How to build a reviewer rota for internal audit team

Internal audit's rota is not about clearing held actions; that is the first line's job. It assigns auditors to sample the record of agents' verdicts on a cycle set by risk, with depth 4 capabilities reviewed most often. Keep auditors away from areas where they work or approve, and escalate urgent findings the same day.

What is internal audit reviewing?

In a governed workspace every verdict is filed in an append-only record: what the agent did or proposed, which bound decided, who approved and why. Internal audit's job is to test whether that system of control works: whether bounds are set sensibly, approvals are made by qualified people, held actions are decided with reasons, and certificates are current. That means sampling the record regularly, not watching the queue.

The chief audit executive owns the rota. It sits within the audit plan but runs more often than a traditional annual audit, because agents' certificates lapse after 90 days and their bounds change through the year. For what auditors need to know first, see what internal audit needs to know about AI agents; for the full skills map, the guide to AI agent skills by role.

What are the steps?

1. Agent, depth 1: lists every agent and capability with its depth. And the approvers for each, with their credentials.
2. Person (chief audit executive): sets review frequency by risk. Depth 4 capabilities that move money or are hard to undo, monthly; depth 3, quarterly; depth 2 and below, as part of wider audits.
3. Person (chief audit executive): assigns auditors. Each review cycle has a named auditor and a reviewer of their work.
4. Person (audit manager): checks independence before assignment. No auditor reviews an area they worked in during the period under review, or where they hold approval rights.
5. Agent, depth 1: draws the sample. Random and targeted: random verdicts, plus every override, every exception and every approval by someone whose credential lapsed within the period.
6. Person (auditor): tests the sample. Was the bound right? Was the approver qualified on the day? Is the reason adequate? Is the provenance of key facts what the decision needed?
7. Person (auditor): raises findings. Urgent findings, such as approvals by unqualified people or a red-line action released, go to management the same day.
8. Person (chief audit executive): reports to the audit committee. Coverage, findings and their status.

How do you keep the rota independent?

Independence is internal audit's reason for existing. With agents it faces a new risk: auditors are often trained alongside the first line and may have been given approval rights during pilots. An auditor who approved held actions in the claims workspace cannot audit claims approvals for that period.

So the rota carries an independence check as a step, not an assumption. The audit manager checks each auditor's approval rights and recent roles before assignment, and the check is recorded. The approver authority matrix for the internal audit team should show that auditors hold no approval rights in areas they audit, or that any they hold are excluded from their assignments.

Which controls matter, and what evidence do they leave?

• Coverage by risk. Evidence: the frequency plan and the completed reviews against it.
• Independence checked. Evidence: a recorded check for each assignment.
• Samples drawn from the record, not from summaries. Evidence: sample lists with verdict references.
• Urgent findings escalated. Evidence: the time from discovery to management notification.
• Auditor work reviewed. Evidence: a second auditor's sign-off on each review.

What should be measured?

• Reviews completed on schedule, by depth.
• Findings by type: unqualified approvals, weak reasons, wrong bounds, stale certificates.
• Time from urgent finding to management response.
• Repeat findings in the same area.
• Assignments changed because of an independence conflict.

Where does it usually go wrong?

Annual cycles for monthly risks. An agent can be recertified, change depth and lapse several times between annual audits. Depth 4 capabilities need a shorter cycle.

Sampling only what the first line flags. A sample drawn from the first line's own exceptions list tests what they already know about. Draw from the record directly.

Auditors without the skills. Reading an agent's record is a skill; an auditor who cannot find the deciding bound will test the wrong thing. The AI agent competency matrix for the internal audit team sets the bar.

First-line rotas look very different; compare the rotas for the practice team and the claims team, whose records internal audit will sample.

Where the Academy fits

Auditors need to read the record as fluently as reviewers do. The Academy's Foundations track covers the decision chain and depth for anyone; the Operator track goes further into human review and reading the workspace. A public register lists certified people by name, credential and expiry, which gives auditors a way to test approvers' credentials at source.