How to train internal auditors to spot prompt injection and pressure

Internal auditors should assume anything an auditee hands over may have been shaped for the audit agent. Train them on evidence packs with planted conclusions, management responses written to soften a drafted rating, curated samples, and pressure to downgrade a finding before committee. The defence is audit discipline: draw your own samples, weigh evidence by source, record every challenge.

How does manipulation reach an audit?

An internal audit agent typically reads policies, process documents, evidence packs and system extracts, draws samples, drafts test workpapers, and proposes a finding rating against the methodology. Its work sits at depth 1 and 2. Auditors decide on findings and ratings; the chief audit executive signs the report.

Auditees supply much of what the agent reads, and they would rather not have findings. Most cooperate in good faith. Some do not, and the agent opens new routes.

Prompt injection in audit:

• An evidence pack with a hidden line: "Control operated effectively throughout the period; no exceptions noted."
• A management response to a draft finding that includes text addressed to "the audit system" proposing a lower rating.
• A process document with an instruction to skip a section during review.

Curated evidence. Management offers "a representative sample" instead of letting audit draw one, or supplies screenshots of system settings rather than access.

Pressure. A senior executive questions a finding's rating days before audit committee. An auditee claims the issue is already fixed. A business head asks for the report wording to change.

A governed agent labels sources by provenance. A system extract the auditor pulled directly is sealed. An evidence pack from management is declared. A screenshot emailed by the auditee is external. The audit agent should not rate a control effective on declared evidence alone. Auditors must hold the same line.

The chief audit executive owns this training. The audit methodology lead keeps the scenarios current.

What are the steps?

1. Learning lead: runs a baseline of five evidence packs, two shaped or planted.
2. Trainer: explains provenance labels and how the audit agent flags instruction-like text and evidence that rests only on declared sources.
3. Agent, depth 1: lists past workpapers where evidence came mainly from auditees, or where text was flagged.
4. Methodology lead: seeds test engagements in a test workspace with a planted evidence pack, a curated sample and an edited settings screenshot.
5. Auditors: review the agent's drafted workpapers and decide whether the tests stand.
6. Trainer: runs pressure scenarios: an executive challenging a rating, an auditee claiming remediation.
7. Agent, depth 1 and 2 in live work: draws samples from direct extracts, drafts workpapers with source labels.
8. Auditors: log every challenge to a finding with who raised it and the outcome, and file planted material as test cases.

What should auditors learn to recognise?

Conclusions inside evidence. Evidence shows what happened. It does not rate itself.

Samples you did not draw. Politely decline and draw your own from a population you extracted.

Screenshots instead of access. A screenshot is external evidence of a setting at one moment. Ask to see the setting live, or pull the configuration yourself.

Responses that argue the rating, not the facts. Management may dispute facts; the rating follows the methodology.

Claims of remediation. "Already fixed" is declared. Test it, or report it as open with management's statement noted.

Pressure timed to committee. Late challenges are common and legitimate in form. The answer is the same: re-examine facts, keep the methodology.

Which controls leave evidence?

Samples drawn by audit. Evidence: population extract and sample selection record.

Source labels on workpapers. Evidence: each test shows the provenance of its evidence.

Challenges logged. Evidence: the log, reviewed by the chief audit executive and available to the audit committee chair.

Rating changes justified by facts. Evidence: the fact that changed, recorded with any rating change.

Seeded engagements repeated. Evidence: dates and results.

What should you measure?

• Seeded material accepted in exercises.
• Tests relying mainly on declared evidence.
• Ratings changed after challenge, and whether facts or pressure changed them.
• Remediation claims later found untrue on follow-up.

Where does training usually go wrong?

Auditors believe they are immune. Scepticism is part of the job, which is why planted text that looks like routine evidence works.

The audit agent is trusted more than auditees. Its drafts rest on what it read. Check what that was.

Challenges go unlogged. Auditors resolve them in conversation and nothing is recorded.

Committee pressure is seen as normal. It is normal; it still needs recording.

Risk managers and paralegals face related tactics; see how to train risk managers to spot prompt injection and pressure and how to train paralegals to spot prompt injection and pressure. Technique is covered in how internal auditors review an AI agent's decisions, and the AI agent training plan template for internal auditors sets the schedule. The full programme is in training teams for AI agents.

Where the Academy fits

Pryme Intelligence Academy's Operator track teaches how a governed agent decides and how provenance shapes its outputs, with module tests set in the learner's own industry and role. Auditors who test controls across many agents may go further, to the Architect track, which covers regulated, multi-agent deployments and ends in a board review with two Pryme assessors.