How to set an approver rule for the internal audit team

Internal audit's approver rule governs its own agents only. Auditors approve agent-drafted workpapers and evidence requests; the audit manager approves findings; the head of internal audit issues reports. Just as important is what the rule forbids: auditors never approve held actions for the business's operational agents, because that would make them part of the control they are meant to test.

What does an internal audit approver rule cover, and who owns it?

Audit teams use agents to plan fieldwork, request evidence, sample transactions, test controls against the verdict record of other agents, and draft workpapers and reports. That work should speed up audits without weakening the review chain that makes audit opinions credible. Our piece on what internal audit needs to know about AI agents covers the wider picture.

The head of internal audit owns the rule. The audit committee is told of it. The agent owner, ideally inside the audit function, configures it. Our guide to AI agent skills by role sets out the skills behind each approval.

What are the steps?

1. Head of internal audit: lists the agent's actions by depth. Depth 1: reads policies, prior reports, evidence and the verdict records of agents under audit. Depth 2: drafts workpapers, test results, findings and reports. Depth 3: sends evidence requests, schedules walk-throughs, selects samples by a set method. Depth 4: issues a final report or closes a finding.
2. Head of internal audit: assigns workpaper review to the auditor responsible for the area, then to the audit manager as reviewer.
3. Head of internal audit: assigns findings to the audit manager, after the auditee has seen the draft.
4. Head of internal audit: keeps report issue and finding closure with themselves or a named deputy.
5. Head of internal audit: writes the independence line. No auditor approves operational agent actions. If someone moves into audit from a team they will audit, they wait before auditing it.
6. Head of internal audit: ties each role to a current certificate. Agent owner configures and files.

How does audit test other teams' approver rules without becoming part of them?

Auditing agent deployments is new work for most audit teams. The agent can read another team's verdict record and compare each approval with that team's approver rule: was the approver named in the matrix, was their certificate current that day, did two people approve where two were required. That turns a sampling exercise into a full-population test, with the auditor reviewing exceptions.

What the audit agent must not do is act in the other team's workspace. It reads; it never approves, releases or changes another agent's bounds. The same applies to auditors. An auditor who approves a held payment "to help out" during a busy month has just become part of the payment control, and cannot audit it.

Evidence provided by auditees is declared until checked against a sealed or signed source. The agent should mark it that way in the workpaper, so the reviewer can see what was verified.

Which controls make the rule work, and what evidence do they leave?

Three-level review. Evidence: auditor, manager and head of audit approvals on each report in the verdict record.

Independence line enforced. Auditors have no approval rights in operational workspaces. Evidence: the access list, compared with the approver authority matrix for the internal audit team.

Read-only access to audited agents. Evidence: the audit agent's scope, and refused verdicts if it ever attempts a write.

Provenance in workpapers. Evidence: each evidence item marked sealed, signed, declared or external.

Rights lapse with certificates. Evidence: certificate status on each approval date.

What should you measure?

• Findings challenged by auditees and upheld, traced to the agent's draft or the auditor's judgement.
• Days from fieldwork end to report issue.
• Exceptions found in full-population tests of other teams' approver rules.
• Auditors holding operational approval rights. The target is none.
• Coverage of audit skills for agent deployments, using the competency matrix for the internal audit team.

Where does it usually go wrong?

Agent-drafted findings read like conclusions. A confident draft can pre-empt the manager's judgement. Managers should test each finding against the evidence, not edit the prose.

Audit trusts the record it is testing. The verdict record is append-only, but audit should still check that it is complete, for example by reconciling payments in the ledger to verdicts in the record.

Certificates are checked from a list, not at source. Audit tests whether approvers held current certificates using a spreadsheet the business keeps. Check a sample at source instead, by number, on the date of each approval.

Auditors borrow approval models from the business. Compare the approver rule for the practice team and the approver rule for the collections team: both deal with acting on customers and patients, which audit should never do.

Where the Academy fits

Pryme Intelligence Academy's Foundations track explains the decision chain, depth and certification, which every auditor of agent deployments needs. Auditors who test approver rules in detail benefit from the Operator track. Certificates issued through VerifyDoc.ai can be checked at source, which means audit can verify an approver's certificate status on any date rather than relying on a spreadsheet.