In layers: what the agent was allowed to do, proof it was tested before it got that authority, a record of every action it took or was refused, and the named approval of everything it drafted. Each layer is owned by someone different and leaves its own evidence. Together they show the control operated, not just that it was designed.
Why doesn't the old evidence work any more?
Traditional control evidence is a signature on a piece of work: a reviewer's initials on a reconciliation, an approver's name on a journal. When an agent prepares the work, the reviewer's signature still matters, but it no longer covers everything. The agent also made choices: which documents to use, which items to match, which to flag. Those choices need their own evidence.
There is a second gap. People's authority is fixed by job role and changes rarely. An agent's authority can be changed in minutes. So the evidence has to show what the agent's limits were on each date, not just today.
What are the steps, and who owns each one?
- Define the scope. Process owner. Write down what the agent may do in this process, at what depth, up to what values, using which sources. Evidence: the approved scope document, versioned.
- Certify before granting authority. Process owner, with risk or internal audit. Test the agent on real past cases from your own operation and record the results. Evidence: the certification report and the owner's sign-off.
- Enforce limits at the system. IT or system owner. Configure the ledger, bank and other tools so the agent cannot exceed its limits even if instructed to. Evidence: access configuration and change log.
- Record every verdict. Automatic. Each action the agent takes, holds or is refused is filed with the reason and the sources used. Evidence: the append-only verdict record.
- Approve what the agent drafts. Named approvers. Each drafted item is approved by someone independent of the request. Evidence: approver identity and date on each item.
- Sample what the agent does alone. Reviewer. Re-perform a sample of depth 3 actions each period. Evidence: sample results with the reviewer's sign-off.
- Review and renew. Process owner. Recertify before the certificate lapses and after any material change. Evidence: renewal records and any depth changes.
What does this look like as a control map?
| Control objective | What the agent does | Evidence |
|---|---|---|
| Only authorised transactions are recorded | Drafts or posts within scope | Scope document, verdict record |
| Preparer and approver are separate | Prepares only | Approver identity on each item |
| Limits cannot be exceeded | Acts through enforced connections | System configuration, refusals in the record |
| Agent is competent for the task | Passed certification | Certification report, renewal dates |
| Errors are detected | Its work is sampled | Sample results |
| Changes to the agent are controlled | Brief and limits versioned | Change log with approvals |
An illustrative example
Take a lender's finance team that uses an agent to prepare financial statements mapping and to post routine journals. The internal audit team plans to test the journal control.
The process owner provides the scope: standard journals from approved templates, up to a set value, at depth 3; everything else drafted. The certification report shows the agent tested on the lender's own prior journals before it was given posting rights. The ledger's configuration shows the posting limit and that the agent's identity cannot approve. The verdict record lists every journal posted, held and refused in the quarter. Internal audit selects 25 posted journals and re-performs them, and selects 25 drafted journals and checks the approvals.
One finding emerges: a template was updated mid-quarter without the process owner's approval. The record shows exactly which journals used the new template, so the team can review just those. Internal audit could equally have used an agent to run some of these tests, within the limits set out in whether an AI agent can test compliance controls.
What about spreadsheets and side systems?
Many finance controls run partly in spreadsheets. If the agent works there, the same layers apply: version history, a record of what it changed, and approval of outputs. The approach is set out in how to let an AI agent work in your finance spreadsheets. US financial institutions also have safeguarding duties over customer information that affect how agents are given access, covered in GLBA safeguards and AI agent access controls. The wider finance controls are in AI agents for finance: books you can audit.
Questions people ask
Who should own the evidence?
The process owner owns the scope and certification. The system owner owns configuration. Approvers own their approvals. A central record that links all of them makes the audit much easier.
How long should the evidence be kept?
As long as your other financial records, under your retention policy. The verdict record should be kept in a form that cannot be altered.
Does an external standard help?
Frameworks such as ISO/IEC 42001 and the NIST AI Risk Management Framework give structure for AI governance generally. They do not replace evidence that each financial control operated.