Who Audits the Agent? AI Agents and the Future of Internal Audit

AI agents hold credentials and act without waiting for approval, which makes them participants in the control environment rather than tools. What that changes for audit evidence, identity governance, and the audit programme itself.

Published 2026-08-19 · By Shahzad Asghar

Ask a room of technologists what an AI agent can do and you will get a long, enthusiastic answer. Ask who approved its last action and the room usually goes quiet.

That silence is the whole story.

For most of the last three years, the conversation about artificial intelligence in the enterprise has been about output. Will the model write good code, draft a decent summary, answer the customer. Those are quality questions, and quality questions are comfortable. We have decades of practice arguing about whether a system produces good work.

Agents change the question. An agent does not produce work for a human to accept or reject. It acts. It holds credentials, calls APIs, moves data, triggers workflows, and closes the loop without waiting for anyone. The moment software stops advising and starts acting, it stops being a tool and starts being a participant in the control environment.

Internal audit has spent a century getting good at examining participants in the control environment. This one is different, and I think the profession has roughly eighteen months to work out how different before the estate gets away from us.

The evidence problem nobody wants to talk about

Start with the thing that should worry auditors most, because it is technical, unglamorous, and structural.

Audit evidence rests on an assumption so old that we rarely say it out loud: that if you repeat a procedure under the same conditions, you get the same result. Re-performance is built on it. Sampling is built on it. When I test a control ten times and it works ten times, I am entitled to a conclusion about the other ten thousand times, because the control is deterministic. It does the same thing every time because it was built to do the same thing every time.

Agents are not deterministic. Run the same prompt against the same agent with the same data twice and you may get two different action paths, both defensible, both within policy. Now sample that. Now re-perform it.

This is not a reason to panic and it is certainly not a reason to refuse assurance. But it does mean that the unit of testing has to move. You cannot meaningfully test an agent's individual decisions the way you test a three-way match. What you can test is the envelope the agent operates inside: the permissions it holds, the actions it is allowed to take without a human, the thresholds that force escalation, the completeness of the trace it leaves behind, the evaluation it passed before release, and the monitoring that catches it drifting.

In other words, assurance shifts from *did the system do the right thing* to *could the system have done the wrong thing, and would we have known*.

I find that a more honest framing anyway. It is closer to how good auditors already think about human judgement, which has never been deterministic either. We do not audit whether a procurement officer made the optimal decision. We audit whether the decision sat inside an authorised envelope, was documented, and was visible to someone accountable.

Agents are, in this narrow sense, more like staff than like software.

Agents are identities, and most organisations have not noticed

Here is where the security side of my career keeps interrupting the audit side.

Every agent that acts inside your estate needs credentials. It gets a service account, a token, an API key, an OAuth grant, something. And those credentials are being created faster than anybody is inventorying them.

The numbers coming out of 2026 are uncomfortable. KPMG's Cybersecurity Considerations 2026 puts non-human identities at roughly eighty times the number of human users in the average enterprise, with cloud-native environments running far higher. A Cloud Security Alliance survey of IT and security professionals found that 68 per cent of organisations cannot clearly distinguish AI agent activity from human activity in their own systems, while 85 per cent already have agents running in production. A follow-up CSA study found 82 per cent of enterprises have agents in their environment that they did not know were there. And IBM's Cost of a Data Breach work found that the overwhelming majority of organisations suffering AI-related breaches had no proper AI access controls in place, with only around 40 per cent of breached organisations applying access controls to AI models and data at all.

Read those findings together and the picture is not subtle. The fastest-growing population of actors in the enterprise is the one with no manager, no hire date, no offboarding trigger, and frequently no owner.

Classical identity governance was designed around a joiner, mover, leaver cycle that assumes a person. Agents have none of that. When the developer who spun up an agent leaves the organisation, the agent does not leave. Its credentials stay live, its permissions stay broad, and its actions keep appearing in systems where nobody can now explain why.

If you want one audit finding that will land with any audit committee in the world, it is that one. Orphaned agents with production access are the modern equivalent of the leaver whose badge still opens the building, except the badge also has the keys to the safe and works at three in the morning.

What to actually put in the audit programme

I am wary of framework worship, so let me keep this practical. If I were scoping an agentic AI engagement tomorrow, these are the areas I would want covered, roughly in order of how much trouble they cause when absent.

Inventory and ownership. Is there a register of agents in production, and does every entry name an accountable human owner who still works here? If the answer is no, everything below this line is theoretical.

Identity and permission scoping. Are agents provisioned as governed non-human identities with least privilege, or did somebody grant broad access once to make the pilot work and never revisit it? Overprovisioning to avoid operational failure is the single most common pattern I see, and it is almost always invisible until something goes wrong.

Action boundaries and human thresholds. Which actions can the agent take autonomously, and which force a human decision? Is that boundary written down and enforced technically, or does it live in a slide deck?

The trace. Can you reconstruct, after the fact, what the agent did, what it was working from, and why it chose that path? An action log that records the outcome but not the reasoning chain is not enough for assurance work. This is where I would push hardest, because trace design is cheap before deployment and nearly impossible to retrofit.

Pre-release evaluation. Was the agent tested against adversarial and edge-case scenarios before it touched production, and does that evidence exist in a form an auditor can examine?

Drift and runtime monitoring. Models change, data changes, and prompt injection is a real attack path when agents read untrusted content. Who is watching, and against what baseline?

Third-party agents. An agent you did not build carries third-party risk, and your existing vendor framework already tells you what to do. Extend it now rather than after the first incident involving somebody else's agent inside your environment.

Offboarding. Add agents to the leaver process. Not eventually. Now.

None of this requires a new methodology. It requires applying an existing one to a population most organisations have not yet admitted is a population.

Audit is not a spectator here

The uncomfortable symmetry is that the audit profession is adopting agents at least as fast as the businesses it audits.

The large firms have moved agentic AI into their assurance platforms, and the IIA has been running practitioner sessions on preparing for it. The direction of travel across the profession is not in question. Within a few years, drafting working paper conclusions, cross-referencing prior-period findings, running full-population tests, and assembling reports will be substantially agent-assisted.

This is good news for small functions, and I say that as someone who has run undersized teams against oversized estates. Agents genuinely change the economics of coverage. Full-population testing stops being a special project and becomes the default. Continuous monitoring stops being aspirational.

But it creates two problems the profession needs to be honest about.

The first is evidence provenance inside our own files. If an agent drafted a conclusion and an auditor accepted it, the working paper needs to show that clearly. Not because agent-assisted work is inferior, but because the reviewer, the quality assessor, and eventually the external assessor need to know where human judgement was actually applied. A working paper that hides the seam between machine assembly and human conclusion is a quality failure waiting to be found.

The second is skill atrophy, and I have no clean answer to it. If junior auditors never build a test from scratch because the agent builds it, where does professional scepticism come from in ten years? Scepticism is not a personality trait. It is a habit built by doing the work and being wrong a few times. I do not know how we preserve that at scale, and I am suspicious of anyone who claims they do.

What does not change

For all the disruption, the fundamentals hold, and holding onto them is the profession's actual contribution here.

Independence still means audit advises on AI governance and does not design it. This gets tested early, because the people building agent frameworks will want the auditors in the room, and being useful in that room is right up to the point where you start owning the control you will later examine.

Evidence standards still apply. Sufficient, reliable, relevant. An agent's output is not evidence because it sounded confident.

And risk-based judgement still decides where the effort goes. Not every agent deserves an engagement. An agent that reformats meeting notes and an agent that moves money are different risk objects, and treating them the same is how small functions waste the little capacity they have.

The IIA's framework already gives functions a serviceable starting point for AI assurance, and the Global Internal Audit Standards that took effect on 9 January 2025 are perfectly capable of governing this work. The Cybersecurity Topical Requirement became mandatory on 6 February 2026 and covers a good deal of the ground. We do not need a new profession. We need this one to move faster than it is comfortable moving.

Where I would start on Monday

If your function has no agent coverage at all, do not begin with an audit. Begin with an advisory conversation and a list.

Ask three questions of your CIO and CISO: how many agents are running in production, who owns each one, and what is the largest single action any of them can take without a human. Write down the answers. Then write down how long it took anyone to find them.

In my experience the time it takes an organisation to answer those questions tells you more about its actual readiness than any maturity model will.

The sector I have spent most of my career in, humanitarian and development work, carries an additional weight here. When the data belongs to displaced people, refugees, or families in fragile settings, an ungoverned autonomous system is not an efficiency problem. It is a protection problem. The people in those records cannot switch providers, escalate a complaint, or opt out. That asymmetry is exactly why assurance exists, and it is why I would rather this profession arrive early and slightly awkward than late and correct.

The agents are already inside. The only open question is whether anybody can account for what they did.

Frequently asked questions

What is an AI agent in an internal audit context?

An AI agent is software that can plan and execute actions across systems autonomously, rather than only generating output for a human to use. In control terms it functions as a non-human actor with credentials and permissions, which makes it an auditable entity rather than a feature.

Why can't internal audit test AI agents the same way it tests traditional controls?

Traditional control testing relies on determinism: the same input produces the same output, so a sample supports a conclusion about the population. Agents are non-deterministic and may take different valid paths on identical inputs. Assurance therefore shifts to testing the agent's operating envelope, permissions, escalation thresholds, audit trail, and monitoring.

What are the biggest AI agent risks internal audit should prioritise?

Orphaned agents whose human owner has left while credentials stay active, overprovisioned permissions granted during pilots and never revisited, incomplete audit trails that record outcomes but not reasoning, absent pre-release evaluation evidence, prompt injection through untrusted content, and third-party agents operating inside the estate outside vendor risk processes.

Which standards and frameworks apply to auditing AI agents?

The IIA Global Internal Audit Standards, effective 9 January 2025, govern the engagement itself, with the Cybersecurity Topical Requirement mandatory for in-scope assurance work since 6 February 2026. For the subject matter, the IIA's Artificial Intelligence Auditing Framework, the NIST AI Risk Management Framework, and ISO/IEC 42001 provide usable criteria.

Should internal audit use AI agents in its own work?

Yes, with two safeguards. Working papers must show clearly where agent assistance ended and human judgement began, so reviewers and external quality assessors can locate the seam. And functions need a deliberate plan for developing professional scepticism in junior staff whose routine work is increasingly automated.

How should an internal audit function start auditing AI agents?

Begin with an advisory review rather than an assurance engagement. Establish an inventory of production agents, a named accountable owner for each, and a documented boundary of actions permitted without human approval. How quickly the organisation can answer those questions is itself a maturity signal.

---

*Shahzad Asghar is a senior technology, security and risk leader with more than twenty years across United Nations and humanitarian organisations, spanning country, regional and headquarters operations. He authored a country operation's first ISO 27001-aligned cybersecurity audit, has governed inter-agency data sharing agreements at scale, and currently applies the NIST AI Risk Management Framework and ISO/IEC 42001 to live AI systems. He holds CISA, CISM and CISSP, and is a member of ISACA. He writes on information technology audit in the age of AI, AI governance, AI security, and assurance for the public sector at shahzadasghar.com.*

← All articles