Audit of an AI agent deployment will not stop at the agent. Auditors will sample approvals of held actions and test the people behind them: was this reviewer qualified, was their standing current on the day, did they have authority, and do their approvals look like real review? Prepare for that, because it is where weak deployments fail.
Why do auditors turn to the reviewers?
Auditors test controls. In a governed deployment, the controls on an agent are layered: what it may do at each depth, the certificate that proves it, the sources it draws on, the business's own limits and the platform's guardrails. For anything held, the final control is a person's judgement.
That makes the reviewer a key control in its own right. An auditor who has satisfied themselves that the agent's certification is sound will ask the next question: when the agent hands a decision to a person, is that person a reliable control? If not, the held actions, often the highest-risk ones, are effectively uncontrolled.
The verdict record makes this easy for them. Every held item and every approval is filed with the reviewer's name and the time. An auditor can pull a sample in minutes and work outward from each name.
What will they test?
Expect four lines of enquiry, each of which can be prepared for.
Qualification. For each sampled approval, did the reviewer hold the right certificate? Auditors will want evidence that is specific to the role and checkable, not an attendance record. The guide on how auditors test that reviewers are qualified covers the tests in detail.
Currency. Was that certificate current on the day of the approval, not just today? If you can only show current status, you cannot answer this.
Authority. Was the reviewer authorised to approve this kind of action at this depth? Access to the queue is not the same as authority to decide, a distinction drawn sharply in reviewers need authority, not just access.
Behaviour. Does the pattern of approvals suggest real review? Auditors will look at time between hold and approval, the share of held items approved without change, and whether certain reviewers approve far faster than peers. An approval in a few seconds on an item that needed source checks is a red flag.
Where does data protection law come into this?
In some areas the requirement for meaningful review is explicit. Under GDPR Article 22, people have rights in relation to decisions based solely on automated processing that have legal or similarly significant effects. Human involvement only takes a decision outside that category if it is meaningful: a reviewer who approves without considering the case does not count. The UK ICO's guidance makes the same point about genuine human review of automated decisions; training reviewers of automated decisions under ICO guidance explains what that means for training.
Customer support is a common place for this to bite. Decisions about refunds, account restrictions or complaints may have significant effects on individuals, and a reviewer who rubber-stamps the agent's draft turns a supposedly reviewed decision into an automated one. See meaningful human review in customer support for the detail.
Will this change the audit function itself?
It will change what auditors need to know. Internal auditors who sample reviewers must understand depth, verdicts and the record well enough to judge whether a reviewer's decision was sound. That is a training need for audit teams, not a reason to think agents will do their job for them; the piece on whether agents will replace internal auditors argues that the judgement remains with people.
What is the trade-off?
Measuring reviewer behaviour can distort it. If reviewers know that fast approvals are flagged, some will slow down artificially without reviewing any better. If they know that approving everything unchanged looks bad, some will make trivial edits to appear engaged. Metrics invite gaming.
There is also a cost in preparing evidence: keeping certificate status for every date, documenting authority for each capability, and analysing approval patterns before auditors do.
The answer to gaming is to use metrics as prompts for conversation, not as targets. A fast approver is someone to sample and talk to, not someone to sanction automatically. Combine pattern data with direct review of a sample of decisions, which reveals whether edits were real. And the cost of preparation is far smaller than the cost of an adverse finding that the business's highest-risk control was not operating.
What should you do before the auditors arrive?
- Keep certificate status retrievable for any date, so each sampled approval can be matched to the reviewer's standing at the time.
- Document authority for each reviewer: which capabilities, which depths, which limits.
- Tie authority to certificates, so a lapse pauses rights automatically and the record shows it.
- Run your own sample quarterly: pick approvals at random, trace each to the reviewer, and test qualification, currency, authority and behaviour.
- Look at patterns across reviewers, and follow up outliers with a conversation and a closer look at their decisions.
- Train your auditors on how the agents and the record work, so their tests are well aimed.
The guide to AI literacy and certification for people who work with agents explains the certificate levels your evidence will rest on.
Questions people ask
How large a sample will auditors take?
That depends on the auditor, the risk and the volume. Expect them to focus on held items at higher depths, where the reviewer's decision matters most.
What if a sampled reviewer's certificate had lapsed on the day?
That is likely to be a finding. Show what control should have prevented it, why it did not, and what you have changed. A design where rights pause automatically on lapse prevents the problem.
Should reviewers know their approvals may be sampled?
Yes. Telling them openly is fairer and tends to improve review quality, as long as the sampling is used to learn rather than to punish.