Internal auditors bank corrections into the audit agent that helps them test, by recording why a workpaper or sample was wrong and passing that reason to the agent owner for a brief, source or bound change. They must not bank corrections into the business agents they audit. Those become findings, owned by management, so independence survives.
Which agent are auditors correcting?
Two kinds of agent cross an auditor's desk, and teaching starts by separating them.
The first is the audit team's own agent. It reads control descriptions, pulls samples from the population, drafts test steps and workpapers, and proposes wording for findings. It works at depth 1 and 2: it reads and drafts, an auditor decides. When it pulls the wrong population or misreads a control, the auditor corrects it, and banking that correction is no different from any other team improving its own tool.
The second is the business agent under audit: the payments agent, the claims agent, the onboarding agent. Auditors read its verdicts and the record, and they will spot errors. It is tempting to fix them directly. That would make audit part of the control it is meant to assess. Those errors are findings, and management owns the fix. The role-by-role picture of these responsibilities is set out in AI agent skills by role.
How do auditors bank corrections into their own agent?
- Agent, depth 1: extracts the population and proposes a sample, recording the source and the filter it applied.
- Agent, depth 2: drafts test steps and the workpaper, citing the control description and evidence for each step.
- Person (auditor): corrects and records a reason: wrong population, misread control, insufficient evidence, unclear brief, or one-off.
- Agent, depth 1: groups reasons by audit area at the end of each engagement.
- Person (audit manager): chooses what to bank, such as a rule that payment populations must include reversed and cancelled items.
- Person (agent owner, inside audit): makes the change to the brief, sources or bounds.
- Attest replays the agent against past engagements' samples and workpapers, and the audit manager accepts or rejects the new certificate.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Extract population | Pulls and filters data, records filter | 1 | Confirming completeness |
| Draft workpaper | Proposes test steps and evidence | 2 | Audit conclusion |
| Correct | Nothing; reason filed | 1 | Reason code |
| Bank | Nothing | none | Audit manager decides |
| Re-certify | Replayed in Attest | none | Accepting the result |
What does an auditor need to learn here?
The audit-specific skill is completeness. Most correction reasons in audit come back to the population: the agent filtered out items that were in scope, such as reversed payments, manual journals posted outside the usual system, or claims reopened after closure. An auditor who learns to bank a completeness rule into the brief removes the commonest repeat error.
The second skill is reading the record as evidence. Business agents file every verdict in an append-only record, and an auditor who can read held, refused and withheld verdicts can test oversight directly, not just ask about it. That reading feeds findings, not banked corrections. Teach the line clearly: if the error is in our audit agent, bank it; if it is in the business's agent, report it. The detail of what auditors look for is in how internal auditors review an AI agent's decisions, and the limits they should insist on are in what internal auditors should never let an AI agent do.
The third is following up on management's banking. When a finding leads management to change a business agent's brief, the auditor's follow-up should check the change was re-certified in Attest and that the agent's corrections on that point fell afterwards.
Which controls protect independence, and what do they leave?
- No audit access to business agent briefs. Auditors have read access to the record and certificates, not edit rights to the agents they audit. Evidence: the access list.
- Findings, not fixes. Errors in business agents go into the audit report with a named management owner. Evidence: the finding and the owner's action.
- Separate agent owner for the audit agent. Inside audit, someone other than the engagement lead approves brief changes. Evidence: proposer and approver in the record.
- Re-certification of the audit agent. Evidence: a dated certificate with gate scores.
What should audit measure?
Measure repeat corrections in the audit agent by reason code across engagements, especially completeness. Measure the time an auditor spends correcting drafts per engagement; a falling number shows banking is paying off. For follow-up work, measure whether management's banked changes reduced corrections in the business agent, which is the evidence that a finding was actually closed rather than papered over.
Where does it usually go wrong?
The most serious failure is the helpful auditor who tells the business agent owner exactly how to reword the brief, then audits the result. Advice is fine; drafting management's fix is not. Keep a clear record of what audit recommended and what management chose.
The second is treating the audit agent's errors as harmless because a person reviews everything. Auditors under time pressure accept drafts, and an uncorrected completeness error becomes a flawed conclusion. Payments operations teams see the same drift with repairs they approve under cut-off pressure, as teaching payments operations staff to bank corrections explains.
The third is banking nothing between engagements, so the same population error recurs every quarter.
Where the Academy fits
Pryme Intelligence Academy's Foundations track gives auditors the vocabulary they need to test agents: the decision chain, depth and certification, and how the record works. Auditors who also run the team's own audit agent benefit from the Operator track, whose modules cover human review and teaching the agent. Certificates are issued through VerifyDoc.ai and can be checked at source.
Questions people ask
Can an auditor ever change a business agent's brief?
Not while they audit it. If an auditor moves into the first line, the change of role should be recorded, and they should not audit that agent for a period your audit charter defines.
Should audit keep its own copy of the business agent's record?
Audit needs read access to the record, not a copy. The record is append-only, so reading it at source is the stronger evidence.
How often should the audit agent be re-certified?
Whenever a banked change is made, and in any case before its certificate lapses. An agent certificate lapses after 90 days, so plan re-certification into the audit calendar.