Internal auditors reviewing agent work wear two hats: they approve the test work an audit agent prepares, and they audit other teams' agents from the record. This checklist prepares a new auditor for both, with independence checks, shadowing on held workpapers, reviewer training, a practicum including a full decision trace, a drill and sign-off.
What does an internal audit reviewer check?
An internal audit agent prepares fieldwork. It pulls populations, selects samples, matches evidence to each sample item, and drafts test results and findings. That is depth 1 and 2 work: it reads and drafts, and an auditor concludes. The reviewer's job is to reperform enough of the agent's work to rely on it, and to judge whether a draft finding is right, fairly worded and supported.
The second hat is auditing the business's own agents. Here the auditor uses the record: every verdict an agent reached, allowed, held, refused or withheld, is filed with the bound that decided it. A competent auditor can take any decision and reconstruct it: which sources the agent used and their provenance, which certificate was current, which person approved a held action and whether they were certified at the time. New auditors often understand controls well but have never traced an agent's decision. The checklist makes that a required step.
How do you use it?
The chief audit executive or an audit manager owns the checklist. Start with a short skills audit of the new joiner, so the checklist builds on what they already know rather than repeating it. Then work through the items in order. The approach to teaching review is in how to train the internal audit team to review AI agent decisions; the overall sequence is in the guide to training teams for AI agents.
The checklist
| # | Item | Owner | Evidence |
|---|---|---|---|
| 1 | Skills audit of the new auditor completed | Audit manager | Skills record |
| 2 | Read-only access to the audit workspace and to the record of in-scope agents | Audit manager | Access log |
| 3 | Independence declaration: agents or processes the auditor designed or ran in the previous 12 months | Auditor | Signed declaration |
| 4 | Audit agent capabilities read: population pulls (1), sampling (1), evidence matching (2), draft results and findings (2) | Auditor | Signed |
| 5 | Red lines signed: never conclude a test without reperforming a sample of the agent's matching; never issue a finding drafted by the agent without re-reading the evidence; never audit an agent named in item 3 | Auditor and manager | Signed |
| 6 | Shadowing on two held workpapers | Buddy | Note |
| 7 | Decision trace: with a buddy, reconstruct one held and one refused decision by another team's agent | Buddy | Trace notes |
| 8 | Shared foundation complete | Auditor | Test score |
| 9 | Reviewer modules and written exam complete | Auditor | Exam result |
| 10 | Practicum: two weeks of real held workpapers and draft findings, confirmed by a buddy | Buddy | Practicum record |
| 11 | Coverage: a sample with a mismatched document, a draft finding that overstates the issue, a full trace of an approval by a reviewer whose certificate had lapsed | Audit manager | Case list |
| 12 | Incident drill as observer | Audit manager | Drill log |
| 13 | Assessor sign-off; no missed red line | Assessor | Signed |
| 14 | Renewal date set | Audit manager | Register |
What does a completed checklist look like?
An illustrative group internal audit team brings in Sample Auditor V. Her skills audit shows strong controls testing but no exposure to agents. Her independence declaration lists the procurement agent, which she helped configure in her previous finance role.
In her decision trace, she reconstructs a held supplier payment: the payments agent's verdict named the customer's own limit as the deciding bound, the approving reviewer was certified, and the source for the bank details was signed by the supplier through a verified channel. She then traces a refused journal and finds the agent's certificate had been renewed two days before.
Her practicum covers 40 workpapers. She reperforms ten items of a payroll test and finds the agent matched one overtime claim to the wrong timesheet; she corrects the result. The reviewer onboarding checklist for the payroll team shows what the payroll reviewers who approved that overtime had been trained on. She rewrites a draft finding the agent had worded as a "systemic failure" when the evidence showed two exceptions. She is signed off in week 7, with the procurement agent excluded from her audits for a year.
How is audit review different from risk review?
Risk reviewers own and monitor controls as a second line; internal audit gives independent assurance as a third. Both read the record, but auditors must stay independent of what they test. The reviewer onboarding checklist for the risk team shows the second-line version.
Questions people ask
Should auditors be certified on the agents they audit?
They need to understand how those agents decide, which the shared foundation and reviewer track give them. They do not need builder skills to audit an agent, though a lead auditor benefits from them.
How much of the agent's work should an auditor reperform?
Enough to rely on it, set by the audit methodology. Start higher for a new audit agent and reduce only as evidence of accuracy builds.
What if the trace shows an approver was not certified?
That is a finding. Record when the certificate lapsed, which decisions were approved after, and whether the business ties approval rights to a current certificate.