Auditors start from decisions, not from training records. They sample actions an agent prepared and a person approved, then check three things for each: whether the reviewer held a current, valid certificate on that date, whether their approval rights covered that action's depth and amount, and whether the review was real. Training completion figures come last, if at all.
Why do auditors start from decisions?
A training report tells an auditor how many people completed a course. It does not tell them whether the person who approved a specific payment, claim or credit decision was competent to do so. Auditors are interested in the second question, because that is where risk sits.
Starting from decisions also tests the controls between training and action. If certificates lapse but rights do not, or if someone is given approval rights without a certificate, a decision-first sample will catch it. A training-first review will not. The piece on why your auditors will sample the reviewers, not just the agents makes the wider case.
What are the steps?
- Define the population. All held actions approved by a person in the period, by agent capability and depth.
- Sample. Weighted towards higher depth and higher value, plus a random element.
- Pull the record for each. The agent's proposal, the verdict, which bound held it, the approver, the time and any changes.
- Check the certificate at the time. Look up the approver's certificate at the issuer and confirm it was current on the decision date, not just today.
- Check rights at the time. Confirm the approver's rights history showed the right to approve that action at that depth and amount on that date.
- Test the review. Did the approver change anything, add a reason or check a source? Compare approval times with the complexity of the case.
- Re-perform a subset. An independent reviewer judges whether the approval was correct.
- Trace back to training. For any exceptions, look at what the approver was trained and tested on.
What do auditors look for in each check?
| Check | A pass looks like | A finding looks like |
|---|---|---|
| Certificate at the time | Current on the decision date, verified at source | Lapsed, revoked or only a PDF on file |
| Rights at the time | Rights granted after certification, removed on lapse | Rights granted manually or left after lapse |
| Quality of review | Edits, reasons or source checks where the case warranted | Identical approvals in seconds across complex cases |
| Re-performance | Independent reviewer agrees | Approval of an action the policy should have stopped |
| Training content | Covers this capability and its failure modes | Generic awareness only |
An auditor will also ask how the certificate was earned. A certificate backed by a written exam and supervised practice on real decisions is stronger evidence than one awarded for attendance; see what an AI agent exam should test.
An example from an internal audit
An internal audit team reviews a payments operation over six months. It samples 50 released payments that the agent had held. For 47, the approver's certificate was current and verified at source, rights matched, and the records show call-backs on beneficiary changes.
Three were approved in under ten seconds each by the same approver, on payments where the agent had flagged a beneficiary change. The approver was certified. The audit re-performs them: two were legitimate, one was fraudulent and later recalled. The finding is about quality of review, not qualification, and the recommendation is a monitored review rate and a refresher, logged against the approver. The audit also asks whether the practicum had included beneficiary changes, which it had.
What else do auditors examine?
- The register. Is there one, who owns it, and does it match the people actually approving?
- Who audits the auditors' own use. Internal auditors may use agents themselves; the question of whether internal auditors are accountable for an agent's mistakes applies to their own work, and the practicum log template for internal auditors applies to them too.
- Automated decisions. Where GDPR Article 22 applies to decisions with legal or similarly significant effects, auditors check that human review was meaningful; see GDPR Article 22 and training reviewers in payments.
The guide to AI literacy and certification explains how certification and literacy fit together.
Where the Academy fits
Pryme Intelligence Academy certificates are issued through VerifyDoc.ai and can be checked at source by number or QR code; a lapsed or revoked certificate shows as such on the same page. The Operator practicum requires two weeks of real review decisions signed off by a Pryme assessor, which gives an auditor something concrete to trace back to.
Questions people ask
Can auditors rely on the HR training system?
As a starting point. They should verify certificates at the issuer and check rights history in the workspace, because HR records may lag behind both.
How large should the sample be?
That is the auditor's judgement, based on volume, risk and past findings. Weight it towards high-depth actions.
What if the record does not show who approved?
That is a serious finding on its own. Without a named approver, no qualification can be tested.