AI agent training for internal auditors in public sector in Ireland

Auditing AI agents in Irish public bodies means testing their use in grant schemes, records requests and procurement checks. Auditors need training to read the decision record, confirm held actions went to authorised officers, and check certificates and provenance. Conclusions stay with the auditor. GDPR, the Data Protection Commission, NIS2 and the EU AI Act set the frame.

What do internal auditors in Irish public bodies spend time on?

Most work for an audit and risk committee in a department, agency, local authority or commercial State body. The plan usually covers grant and scheme payments, where eligibility and inspection must be evidenced; procurement, where thresholds and competition rules must be followed; payroll and pensions; ICT and cyber security; and governance under the code that applies to State bodies. Auditors also give assurance that public money was spent for the purpose it was voted.

Their work feeds the accounting officer's statement on internal control, and the State's external auditor may rely on it. That raises the bar on evidence: a finding must be traceable to documents another auditor could inspect.

What changes when agents arrive?

Public bodies are introducing agents in processes with high volume and clear rules. For each, audit needs to know the certified depth.

• Scheme application checks (depth 1). The agent compares an application against scheme terms and the body's own records, then lists discrepancies for an officer.
• Records request searches (depth 2). It finds relevant records and drafts the schedule. An officer decides what is released.
• Procurement compliance checks (depth 1). It reviews a contract file against the body's thresholds and procedures and flags gaps.
• Inspection scheduling (depth 3). Within limits the body sets, it schedules field inspections and notifies applicants.

Audit can also use an agent of its own, at depth 1, to test full populations from the append-only record, for example every scheme payment in a year against inspection outcomes.

What must auditors learn, and what stays with them?

Begin with the basics in our guide to what internal auditors should learn before working with AI agents: depth, the five bounds of the minimum chain, the four verdicts and the record.

Next, red lines. Some actions should never be allowed to an agent in a public body: approving a grant, refusing an application, or releasing records. Our list of what internal auditors should never let an AI agent do helps auditors turn those into tests. An auditor should be able to show from the record that every such action was refused for the agent or held for a named officer, and that no officer approved held actions outside their delegation.

Then consistency. Audit teams in the public sector are often small and drawn from different backgrounds. Running calibration sessions for internal auditors on anonymised agent findings makes sure the team rates a missed approval or a lapsed certificate the same way.

Certification is the last core skill. Agent certificates lapse after 90 days, and depth is earned on the body's own past cases. An agent acting at depth 3 on a lapsed certificate is a finding even if every action looked right.

What stays with the auditor: the plan, conclusions, ratings, and the report to the audit and risk committee. Pryme Intelligence Academy's Foundations track gives the shared vocabulary, free, for teams starting out.

Which rules in Ireland shape oversight and literacy?

GDPR applies to every public body. Article 5 principles govern what an agent may read; Article 22 restricts decisions based solely on automated processing with significant effects, which matters for scheme decisions; Article 30 requires records of processing; and Article 35 requires impact assessments for high-risk processing. The Data Protection Commission supervises.

The EU AI Act requires AI literacy among staff operating AI systems under Article 4. For high-risk uses, Article 26 deployer duties apply, and public bodies must carry out a fundamental rights impact assessment under Article 27. Some public uses, including decisions on access to public benefits, are high-risk under the Act. NIS2 applies cybersecurity risk management and incident reporting to essential and important entities, which includes many public administration bodies, and reaches the systems agents connect to.

Public bodies also carry transparency and fairness duties, and freedom of information law means the record of an agent's verdicts may be requested. The Central Bank of Ireland is not relevant unless the body is a financial entity.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

What does a 90-day plan look like?

Weeks 1 to 4. The audit team covers the basics and adds each agent to the audit universe, with its capabilities, depth and certificate dates. The head of audit briefs the audit and risk committee on what agent audits will involve.

Weeks 5 to 9. A pilot engagement on scheme application checks tests that every approval and refusal was made by an officer, that the agent stayed at depth 1, that certificates were current, and that the body completed its impact assessments.

Weeks 10 to 13. Hold the first calibration session, agree the rating scale for agent findings, and write a standing audit programme. Set up banking corrections for audit's own agent.