace internal auditors explains why judgement and independence remain human.

Which US rules shape oversight and literacy?

There is no single federal AI law. Insurance is regulated by the states, with the NAIC coordinating. The NAIC has developed a model approach to insurers' use of AI, taken up by many states, which expects a written programme covering governance, risk management, internal controls and oversight of third-party systems. Auditors should test the insurer's programme against the version adopted in each state where it writes.

NYDFS applies its cybersecurity requirements to licensed insurers in New York, which reach the systems agents connect to. Colorado has passed an AI act aimed at high-risk systems that make consequential decisions, which can include insurance. HIPAA governs protected health information for health plans, and GLBA governs the privacy and security of customers' financial information. State privacy laws, such as California's CCPA as amended by the CPRA, may also apply.

The NIST AI Risk Management Framework, voluntary, gives a useful structure for the audit programme, and SOC 2 reports help when assessing an agent provider's controls.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

A 90-day training plan for audit

Days 1 to 30: shared literacy. Every auditor learns depth, the minimum chain, verdicts and the record. The chief audit executive lists each agent deployment, its certified capabilities and the states where its output is used.

Days 31 to 60: pilot audit. Audit denial letter drafting. Test every denial in the period for approver authority, certificate currency, source provenance and state-specific content. Use an audit agent at depth 1 for the full-population tests.

Days 61 to 90: programme. Write the standing agent audit programme mapped to state AI expectations, agree finding ratings, and set up banking corrections for audit's agent. Record training in our training plan template for internal auditors.

Where the Academy fits

Pryme Intelligence Academy's Foundations track gives every auditor the vocabulary free. Auditors leading agent audits can take the Operator track: a written exam passed at 32 of 40 questions in 60 minutes, then a two-week practicum. Certificates are issued through VerifyDoc.ai and can be checked by number or QR code, which helps when examiners ask about reviewer competence.