A compliance reviewer must learn to do two things with agents: decide what the compliance agent flags, and test other teams' agents from their record. This checklist covers both, with independence rules before day one, shadowing on held breach decisions, reviewer training and exam, a practicum that includes tracing a decision end to end, and sign-off.
What is different about reviewing in compliance?
In compliance, the agent usually monitors. It screens communications or transactions against policy, maps new rules to internal policies, drafts monitoring reports and chases attestations. It flags possible breaches and holds them for a person. It never decides that a breach is reportable, and it never sends a notification to a regulator. Those stay with named people.
A compliance reviewer also has a second job that other reviewers do not: checking whether the rest of the business's agents behave as their certificates say. That means reading the record. Every verdict, allowed, held, refused or withheld, is filed with the bound that decided it, so a reviewer can pick any decision and reconstruct why it happened. New compliance staff often know the rules well but have never traced an agent's decision from its record. The checklist makes that a required skill.
Independence matters too. A reviewer who helped design an agent's bounds should not be the one who tests them.
How do you work through it?
The head of compliance owns the checklist. Tick each item and record the date. Items 1 to 4 are prerequisites; the reviewer has no rights to close flags until item 14 is signed. Keep the completed list with the reviewer's file, since supervisors may ask how compliance staff were made competent. The broader order of training is set out in the guide to training teams for AI agents, and the general idea of what onboarding is applies here as anywhere.
The checklist
| # | Item | What good looks like |
|---|---|---|
| 1 | Read-only access to the compliance workspace and the record | No right to close flags or change agent bounds |
| 2 | Independence declaration | Lists any agent the reviewer helped design; those are excluded from their testing |
| 3 | Compliance agent profile read | Knows each capability and depth: screening (1), policy mapping (2), report drafting (2), attestation chasing (3) |
| 4 | Red lines signed | Never close a possible breach without evidence on file; never let an agent draft go to a regulator unread; escalate anything suggesting deliberate misconduct the same day |
| 5 | Shadowing | Two days with a certified reviewer on held flags |
| 6 | Record tracing | With a buddy, trace three decisions by other teams' agents from verdict back to the bound that decided it |
| 7 | Shared foundation | Complete, test passed |
| 8 | Reviewer modules and exam | Complete and passed |
| 9 | Practicum | Two weeks of real held flags, each confirmed by a buddy |
| 10 | Practicum coverage | Includes a false positive, a genuine breach, a flag based on an external source and one record trace of a refused action |
| 11 | Incident drill | Taken part in a drill with another team |
| 12 | Assessor sign-off | No missed red line |
| 13 | Testing rights | Agents the reviewer may test, excluding those in item 2 |
| 14 | Approval rights and renewal | Rights to close flags recorded; renewal date set |
A completed example
An illustrative bank's compliance team takes on Sample Reviewer M from a policy role. Her independence declaration in item 2 lists the onboarding agent, because she helped write its customer due diligence rules; she will not test it.
During record tracing, her buddy shows her a refused payment by the payments agent: the verdict named the customer's own limit as the deciding bound. She then traces a held account opening back to a sanctions near-match. Because compliance reviewers often sample decisions from the onboarding team, she reads how the onboarding team is trained to review AI agent decisions, so she knows what that team's reviewers were taught.
Her practicum covers 60 held flags. She closes a flagged message as a false positive after reading the full thread, and escalates another where a trader's chat suggested sharing client information. For item 11 she joins an AI agent incident drill for the onboarding team as the observer from compliance. She is signed off at the end of week 7.
Where the Academy fits
Pryme Intelligence Academy covers items 7, 8 and 12 through Operator. For a compliance lead who designs controls across several agents in a regulated setting, Architect adds a capstone and a board review with two Pryme assessors and is valid 24 months. Certificates can be checked at source by number or QR code, which helps when a supervisor asks.
Questions people ask
Should compliance reviewers be certified before operational reviewers?
Not necessarily before, but before they test anything. A compliance reviewer who cannot read the record will either miss real issues or raise false ones.
How does this differ from the IT team's checklist?
IT reviewers decide access and change requests; compliance reviewers decide breaches and test controls. See the reviewer onboarding checklist for the IT team for the contrast.
What if a compliance reviewer disagrees with an operational team's approvals?
Raise it through calibration first, with examples from the record. If the pattern continues, it becomes a finding. The reviewer onboarding checklist for the collections team shows the standard those reviewers are held to.