The third line of defence is internal audit: the function that gives the board independent assurance that the organisation's risk management and controls actually work. It does not run processes or set risk standards. It tests both. For AI agents, it checks whether the agents, their reviewers and their bounds operate as the first and second lines say they do.
Why does the third line matter for agents?
Because everyone else has a stake in the agent working. The business team wants the efficiency; the agent owner built it; the second line approved the framework. Internal audit is the one function with no stake in the answer, reporting to the board or its audit committee, whose job is to ask whether the evidence supports the claims.
Agents also give auditors something new to work with. Every verdict an agent receives is filed in an append-only record, naming the bound that decided it. An auditor can test oversight directly: pull a sample of held actions, see who approved each, check whether they had standing at the time, and confirm the facts behind each approval.
What does internal audit test?
- Design. Are the agent's bounds, house rules and red lines appropriate to the risk?
- Certification. Did the agent hold a current certificate at the depth each action needed?
- Review. Were held actions decided by certified people, within targets, with real reasons?
- Separation. Did anyone approve what they prepared?
- Change control. Were changes to the brief and sources approved and tested before going live?
- Incidents. Were incidents declared, contained and reviewed, and were the fixes made?
An example
Take a hypothetical building society. Internal audit reviews its savings operations agent, which handles routine account servicing at depth 3 and holds withdrawals above a set amount for two approvers. The auditors sample sixty held withdrawals from the record. In fifty-six, two certified approvers decided with reasons. In four, the second approver had approved within seconds of the first, without opening the supporting documents. The finding goes to the operations head and the audit committee: the second-approval control is designed well but is not operating as designed. The fix is coaching and a monthly sample by the control owner.
How is it different from the first and second lines?
The first line of defence is the business teams that own and run processes, including the agents in them. The second line of defence is risk and compliance, which sets standards, challenges the first line and monitors. The third line is independent of both and tests them. A second-line review asks whether the first line follows the standard; a third-line audit asks whether the standard and the monitoring are themselves effective.
The second line should be involved in agent training to set and challenge the standard, as covered in how to involve the second line in AI agent training. The third line should understand the training but stay out of delivering it, to keep its independence; why the second line, not the third, sits in the room is argued in why the second line should sit in your AI agent training.
What do auditors need to learn?
To read an agent's record as evidence: what held, refused and withheld mean, what depth and certification imply, and what provenance tells them about a fact. Without that, auditors can only interview people about oversight rather than test it. The guide to AI agent skills by role covers the auditor's skills alongside other roles.
Questions people ask
Can the third line use agents in its own work?
Yes, for work such as sampling and file preparation. Those agents need their own governance, and an audit agent should never be owned by the team whose work it tests.
How often should internal audit review an agent deployment?
On a risk basis. A new deployment at depth 3 or above should be reviewed within its first year, and again after any significant change in depth or scope.