AI agent training for internal auditors in public sector in the UK

Giving assurance over AI agents in benefits administration, council tax queries and casework triage is now part of public sector internal audit in the UK. Auditors need training to test held actions, red lines, certificates and provenance from the record, and to rate agent findings consistently. UK GDPR, the ICO and equality duties frame the work.

What do internal auditors in UK public bodies spend time on?

Central government departments, arm's-length bodies, local authorities and health bodies all maintain internal audit functions that report to an audit committee and support the accounting officer or chief executive's governance statement. The head of internal audit gives an annual opinion on governance, risk management and control, under internal audit standards adapted for the public sector.

The plan in a local authority might cover council tax and business rates, housing benefit and council tax support, adult social care payments, procurement, and cyber security. A central department adds grant schemes and large programmes. Fraud and error are standing themes, and external auditors rely on internal audit's coverage of key controls.

Where do agents change the work?

Public bodies are introducing agents in high-volume, rules-based work. Each action needs its own depth.

• Council tax and benefit queries (depth 2). The agent drafts replies to residents citing their account and the relevant rules. A revenues officer sends.
• Casework triage (depth 1). It reads incoming cases, classifies urgency and routes them to the right team, without deciding outcomes.
• Discount and exemption checks (depth 1). It cross-checks single person discounts and exemptions against other records and flags anomalies for review.
• Supplier payment matching (depth 2). It matches invoices to orders and drafts payment for approval.

Audit's own agent, at depth 1, can test full populations from the append-only record, such as every discount removed in a quarter and who approved it.

What must auditors learn, and what stays with them?

Auditors need to understand held actions in depth. When an agent drafts a discount removal and holds it, a named officer must decide. Our guide on how internal auditors handle an action an AI agent has held shows how to trace it from the record: who received it, how long it waited, who approved and with what reasoning. Bulk approvals without evidence of review are a common finding.

Red lines follow. Decisions on entitlement, enforcement action against a resident, or anything affecting a vulnerable person should never sit with an agent. Our list of what internal auditors should never let an AI agent do helps translate those into tests.

Rating consistency matters because the head of internal audit's opinion depends on it. Calibration sessions for internal auditors on anonymised agent findings stop one auditor calling a lapsed certificate "limited assurance" while another calls it advisory.

Certificates complete the core. Depth is earned on the body's own cases through Attest, and certificates lapse after 90 days. An agent acting above depth 1 after its certificate lapsed is a control failure regardless of outcome.

What stays with auditors: the annual opinion, engagement conclusions, ratings and reports to the audit committee.

Which UK rules shape oversight and literacy?

The UK takes a principles-based, regulator-led approach to AI rather than a single AI law. For public bodies, UK GDPR and the Data Protection Act 2018 are central. Article 22 of UK GDPR restricts decisions based solely on automated processing with legal or similarly significant effects, which matters for benefits and enforcement. Article 35 requires a data protection impact assessment for high-risk processing, and Article 30 requires records of processing. The ICO regulates and has published guidance on AI and data protection.

Public bodies also have an equality duty to have due regard to eliminating discrimination and advancing equality of opportunity, which audit can test by asking how agent outputs were checked for unequal effects. Central government has a standard for publishing records of algorithmic tools used in decision-making, and auditors can test whether the body has considered it. Administrative law expects decisions to be lawful, rational and fair.

The FCA, PRA and PSR do not govern a council's internal audit. ISO/IEC 42001 and the NIST AI Risk Management Framework provide useful structure.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

A 90-day training plan for the audit team

Weeks 1 to 4. All auditors cover depth, the minimum chain, verdicts and the record. The head of internal audit adds agents to the audit universe and tells the audit committee how agent assurance will feed the annual opinion.

Weeks 5 to 9. Pilot an audit of discount and exemption checks. Test every held removal, approver authority, time to decision, certificate currency and the equality check.

Weeks 10 to 13. Run the first calibration, agree ratings for agent findings, write the standing programme, and set up banking corrections for audit's agent.

Where the Academy fits

Pryme Intelligence Academy's Foundations track gives every auditor a shared vocabulary, free. Auditors leading agent engagements can take the Operator track, which includes a practicum of real review decisions signed off by an assessor. A business can choose to tie approval rights to a current certificate, depth by depth, and auditors can test that practice against the public register.