Start from the agent's filed record of decisions, not from its outputs. Pick a period, sample verdicts across allowed, held and refused, trace each one to the inputs, sources and bounds that applied, and check the target systems show the same change. Then test the controls themselves: were the limits right, were approvals real, and did anything happen outside the record?
What should the auditor ask for first?
Three things, before any sampling.
The agent's authority as it stood in the period. Its role scope, capabilities, depth, the limits in force and its certificate dates. Authority changes over time, so the auditor needs the versions, not today's settings.
The full population of verdicts. Every action the agent attempted, not just those that succeeded. Refused and held items show whether the bounds worked.
The systems it touched. A list of every system where the agent could read or write, with each system's own logs for the agent's identity.
Our guide on preparing AI agents for an audit covers how to have these ready.
What are the audit steps?
- Auditor: reconciles the populations. Count agent actions in the agent's record and in each target system's log for the agent's identity. They should agree. A change in the system with no matching verdict is the most serious finding. Evidence: the reconciliation.
- Auditor: samples across verdict types. Include allowed, held, refused and, where they exist, withheld verdicts. Weight towards higher-value and higher-depth actions. Evidence: the sample list and how it was drawn.
- Auditor: traces each item. For each, confirm the request, the inputs and their provenance, the bounds checked and the deciding bound. Evidence: a trace sheet per item.
- Auditor: re-performs a subset. Using the recorded inputs and the limits in force, would the verdict be the same? Evidence: the re-performance result.
- Auditor: tests the approvals. For held items, who approved, what did they see, and how long did they take? Patterns of very fast approvals deserve a look. Evidence: approval timings and reviewer notes.
- Auditor: tests the bounds. Were the limits set by the right person through change control? Did any change take effect without approval? Evidence: the change log.
- Process owner: responds. Findings go to the agent's owner, who answers for them as for any process. Evidence: the management response.
What does a good audit trail need to contain?
An audit trail for an agent is more than a log of outputs. It needs the request, the inputs with provenance, the versions of sources and brief, the tool calls, the proposed action, every bound checked, the verdict and the approver. If any of those are missing, the auditor can confirm what happened but not whether it was allowed.
A worked example
Take an internal audit of a lender's collections agent over one quarter. The record shows 9,000 verdicts. The collections system's log shows 9,012 changes by the agent's identity.
The twelve extra changes are traced to a batch script that ran under the agent's credentials during a migration, outside the platform. Nothing in them was harmful, but none were checked against the agent's bounds. That is the headline finding. The sample of 60 verdicts traces cleanly. Approvals on held items average a few seconds each on Friday afternoons, which becomes a second finding about review quality.
What about actions that need undoing?
If the audit finds actions that should not have happened, someone must decide whether and how to reverse them. Some actions undo cleanly; others need a compensating step. Our answer on whether you can undo what an AI agent did covers the difference.
Who should own the audit view?
Internal audit, independently of the team that runs the agent. Auditors should have their own read access to the record, so they are not relying on extracts prepared by the people they are auditing. We make the case in internal audit needs its own view of agent decisions, and our guide on briefing internal audit on how AI agents are governed covers the first conversation.
The topic guide, agent governance is a bound, not a model, explains why the record of verdicts is what makes audit possible.
Questions people ask
Can an agent help audit another agent?
It can assemble traces, reconcile populations and flag patterns. The judgement about whether controls worked, and the audit opinion, stay with the auditor.
How big should the sample be?
Use your normal audit sampling approach for a control of that frequency and risk. Agents act often, so the population is large; weight the sample towards the highest-impact actions.
What if the record has gaps?
Report it as a finding. A gap in the record means the auditor cannot show what was allowed, which is a control failure in its own right.