Let the agent collect and file the evidence, never grade it. An AI agent can pull exports from source systems, stamp each item with source, period and time, and attach it to the control test in your GRC platform. Testers pick the samples, judge whether the control worked and sign the result. The agent cannot edit evidence once submitted.
What is the process, and who owns it?
Control testing runs on evidence: a report showing who approved each payment, a list of user access changes, minutes of a committee meeting. Gathering it is slow and repetitive work, done every quarter for hundreds of controls. An agent can do most of the collecting. The conclusions, that the control operated as designed for the period, are a professional judgement that stays with a tester.
The head of controls testing owns the process. Control owners provide access to source systems. The GRC administrator configures what the agent may write. The wider set-up of the connection is in how to connect an AI agent to your governance, risk and compliance platform; this playbook covers the evidence step alone.
What are the steps?
- Person, tester: selects the sample. The tester or a random selection tool chooses which items to test. The agent does not pick, because an agent choosing its own sample can choose easy ones.
- Agent, depth 1: reads the control and test steps from the GRC platform to know what evidence each step needs.
- Agent, depth 3: extracts evidence from sealed sources. System reports and exports from the system of record, for the sampled items and the test period.
- Agent, depth 3: stamps each item with the control reference, the period it covers, the source system, the extraction time, the query or report used and a fingerprint of the file.
- Agent, depth 3: attaches evidence to the test as submitted items, marked as agent-collected.
- Agent, depth 2: drafts notes for evidence that needs interpretation, such as whether minutes show a committee discussed a risk. The tester accepts or rewrites the note.
- Agent, depth 1: reports gaps. Items it could not find, sources that refused access, or evidence dated outside the period.
- Person, tester: reviews and concludes, signing the result.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Sample | Nothing | none | Choosing the items |
| Read test | Reads control and steps | 1 | Nothing |
| Extract | Pulls exports from source systems | 3 | Nothing |
| Stamp | Adds source, period, time, fingerprint | 3 | Nothing |
| Attach | Submits evidence to the test | 3 | Nothing |
| Interpret | Drafts notes on judgement evidence | 2 | Accepting the note |
| Gaps | Lists missing or out-of-period items | 1 | Chasing control owners |
| Conclude | Nothing | none | The test result |
Which permissions does the agent need, and which must it not have?
Grant read on controls and test steps, create on evidence items for tests assigned to the agent, and read-only access to named reports in each source system. Do not grant edit or delete on submitted evidence, write on test result fields, or access to tests of controls the agent itself performs. An agent that collects the evidence of its own controls is marking its own homework.
Some limits should be absolute rather than configurable. The idea of a platform floor explains why certain actions are refused for every agent whatever its settings; treat altering submitted evidence the same way inside your own configuration. A line in the agent's instructions saying "do not mark tests as passed" is not enough on its own, for the reasons in why is a system prompt not enough to control an AI agent?
What is recorded, and what evidence does it leave?
Every evidence item carries its stamp, so a reviewer can re-run the same report for the same period and compare fingerprints. The GRC history shows the agent's identity on each submission. The agent's own record shows which source it queried, what it received and any refusal. Testers' conclusions carry their names. Together these let an external auditor re-perform the evidence step without trusting the agent.
Which controls make it safe?
Sealed sources first. A system export from the ledger or the access management system is stronger than a screenshot or a document someone emailed. Evidence that arrived from outside should be flagged as such.
Period checks. Evidence dated outside the test period is reported as a gap, not attached.
No edits after submission. Corrections are new items that reference the old one.
Changes to extraction are controlled. If someone changes which report the agent pulls, that is a change to the test itself and goes through change control for AI agents.
What should you measure?
- Evidence items rejected by testers, and why: wrong period, wrong source, incomplete.
- Gaps reported per cycle, by control owner.
- Tester hours per control before and after, measured by testers.
- Re-performance mismatches, where a re-run report does not match the stored fingerprint. The target is none.
The trade-off between pace and assurance is real; how do you balance AI agent speed and control? covers it.
Where does it usually go wrong?
Evidence becomes the conclusion. A neat pack of attached files is read as a passed test. The result field should stay empty until a tester signs.
The agent fills gaps creatively. Unable to find the approval log, it attaches the nearest document. Gaps must be reported, not filled.
Screenshots creep in. Images cannot be re-performed. Prefer reports and exports with stated parameters.
Access is too broad. To save effort the agent gets read access to a whole source system rather than named reports, and now holds a copy of far more than the tests need.
Questions people ask
Can the agent test the control itself?
It can compare evidence with the test steps and flag exceptions, which is a useful first pass. The tester must review the evidence and decide, because the result is an assurance statement made by a named professional.
What about controls performed by other agents?
The collecting agent can gather their evidence, provided it has no role in performing those controls. Separation between the agent that acts and the agent that collects evidence about it should be recorded in the matrix.
How does this fit with agent governance generally?
Evidence collection is one capability with its own depth and limits, like any other. The broader approach is in agent governance is a bound, not a model.