Audit the evidence, not the model. Internal audit tests governed agents the way it tests any control: by checking that the design is sound and that it operated. The evidence is the append-only decision record, the certificate history for each agent, and the held actions that named people approved. Auditors do not need to open the model.
What does an auditor actually test?
Three things, and each has its own evidence.
| Test | Question | Evidence |
|---|---|---|
| Design | Are the bounds right for the risk? | The agent’s role scope, sources, the firm’s limits, approver rules, red lines |
| Authority | Was the agent allowed to act at that depth, on that date? | Certificate history: issue, depth, lapse, failed runs |
| Operation | Did each action follow the rules, and did people decide what was held? | Verdicts in the record, with facts, sources and approver |
Every action meets five bounds at once: role scope, certificate, sources, the firm’s own limits and the platform guardrails. The lowest wins and the verdict names which bound decided. That makes each verdict self-describing, which is what auditors want.
How should auditors use the certificate history?
As the authority test. Depth is earned on evidence, not configured: the role sets a ceiling, certification on the firm’s own cases sets the depth, and the lower wins. Certificates lapse after 90 days. A run that clears no depth drops the agent to depth 1 the same day.
So for any sampled action, the auditor can ask: on that date, was the agent certified for that capability at that depth? An action at depth 3 the day after a failed run is a finding. So is a pattern of certificates renewed late, or a gate that failed and was not investigated. Certification covers seven gates, each of which must clear on its own: grounded, refuses, depth, escalates, scope, adversarial and stable.
How do you sample held actions?
Held actions are where people meet agents, so they deserve the closest look. A useful sample design:
- Pick held items across types and reviewers, weighted to higher-value or higher-risk actions.
- For each, check that the approver had authority under the approver rule on that date.
- Check the approver’s competence: training, and certificate status if the firm ties approval rights to a current certificate.
- Read the facts the agent used and their provenance. An approval of a payment that rested on an external claim, such as an emailed bank letter, should not exist.
- Note time to decision. Items approved in seconds in bulk suggest review was not real.
Sample refusals too. Refusals at the firm’s limits show where business pressure is pushing. Repeated attempts at withheld actions, which are refused at the platform floor for every agent, suggest a training gap.
What will auditors find hard?
Usually not the agents. The gaps tend to be around them: limits nobody owns, approver rules that do not match the authority matrix, reviewers without training, and changes to sources made without re-certification. Auditors should ask for change logs on limits and sources, and match them to certification runs.
How does internal audit relate to compliance?
The second line monitors continuously; the third line tests independently and reports to the audit committee. Both use the same record. See what a compliance team needs to know about AI agents for the monitoring view, so the two plans do not duplicate effort.
What does the audit team itself need?
Fluency in the vocabulary and the record. Auditors should be able to read a verdict and name the deciding bound, explain the four verdicts, and interpret a certificate history. Map the team with an AI agent competency matrix for internal audit.
If the audit function uses agents in its own work, such as drafting test scripts or summarising evidence, it needs its own controls: an approver authority matrix for the internal audit team, an approver rule for audit and a reviewer rota. The overview by role is in AI agent skills by role.
Where the Academy fits
Auditors who need the concepts can take Foundations in Pryme Intelligence Academy, about four hours. Those auditing large or regulated deployments benefit from the Architect track. Certificates issued through VerifyDoc.ai can be checked at source by number or QR code, and a lapsed or revoked certificate shows as such, which helps when testing reviewer competence.
Questions people ask
Do auditors need to understand how the model works?
Not in depth. Audit tests the controls around the model: bounds, certification, review and the record.
Can the agent’s record be relied on as audit evidence?
It is append-only and outside the agent’s reach, which supports reliance. Auditors should still test its completeness against source systems.
How often should agents be audited?
Include them in the risk-based plan like other key controls, with more frequent review for agents at depth 4.