Internal audit's approver authority matrix covers audit's own work when an AI agent helps: selecting samples, drafting workpapers, rating findings, releasing reports and validating that actions are closed. Each step has a named approver, a second reviewer where the conclusion matters, and a rule that auditors approve nothing in the first-line processes they audit.
What does internal audit approve?
Audit does not approve business transactions. It approves its own conclusions, and those conclusions carry weight with the audit committee and regulators. When an agent selects samples at depth 1 or drafts a workpaper at depth 2, the question is not whether the agent may act but whether audit's independence and evidence standards still hold.
Two risks drive the matrix. The first is that the agent shapes the conclusion: a sample selected by an agent may miss exactly the cases a human auditor would have chosen. The approver of a sample must understand how it was drawn. The second is independence: auditors who review held actions in a process they later audit are testing their own decisions. Many audit functions forbid it outright. The full background is in what internal audit needs to know about AI agents.
How do you fill it in?
- List each step in your audit methodology where an agent assists.
- Record the agent's part and depth. In audit, depth 3 is rare and depth 4 does not apply.
- Name the approver by audit grade, and the second reviewer for conclusions.
- State what the approver must check about the agent's contribution.
- Add the independence rule for the step.
- Record the certificate the approver must hold, if audit ties sign-off to certification.
The template
| Audit step | Agent's part and depth | Approver | Second reviewer | Check on the agent's work | Independence rule | Certificate |
|---|---|---|---|---|---|---|
| Planning and risk assessment | ||||||
| Sample selection | ||||||
| Data extraction from the agent record | ||||||
| Workpaper drafting | ||||||
| Finding rating | ||||||
| Draft report release | ||||||
| Final report release | ||||||
| Action closure validation |
A worked example
A hypothetical bank's internal audit function: associates, seniors, managers and a chief audit executive.
| Step | Agent's part | Approver | Second reviewer | Check on the agent's work | Independence rule | Certificate |
|---|---|---|---|---|---|---|
| Planning | Summarises prior findings (1) | Audit manager | Chief audit executive | Nothing material omitted | None | Foundations |
| Sample selection | Draws sample by stated criteria (1) | Senior | Manager | Criteria written before drawing | Auditor did not review the population | Builder |
| Data extraction | Pulls verdicts and approvals (1) | Senior | None | Completeness against record count | Read-only access | Foundations |
| Workpaper | Drafts from evidence (2) | Senior | Manager | Every statement traced to evidence | Author is not the approver | Operator |
| Finding rating | Proposes rating (2) | Manager | Chief audit executive | Rating rationale written by a person | None | Operator |
| Draft report | Assembles draft (2) | Manager | Chief audit executive | Tone and accuracy | Business sees draft before final | Operator |
| Final report | None | Chief audit executive | Audit committee chair informed | n/a | n/a | Architect |
| Action closure | Compares evidence to action (2) | Senior | Manager | Evidence is sealed or signed, not declared | Auditor did not design the fix | Operator |
Sample selection requires a Builder certificate. An auditor approving a sample the agent drew must understand how the agent applied the criteria, which sources it used, and what it might have excluded. Writing criteria before drawing stops the sample being shaped to fit an expected answer.
Action closure checks the provenance of evidence. When management says an issue is fixed, that statement is declared. The auditor approves closure only when the evidence is sealed, such as a configuration report from the system itself, or signed by a named owner.
The final report has no agent part. The chief audit executive signs it, and the audit committee chair is informed. Skills behind each approval are in the AI agent competency matrix for the internal audit team. Audit's own HR-related approvals, such as auditor rotation, follow the approver authority matrix for the HR team. Detailed rules are in the approver rule for the internal audit team.
Where the Academy fits
Pryme Intelligence Academy runs every lab in a free Build workspace, which lets auditors practise reconstruction and sample design without touching production. Foundations covers the shared vocabulary; seniors who approve samples can take the Builder track to understand how agents apply criteria.
Questions people ask
Can auditors use agents on confidential audits?
Yes, if the agent's access is read-only, scoped to the audit, and recorded. Audit should own its agent separately from first-line agents. The skills involved are mapped in AI agent skills by role.
Should audit approve first-line agents' depth increases?
No. That is a first-line and second-line decision. Audit tests later whether the increase was justified by evidence and approved correctly.
What if a finding concerns the agent itself?
Rate it like any other control finding. The agent's owner is the management respondent, and the action is usually a change to its bounds, sources or certification.