Auditors want to see that the people who oversee agents were competent at the moment they acted. Prepare evidence that links each approval in the record to a named person, a certificate that was current that day, the briefing for the agent's cycle, and the policy that set the requirement. Keep it continuously, not in the week before fieldwork.
What is training evidence for an AI audit, and who owns it?
Training evidence is the set of records showing that the people who use, review and approve agents' work had the knowledge and skill their role required, when they needed it. An auditor will rarely ask "did you train people?". They will ask "who approved this held payment, and how do you know they were competent to?".
That question touches several owners. Learning and development owns course records and certificates. Operations owns approval rights and the review rota. Compliance or risk owns the policy that says which roles need which training. Builders own each agent's certification. One person, usually in compliance, should own the evidence pack itself and keep it current.
The pack differs from proof that agents are fit, covered in how to prepare AI agents for an audit. Here the subject is people. Both meet in the record, where each verdict shows the agent's certificate and each approval shows the person.
The steps
- Person (compliance): write the requirement. A short policy stating which roles need which training and certificate for which depth of approval, and how often.
- Agent, depth 1: map roles to approvals. An agent reads the workspace and lists every person with approval rights, by agent, capability and depth.
- Person (learning and development): attach evidence to each person. Certificates with numbers, test results with paper versions, practicum logs, briefing attendance.
- Agent, depth 1: check certificate status at source for each person and record the date and result.
- Agent, depth 1: sample the record. Pull a sample of approvals and, for each, the approver's certificate status on the day of the approval.
- Person (compliance): review exceptions. Any approval by someone without a current certificate is explained and remediated.
- Agent, depth 2: draft the evidence pack, using a fixed structure such as the training evidence pack template for AI audits.
- Person (compliance): sign the pack and set the next refresh, at least every 90 days to match agent cycles.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Requirement | Nothing | none | Writing the policy |
| Role mapping | Lists approvers by agent, capability and depth | 1 | Confirming completeness |
| Attach evidence | Nothing | none | Gathering records |
| Status check | Checks certificates at source | 1 | Reading exceptions |
| Record sample | Matches approvals to certificate status | 1 | Choosing the sample |
| Pack | Drafts in a fixed structure | 2 | Review and signature |
What records will auditors ask for?
The requirement. A policy that ties approval rights to training, depth by depth.
The population. Everyone who approved anything, with the depth they approved at. A skills audit is a good way to build and check this list.
Evidence per person. Certificates verifiable at source, not PDFs. Test results tied to a paper version and pass mark, such as 32 of 40 questions. Practicum logs showing real decisions reviewed. What counts is set out in what evidence of competence is.
Currency. People's professional certificates last 12 or 24 months; agents' certificates lapse after 90 days. Auditors will check both on the date of a sampled decision.
Cycle briefings. For each agent recertification, the change note and who was briefed. A depth change without a briefing is a gap.
Exceptions and remediation. Lapses, how they were handled and what was re-reviewed.
Frameworks shape the questions. The EU AI Act's Article 4 expects providers and deployers to ensure sufficient AI literacy among staff, and Article 14 covers human oversight. A SOC 2 report covers controls including security and processing integrity, and SOC 2 and evidence of training for teams running AI agents covers that angle. ISO/IEC 42001 sets out an AI management system with competence requirements.
Which controls make the evidence reliable?
- Approval rights enforced by the workspace. Evidence: approver lists that match certificate status.
- Status checked at source. Evidence: dated check results per person.
- Append-only record. Evidence: approvals that cannot be edited after the fact.
- Cycle briefings logged. Evidence: change notes and attendance per agent cycle.
- Quarterly signed pack. Evidence: the pack, with the signer and date.
What should you measure?
The number of approvals in the sample made by someone without a current certificate, which should be zero. The time from an agent's depth change to the team's briefing. The number of certificates due to lapse in the next 30 days without a booked renewal. And the age of the oldest unresolved exception.
Where does it usually go wrong?
Evidence is assembled for the audit. Records are found, dates do not line up, and the pack shows effort rather than control.
Completion is mistaken for competence. A list of people who finished a course says nothing about whether they could judge a held action. Scenario tests and practicum logs do.
PDF certificates are accepted at face value. A PDF cannot show whether a certificate was later revoked. Check at source.
Where the Academy fits
Pryme Intelligence Academy certificates are issued through VerifyDoc.ai and can be checked by anyone at source, by number or QR code; a lapsed or revoked certificate shows as such on the same page. For teams, the admin view shows progress, results, certificates and expiry dates in one place, which covers most of steps 3 and 4. More in the guide to AI literacy and certification for people who work with agents.
Questions people ask
How far back should training evidence go?
As far back as the decisions an auditor may sample, which is usually the audit period. Keep the records for as long as the agent's record itself.
Do auditors need to see training content?
Sometimes. Keep the syllabus and the version of each test, so you can show what a person was assessed on.
What if someone approved without a current certificate?
Record it, re-review their approvals from the gap, fix the cause and show the remediation. An honest exception with a fix is better evidence than a clean pack nobody believes.