Internal audit needs its own view of agent decisions

Internal audit should read the record of AI agent decisions directly, not rely on dashboards and summaries produced by the teams that run the agents. The third line exists to check the first two independently. If auditors can only see what operations chooses to report, they are auditing the report, and the agent's actual decisions go unexamined.

Why are agent decisions harder to audit through reports?

Traditional audit of a process often works by sampling. An auditor picks transactions, follows each one through its documents and approvals, and tests whether controls operated. The evidence sits in systems the auditor can query, and the people involved can be interviewed.

Agents change the volume and the shape of that evidence. An agent may take thousands of actions a day, each passing through several bounds, each producing a verdict. The interesting evidence is not only what the agent did, but what it was stopped from doing, which bound stopped it, and who acted on the work it held. Operations teams naturally summarise this into a few measures: volume, automation rate, held items cleared, incidents. Those summaries are useful for running the agent. They are the wrong evidence for auditing it.

A summary has already made choices. It decided which verdicts to count, how to group them and what counts as an exception. If any of those choices hides a problem, the auditor will not find it by reading the summary.

What should internal audit be able to see directly?

Read access to the verdict record itself, with enough structure to query it independently. At a minimum:

• Every proposed action, allowed, held, refused or withheld, with its timestamp and the agent that proposed it.
• The bounds checked for each action and the one that decided the verdict.
• The sources the agent relied on and the provenance of each.
• For held items, the named person who acted, what they decided and any edit they made.
• Changes to each agent's capabilities, depth, limits and exceptions, with who made them.
• Certification history: when each agent was certified, on what evidence, and when it lapsed or was renewed.

With that, an auditor can choose their own samples, run their own queries and test their own hypotheses. Our general explainer on what an audit trail is describes the basic properties; for agents, the decisive one is that audit sees the same record the system wrote, not a version prepared for them.

What can auditors test that a report would hide?

Direct access lets audit ask questions that operational reporting is not built to answer.

The last row matters most. An auditor working from a report cannot test completeness, because the report only contains what was reported. An auditor with the record can compare it against the systems the agent touches and check that every change has a verdict behind it.

Why should the record be append-only for audit to rely on it?

Because otherwise the first line could tidy it. If entries can be edited or deleted, even with good intentions, an auditor cannot know whether what they see is what happened. An append-only record, where corrections are added as new entries rather than overwriting old ones, gives audit a fixed baseline. It also protects the operations team, because it shows they did not alter the evidence.

How should internal audit prepare to use this access?

Access is useless without the skills and the plan to use it. Three steps help.

First, get briefed on the governance model before the first review: what depth means, what the five bounds are, how verdicts are decided, how certification works. Our guide on briefing internal audit on how AI agents are governed sets out what that briefing should cover.

Second, agree the access in the audit charter or terms of reference, so it does not depend on goodwill from the teams being audited. Read access should be standing, not granted per review.

Third, build a small set of repeatable tests that run against the record each cycle: limit breaches, unreviewed held items, depth changes without evidence, lapsed certificates still in use, stale exceptions. These become the backbone of continuous assurance between full audits. Organisations certifying an AI management system will also find this access supports internal audit under ISO/IEC 42001, which expects the organisation to check its own system independently.

What is the trade-off in giving audit direct access?

Operations teams sometimes resist. They worry that raw records will be misread, that an auditor will find a cluster of refusals and treat it as a failure when it is the bounds working. That risk is real, and it is a reason to brief auditors properly, not to restrict their access.

There is also a data question. The verdict record may contain customer information. Audit access should follow the same data protection rules as any other access: limited to what is needed, logged, and reviewed. That is manageable; most internal audit functions already have controlled access to sensitive systems.

The gain is independence. An audit function that reads the record directly can give the board assurance that does not depend on the people it is assuring. One that reads only reports gives the board the first line's view, relabelled. If your auditors today receive a quarterly pack from the agent team, ask for standing read access to the record and a briefing on how to read it. The surrounding framework is in our guide to agent governance as a bound, not a model, and the evidence you will need to hand over is covered in how to prepare AI agents for an audit.

Where Pryme fits

Pryme files every verdict in an append-only record that names the agent, the action, the sources and their provenance, each bound checked and the one that decided, and the person who acted next. Auditors can be given read-only access to that record directly, alongside certification history from Attest and every change to depth, limits and exceptions.