Internal auditors are the real control because they are the only people paid to doubt every other control. Once AI agents prepare and execute work, someone must test whether depth, limits, reviews and certificates actually operate as described, and report the answer to the audit committee. That job needs auditors who understand how a governed agent decides.
What is different about auditing an AI agent?
Less than people fear, and more than the audit plan usually allows for. The familiar questions still apply: is the control designed properly, does it operate, and is there evidence? What changes is where the control sits. In a governed deployment every action meets five bounds at once: role scope, certificate, sources, the organisation's own limits and the platform guardrails. The lowest one wins, and the verdict names which bound decided.
That gives auditors something they rarely have: a decision-level trail. Every verdict is filed in an append-only record, so any decision can be reconstructed. The auditor's skill is no longer finding evidence; it is knowing which questions the evidence can answer and which it cannot.
What should internal audit test first?
A practical audit of an agent deployment covers a handful of areas. Each can be tested from the record and from interviews:
| Area | What to test | Evidence to look for |
|---|---|---|
| Depth | Does the agent act only at its certified depth? | Verdicts showing the certificate as the deciding bound |
| Certificates | Are certificates current, and did lapses take effect? | Lapse dates and the drop to depth 1 the same day |
| Limits | Do the organisation's own limits match approved risk appetite? | Change history for each limit and who approved it |
| Human review | Are held items decided by authorised, trained people? | Reviewer names, timings, override reasons |
| Withheld actions | Did platform-floor actions stay withheld? | Withheld verdicts and how people handled the work instead |
| Sources | Are facts used with the right provenance? | Sealed, signed, declared and external stamps on key decisions |
Why are the reviewers part of the audit scope?
Because a held action is only a control if the person deciding it is competent and attentive. An agent that holds every payment above a limit is well designed. If the reviewer approves all of them in seconds, the control does not operate. Auditors who test only the agent and not the people miss the commonest failure.
Sampling reviewer decisions is now part of the work: approval times, override rates, decisions later found wrong, and whether the reviewer held the right authority and a current certificate at the time. Where a business makes approval rights depend on a current certificate, the auditor can test that rule directly against the record.
What should internal auditors never let an agent do?
Audit itself can use agents. An agent can read the record, select samples, draft test workings and summarise exceptions. What it should never do is reach the audit opinion, decide which findings go to the audit committee, or test controls over itself. Independence is the audit function's core asset, and it does not survive an agent marking its own homework. The list is in what internal auditors should never let an AI agent do.
A quieter risk is the auditor configuring the deployment. If internal audit helps set limits or design review flows, it cannot later audit them objectively. Advise, yes; own, no. Auditors who are asked to help design controls before go-live should record that involvement, so later audits can be assigned to someone who was not part of it.
What does an internal auditor need to learn?
Four areas of knowledge carry most of the weight:
- The decision chain. How the minimum chain works, what each verdict means, and why withheld is a platform decision rather than a customer setting.
- Depth and certification. That depth is earned through evidence from certification against the organisation's own cases, that the agent's role sets a ceiling, and that the lower of the two wins.
- Provenance. How the Pryme Context Protocol stamps every fact, and why an external claim cannot authorise a payment.
- Frameworks. How agent controls map to what the auditor already uses: the NIST AI Risk Management Framework's Govern, Map, Measure and Manage functions, ISO/IEC 42001 for AI management systems, and EU AI Act Article 12 on record-keeping and Article 14 on human oversight where they apply.
How do auditors report agent risk to the audit committee?
Plainly. Committees do not need the mechanics; they need to know whether the organisation can show who decided what, whether the limits match appetite, and whether the people overseeing agents are competent. A short opinion on those three questions, backed by tested samples, is more useful than a long technical report.
Auditors also bring cross-functional sight. They see underwriting, risk and operations at once, and can spot a control that relies on a team nobody has trained. See how risk managers and underwriters carry first- and second-line responsibility, and the full picture in AI agent skills by role. The briefs on internal auditors in insurance in the United States and Italy cover the market detail.
Where the Academy fits
Internal auditors often start with Pryme Intelligence Academy's Foundations track, then take the Operator track to understand review from the inside. Certificates are issued through VerifyDoc.ai and can be checked at source by number or QR code, and a lapsed or revoked certificate shows as such, so auditors can verify a reviewer's credential without asking anyone.
Questions people ask
Can internal audit rely on the agent's record as evidence?
It can rely on it as a complete, append-only record of verdicts and human decisions, after testing that the record is intact and covers the scope. It still needs interviews and walkthroughs to judge whether controls are well designed.
How often should agent deployments be audited?
In line with their risk. Agents acting at depth 3 or 4 on money or customer outcomes deserve more frequent review than read-only agents. Certificate lapses and depth changes are good triggers for a targeted review.
Should internal audit attend operator training?
Yes, as observers. Knowing what reviewers were taught makes it easier to test whether they apply it.