How to run a two-week practicum for internal auditors

Attach the auditor to a live engagement on an agent-run process for ten working days and treat each test conclusion, workpaper and draft finding as a decision. An audit manager with a current certificate decides each one independently. The auditor passes with at least 95 decisions in every 100 right and no missed red line, such as accepting an audit agent's conclusion without re-performing any of it.

What is the practicum, and who owns it?

Internal auditors meet agents twice. They audit processes where agents act, reading certificates, verdicts and approvals in the record. And they use audit agents that sample records and draft workpapers and findings. The practicum tests both: can the auditor read an agent's record correctly, and can they judge an audit agent's draft?

The head of internal audit owns the practicum and names the audit manager who reviews. The auditor owns each decision and its reasoning. Management of the audited area is not involved beyond the engagement itself. Independence is a red line for this role, so nothing in the practicum should put the auditor in the position of approving a control they will later test.

How do you build the queue?

Audit decisions take time. Eight to twelve a day yields about 100 over the fortnight. Choose an engagement on an agent at depth 3 or 4, so the record contains held actions, refusals and approvals. Include:

• samples drawn by the audit agent, where the auditor confirms the sample is valid;
• test results on individual verdicts: was the action within the agent's certified depth and the organisation's limits on that day?
• approver checks: was the person who cleared each held action certified on the day of approval?
• refusals and withheld actions, where the auditor decides whether each is a control working or an exception;
• workpapers drafted by the audit agent, to accept or correct;
• draft findings, to rate and word.

Seed anonymised past items if the engagement is too clean. For example, a seeded test might show a held payment approved by someone whose certificate lapsed two days earlier, while the audit agent's workpaper marks the approval as compliant because it checked certificate status on the test date rather than the approval date. The auditor should catch the date error and raise an exception.

The steps

1. Person (head of internal audit): brief the auditor on the bar, red lines and log.
2. Agent, depth 1: draw samples from the record for the engagement.
3. Agent, depth 1: run tests and present results with the evidence behind each.
4. Agent, depth 2: draft workpapers and findings.
5. Person (auditor): decide on each item and re-perform a stated share of the agent's tests.
6. Person (audit manager): decide independently, then compare.
7. Agent, depth 1: log both decisions, the match and any red-line flag.
8. Person (audit manager, then assessor): review the log at the end.

How do you set and apply the bar?

A decision is correct if it matches the audit manager's or the manager agrees it was sound. A finding rated one level differently can be correct if the reasoning holds; a finding with no evidence behind it cannot.

The red lines: accepting an audit agent's conclusions without re-performing any of them; rating a finding without evidence; treating refusals or withheld actions as failures by default; sharing draft findings beyond the agreed distribution; taking any step that would compromise independence. One miss fails the practicum.

Write the rating scale down before day one. If the function rates findings as high, medium and low, give the auditor the definitions and two past examples of each, so that disagreements at the debrief are about evidence rather than vocabulary.

Which controls matter, and what evidence do they leave?

• Re-performance. Evidence: the share of agent tests the auditor redid, and the results.
• Independent manager decisions. Evidence: logged before comparison.
• Date discipline. Evidence: certificate status checked as at each approval date.
• Daily debrief. Evidence: a line per mismatch.
• Full log. Evidence: the practicum log template for internal auditors.

Pryme Intelligence Academy's Certified Pryme Operator practicum applies the same bar, signed off by a Pryme assessor, and gives auditors a certificate their own audit committee can check at source.

What should you measure?

Correct decisions out of the total, by type. Red-line misses (zero). Errors in the audit agent's work that the auditor caught, compared with those the manager caught. And exceptions correctly classified as controls working rather than failures.

Where does it usually go wrong?

The engagement chosen is on a depth 1 or 2 agent, so there are no held actions or approvals to test. Pick a deeper one.

The auditor accepts the audit agent's workpapers because they are complete and tidy. Completeness is not correctness. Re-performance is non-negotiable.

Refusals are logged as exceptions. A refusal is usually the control working; the auditor must say why each one is or is not a concern.

Whether auditors need a certificate to approve audit-agent outputs is the function's choice; see do internal auditors need a certificate to approve AI agent actions, and on responsibility, are internal auditors accountable for an AI agent's mistakes. Other roles use the same structure; compare running a practicum for paralegals and the guide to AI literacy and certification for people who work with agents.