No, and the arrival of agents gives internal audit more to do, not less. Agents can test entire populations instead of samples and draft findings from the evidence. But an audit opinion is only worth something because an independent person forms it. Internal auditors keep that, and they gain a new subject: the agents themselves.
Why can an agent not give assurance?
Assurance depends on independence and judgement. The audit committee relies on internal audit because the function stands apart from the processes it reviews and applies professional scepticism. An agent drafted by the same organisation, running on the same data, is part of the system being audited. It can produce evidence; it cannot vouch for the system it belongs to.
The second reason is judgement about significance. An agent can find 300 exceptions in a claims population. Deciding which three matter, and why, is the auditor's craft.
What changes in the audit cycle?
| Audit stage | What the agent does | What the auditor keeps |
|---|---|---|
| Planning | Reads prior reports, risk registers and incident logs; drafts a risk-ranked plan (depth 2) | The plan, scope and priorities |
| Fieldwork | Tests full populations against defined criteria; collects evidence with provenance (depth 1 and 2) | Choice of tests, sampling of the agent's own work |
| Findings | Drafts findings and root-cause notes | Significance, ratings and the wording |
| Reporting | Drafts the report and tracks agreed actions | The opinion and the conversation with management |
| Follow-up | Checks whether actions were closed in the system of record | Whether closure is real or cosmetic |
Note what is missing: the agent does not act on the audited systems. In audit, depth beyond 2 rarely makes sense. Other roles that review decisions rather than execute them follow a similar pattern; see whether agents will replace underwriters and whether agents will replace customer support agents.
What new work do agents create for audit?
Once agents act in the business, internal audit has to give assurance over them. That means asking questions an auditor has not asked before. Was each agent certified on the organisation's own cases, and is the certificate current? Do its depth and bounds match what the business approved? Do held actions reach a named person, and do those people approve too easily? When a certification run cleared no depth, did the agent drop to depth 1 the same day?
The evidence exists. Every verdict, whether allowed, held, refused or withheld, is filed in an append-only record that names the bound that decided. An auditor who can read that record can reconstruct any decision. One who cannot will be reduced to interviewing the people who configured the agent.
What does that look like at an insurer?
Take an insurer whose claims agent settles small claims at depth 3. Internal audit plans a review. The audit agent tests every settlement in the quarter against the settlement limit and the policy terms, and drafts a finding: no breaches. The auditor goes further. They pull the record for claims that were held and approved, and see that one handler approved held settlements in a median of under a minute. That is a control weakness the population test would never surface: a reviewer rubber-stamping the agent. The finding goes to the claims director with a recommendation on sampling and reviewer training. Markets bring their own supervisory context, discussed in AI agent training for internal auditors in insurance in India and in the UAE.
What must auditors learn?
Auditors need enough fluency to audit the agent layer: depth and how it is earned, the minimum chain of five bounds, the four verdicts, how certificates lapse, and how to query the record. They also need to resist trusting their own audit agent's population tests uncritically, and to sample its work. The case for auditors as the decisive control is made in why internal auditors are the real control.
Where the Academy fits
Internal auditors who need to read the record and challenge agent controls benefit from Pryme Intelligence Academy's Operator track, which covers how a governed agent decides, human review and what to do when something goes wrong. Audit leads covering regulated, multi-agent estates can go further with the Architect track. The guide to AI agent skills by role shows where audit sits.
Questions people ask
Should internal audit use the same agents as the business?
Preferably not for testing. A separate audit agent, with its own brief and sources and certified for audit work, keeps the line of independence clearer.
Can an agent replace sampling?
For tests with clear criteria, testing the whole population is better than sampling. Sampling remains necessary for judgement-based tests and for checking the agent's own conclusions.
Who audits the audit agent?
The chief audit executive owns it. Its certification, depth and bounds should be documented and open to review by external audit and the audit committee.