A compliance monitoring plan template sets out which obligations the second line will test over the coming period, how each test works, how often, on what sample, from which data, who reviews the findings, and, where an AI agent helps, which steps it performs. The template below fits on one page per area, with a filled sample.
What is the plan for?
Compliance monitoring checks that the business is meeting its obligations in practice, not just on paper. The plan is the agreed programme of those checks. It shows the board and regulators that testing is risk-based, covers the right areas, and runs to a schedule rather than when someone has time.
An AI agent can carry much of the testing workload: pulling samples, checking each item against criteria, drafting findings. That lets a small team test more often and on larger samples. It does not change who owns the conclusions. Monitoring is a second-line activity, and its findings must come from people independent of the first line; the guide AI compliance agents: second line, never the last word sets out why.
When should you write or refresh it?
Write it annually, approved by the compliance committee, and refresh it whenever risk changes: a new product, a regulatory change, an incident, a new AI agent in a customer-facing process. When an agent goes live under an AI agent deployment plan, add monitoring rows for the process it touches, and include checks that its rollback plan works.
How do you fill in each field?
- Area and obligation. What rule or policy requirement is being tested.
- Risk rating. Drives frequency and sample size.
- Test. What exactly is checked, written so it can be repeated.
- Frequency and sample. How often, how many items, how selected.
- Data source. Where the sample comes from, and its provenance.
- Agent role. Which steps the agent performs at what depth. Usually: pull sample (depth 1), test against criteria and draft findings (depth 2).
- Reviewer. The named second-line person who reviews the agent's work and concludes.
- Reporting. Where findings go and when.
The mechanics of having an agent run tests are in how to run compliance monitoring tests with an AI agent.
The compliance monitoring plan template
| Area | Obligation tested | Risk rating | Test | Frequency | Sample | Data source | Agent role and depth | Reviewer | Reported to |
|---|---|---|---|---|---|---|---|---|---|
Add a summary block above the table: plan period, plan owner, approval date, and the areas excluded with reasons.
A filled sample: a consumer lender's plan (extract)
| Area | Obligation tested | Risk | Test | Frequency | Sample | Agent role | Reviewer |
|---|---|---|---|---|---|---|---|
| Lending | Affordability assessed before every loan | High | Each file has verified income, essential spending and a stressed repayment check | Monthly | 60 approved loans, random | Pulls files; checks each item; drafts exceptions (depth 2) | Compliance monitoring manager |
| Collections | Contact within frequency caps | High | No customer contacted above the cap in any week | Monthly | All accounts in arrears | Counts contacts across channels; lists breaches (depth 2) | Compliance analyst |
| Complaints | Final responses within the deadline | Medium | Response date against deadline | Quarterly | 100 closed complaints | Calculates dates; lists late responses (depth 2) | Compliance analyst |
| Financial promotions | Promotions approved before use | Medium | Each live promotion has an approval record | Quarterly | All live promotions | Matches promotions to approvals (depth 2) | Compliance manager |
| AI agents | Agents act within certified depth | High | No action above effective depth; held items reach a named person | Monthly | Verdict record for each agent | Queries record; lists exceptions (depth 2) | Compliance manager, independent of agent owner |
The collections row shows the volume an agent makes possible. A person sampling 60 accounts might miss a breach. An agent checking every account in arrears finds all of them, and the analyst's time goes on deciding what each breach means.
The last row monitors the agents themselves. It uses the verdict record, which shows every action, its verdict and the bound that decided.
How should findings be reported?
The agent drafts a findings summary for each test: items tested, exceptions, and the evidence for each. The reviewer checks a sample of the agent's passes as well as all its exceptions, writes the conclusion and rates the finding. Whether an AI agent can prepare a compliance monitoring report covers what the agent may draft at the reporting stage. The final report and its ratings are the reviewer's.
Questions people ask
Should the reviewer re-check items the agent passed?
Yes, a sample of them. If the reviewer only sees exceptions, an agent that misses breaches would go unnoticed. Record the re-check and its result in the test file.
Can the agent decide which areas to test?
It can propose, for example by highlighting areas with rising complaints. The plan itself is a risk judgement approved by the compliance committee.
What if the first line uses the same agent?
Then the second line should not rely on it for monitoring that process. Use a separate agent, or separate certification and bounds, so monitoring stays independent.