How to run an AI agent incident drill for the accounts payable team

Run it as a 90-minute tabletop exercise around one realistic scenario: a supplier's bank details change by email and the invoice agent queues payments to the new account. The accounts payable team practises four moves in order: pause the agent to draft-only, escalate to a named owner, record each decision, and report inside and outside the business.

What is the drill for, and who owns it?

An incident drill is a rehearsal of what people do when an agent's behaviour goes wrong. For accounts payable, the stakes are direct: money leaves the business, and once a payment settles it can be very hard to recover.

In a typical AP workspace, an agent matches invoices to purchase orders and goods receipts at depth 3 within bounds, and drafts the payment run at depth 2 or queues it at depth 4 for a person to release. The drill tests whether clerks, the AP supervisor and the financial controller act fast and in the right order when that chain is compromised.

The financial controller owns the drill. The AP supervisor runs it as facilitator. Clerks, a treasury contact and someone from IT take part.

The scenario

Monday, 10:00. A supplier's letter, received as a PDF by email, gives new bank details. The invoice agent reads it as external, so it cannot authorise anything on its own, but the vendor master was updated manually by a temporary clerk on Friday. Over the weekend the agent matched four invoices from that supplier, totalling 40,000, and queued them in Wednesday's payment run. One clerk notices the new account is at a bank in a different country.

The drill, step by step

1. Person (facilitator): reads the scenario and starts the clock. Nobody may look at a script.
2. Person (clerk): raises the alert. The test is whether they know whom to tell and how, within minutes.
3. Person (AP supervisor): pauses the agent to draft-only. They tighten the business's own limits so every payment and match is held. The agent drops to depth 2: it still drafts, but nothing moves without a person. The verdicts now name the business's own limits as the deciding bound.
4. Person (AP supervisor): escalates to the financial controller and treasury. Treasury confirms whether any payment from that run has already been released.
5. Agent, depth 1: lists every invoice from the supplier since the vendor master changed. Reading the record, not acting on it. The team checks each one.
6. Person (financial controller): decides on containment. Remove the four invoices from the run, revert the vendor master, call the supplier on a number from the original contract, not from the email.
7. Person (AP supervisor): records each decision and its owner. The record already holds the agent's verdicts; the people's decisions must sit alongside them.
8. Person (financial controller): decides on reporting. Internally to the finance director and audit. Externally, to the bank and possibly the police if fraud is suspected. If personal data was exposed, data protection rules may apply.
9. Person (facilitator): runs the debrief. What would have happened if nobody noticed?

Which controls does the drill test, and what evidence should each leave?

Provenance. The emailed letter was external and could not authorise a payment. The drill checks the team understands why, and why a manual vendor master change bypassed that protection. Evidence: the vendor master change log and the name of the person who made it.

The pause. Evidence: the limit change in the record, with the supervisor's name and time.

Release by a named person. Evidence: the payment run shows which items were held and who removed them.

Segregation. A temporary clerk should not change bank details alone. Evidence: the approval rule on vendor master changes, or its absence.

What should the financial controller measure?

• Minutes from the clerk's alert to the pause.
• Minutes from the pause to treasury confirming the status of the run.
• Whether every affected invoice was found from the record.
• Whether each decision has a named owner and time.

Where do AP drills usually go wrong?

Nobody knows who can pause. If only one person can tighten limits and they are on leave, the drill exposes it. Name a deputy.

The supplier is called on the fraudster's number. Under pressure, clerks use the contact details in the suspicious email. The drill should rehearse finding the contract number.

Recording left to the end. Memory fades within hours. Record each decision as it is made.

Compare drills for teams with similar risks: the compliance team drill and the collections team drill. New AP reviewers should cover this in their induction using the reviewer onboarding checklist for an accounts payable team. The full approach is in training teams for AI agents.

Where the Academy fits

Pryme Intelligence Academy's Operator track includes a module on when something goes wrong, covering the pause, escalation and record that this drill rehearses. Certified Pryme Operator's practicum requires no missed red line across two weeks of real review decisions, and a changed bank detail is exactly the kind of red line an AP reviewer must not miss.