Six to eight weeks, with one twist. Internal auditors need about 18 hours of learning and a period of real review practice, but they should not get that practice in a function they audit. Arranging a queue outside their audit scope, and learning to test the record rather than approve actions, is what takes the extra time.
Why auditors supervise differently
Internal auditors do not sit in the operational line. They test whether controls work, and they need to stay independent of the decisions they test. An auditor who spends two weeks approving an accounts payable agent's held payments has just become part of the control they will later audit.
Their supervision of agents is different in kind. They read the append-only record, reconstruct decisions, check that held actions reached the right named people, confirm that certificates were current when each action was taken, and test whether the business's own limits match its policies. That is supervision through evidence, not through the queue.
The closest comparison is paralegals, who also work from documents and records rather than live queues; see how long it takes to train paralegals.
How to plan the six to eight weeks
- Weeks 1 to 2: foundations. About four hours on governance, the decision chain, depth and certification, and what the business pays for.
- Weeks 1 to 5: operator learning. About 14 hours, with most attention on reading the workspace, how a governed agent decides and when something goes wrong.
- Weeks 4 to 6: review practice outside audit scope. Two weeks of real review decisions in a function the auditor will not audit in the coming cycle, or in a sandbox replay of real cases if no such queue exists.
- Weeks 5 to 7: record testing. The auditor reconstructs a sample of decisions from the record in the area they do audit.
- Week 7 or 8: exam and sign-off.
What the auditor needs to be able to test
| Control | What the auditor checks in the record |
|---|---|
| Depth | Each action was taken at a depth the agent had earned |
| Certificate | The agent's certificate was current; any lapse dropped it to depth 1 the same day |
| The deciding bound | Verdicts name the bound that decided, and held items went to named people |
| Sources | Decisive facts came from sealed or signed sources where policy requires |
| Withheld actions | Actions blocked at the platform floor were never worked around outside the system |
| Reviewer readiness | People who approved held items were trained and, where required, certified |
The last row is often missed. If a business makes approval rights depend on a current certificate, depth by depth, the auditor should test that approvers held one on the date they approved.
An example from a financial services group
Take an internal audit team of six at an insurer that runs agents in claims and customer service. Two auditors complete Foundations and Operator learning over five weeks. For their review practice, they spend two weeks in the customer service queue, because the coming audit plan covers claims.
In weeks five to seven, they reconstruct forty claims decisions from the record. They find three claim payments approved by a handler whose certificate had lapsed the week before, under a policy that required it. The control existed on paper; the system had not enforced it. That finding goes in the audit report, and the auditors sit the exam in week eight.
Calibration among auditors on the same reconstructed cases is described in calibration sessions for internal auditors. Caseworkers, by contrast, train inside their own queue; see the caseworker timeline.
What auditors should not do
- Approve held actions in a function they audit.
- Edit the agent's limits, sources or brief.
- Rely on dashboards without reconstructing at least a sample from the record.
The wider sequence for training around agents is in training teams for AI agents.
Questions people ask
Do auditors need certification to audit agents?
Not necessarily. They need the knowledge. Some audit functions choose certification so their own competence is checkable, which helps when audit findings are challenged.
Can an auditor practise on historic cases instead?
Yes, if no queue outside their scope exists. Replaying real historic cases in a sandbox gives realistic practice without breaking independence.
How often should auditors refresh this training?
Before each audit of an agent-run process, at least a short refresh on any change to depth, sources or limits since the last audit.