Sampling gets faster and the audit universe gets bigger. Agents pull samples, test populations and draft workpapers from the decision record, so an internal auditor spends less time gathering evidence. In exchange, the auditor has new things to audit: how agents' authority is set, whether certificates are current, whether human review is real, and whether the record can be trusted.
What did the day look like before?
- Planning audits and agreeing scope with the business.
- Requesting samples and supporting documents.
- Testing controls item by item.
- Interviewing process owners and staff.
- Writing findings and agreeing actions.
- Following up on overdue actions.
Evidence gathering often took longer than the testing itself.
What does the agent take on?
| Task | Who | Depth |
|---|---|---|
| Extracting populations and samples from systems and the record | Agent | 1 |
| Testing attributes across whole populations | Agent | 1 |
| Drafting workpapers and testing summaries | Agent | 2 |
| Tracking actions and drafting follow-up requests | Agent | 2 |
| Judging whether a control is effective, writing findings, rating issues | Auditor | stays with a person |
Auditors should be careful here: if an agent prepares audit evidence, its own bounds and sources need to be understood, or the audit inherits its errors.
What new areas need auditing?
How authority is set. Each agent's depth is earned through certification, up to its role's ceiling. Auditors check that depth matches evidence, and that the business's own limits match its risk appetite.
Certificates. Certificates lapse after 90 days, and a run that clears no depth drops the agent to depth 1 the same day. Were there periods when an agent acted on a lapsed certificate? The record shows the certificate held at each decision.
The minimum chain. Every action meets five bounds: role scope, certificate, sources, the business's own limits and the platform guardrails. The verdict names which decided. Auditors can test whether the deciding bounds make sense for the process.
Human review. Are held items reviewed by people with the authority and competence for the hold reason? Are approvals made quickly and in bulk? Are reasons meaningful? This is often where findings are.
Sources and provenance. Do agents act on external or declared facts where policy requires sealed or signed ones?
Change control. When an agent's brief, sources or limits change, is the change approved and recorded?
A day in practice
Take an insurer's internal audit team reviewing claims settlement. The auditor asks the audit agent to extract every settlement in the quarter, with verdict, depth, deciding bound, approver and time on item. Within the hour she has the population; previously the sample alone took a week to assemble.
She tests three things. First, whether any settlements were made at depth 3 while the claims agent's certificate had lapsed. There were none, but the certificate was renewed with two days to spare during a storm surge, which she notes as a resilience risk. Second, whether held settlements were approved by handlers with sufficient authority; four were approved by a handler above their limit during the surge. Third, time on item: one handler approved 80 held settlements in an afternoon, averaging under a minute each. She writes up findings on authority and review quality, and agrees actions with the claims manager.
What does an internal auditor need to learn?
The vocabulary: depth, certification, the minimum chain, the four verdicts, provenance classes. How to read the append-only record and query it. Which controls frameworks apply; for example, ISO/IEC 42001 is a certifiable AI management system standard, and the NIST AI Risk Management Framework is a voluntary reference many organisations use. And how to test human oversight as a control, not assume it.
Other roles see the same record from the operating side; compare what changes in an underwriter's day. For market views, see internal auditor training in insurance in the US and in Italy. New auditors are covered in how to onboard a new internal auditor. For every role, see AI agent skills by role.
Where the Academy fits
Pryme Intelligence Academy's Foundations course covers why agents must be governed, the decision chain, and depth and certification in about four hours, which gives auditors the vocabulary. Auditors who will test agent controls in depth benefit from the Operator track's modules on reading the workspace and when something goes wrong. Any certificate it issues can be checked at source, and the public register shows expiry.
Questions people ask
Can auditors rely on evidence an agent extracted?
Yes, if the extraction is reproducible and the auditor understands the agent's sources and bounds. Re-perform a sample of extractions.
Does the decision record replace audit testing?
No. It makes evidence complete and tamper-evident, but the auditor still judges whether controls worked.
Should internal audit review the agent's certification evidence?
Yes, at least for agents acting at depth 3 or above. Certification evidence is what justifies the authority.