Auditing AI Agents: Why Skilled Internal Audits Win

Somewhere in your organization right now, a software agent is closing a task that used to have a name attached to it. It is triaging customer complaints. It is drafting a corrective action. It is watching a sensor feed and deciding whether the reading is a blip or a trend. It files a record, and the record looks exactly like the ones a human filed last year.

Then the internal auditor arrives, opens the checklist that has worked for a decade, and asks the first question: who performed this?

That is the moment the audit either gets serious or quietly becomes theater. And it is the reason ISO consulting conversations in 2026 keep circling back to the same practical problem: organizations deployed agents faster than they upgraded the audit function that has to verify them. Auditing AI agents is not a future-state discipline. It is this year’s surveillance audit.

Across 28 years and 200+ audits attended, Management Systems International (MSI) has watched a consistent pattern hold through every wave of automation: the technology never breaks the standard. What breaks is the audit program that keeps asking the old questions. This article is the practitioner’s guide to asking the new ones.

Section 1

What Does Auditing AI Agents Actually Mean?

Define. Scope. Verify.

Start with a definition of auditing AI agents tight enough to scope an audit against, because the loose version of this topic produces loose findings.

An AI agent, for management system purposes, is software that takes an input, applies a model rather than a fixed rule set, and produces an output that enters your process without a human necessarily touching it first. That last clause is the whole issue. A spreadsheet macro is deterministic and testable. A statistical process control chart is deterministic and testable. An agent that reads free-text complaints and assigns severity codes is neither, and it is making a quality decision.

So auditing AI agents is not auditing a piece of software. It is auditing a process — the same process that was always in scope — in which one of the actors is now a model. The audit criteria are unchanged. Clause 8.1 still requires operational control. Clause 7.2 still requires competence. Clause 9.1 still requires that monitoring produces valid results. What has changed is where the evidence lives and who can explain it.

The Three Categories Your Audit Program Should Separate

Not every use of AI carries equal audit weight, so auditing AI agents starts with triage rather than with fieldwork. Treating every deployment identically wastes audit hours on the trivial while under-sampling the consequential. MSI recommends internal audit programs classify agent involvement into three tiers before scoping a single engagement:

• Tier 1 — Assistive. The agent drafts, summarizes, or suggests, and a competent person reviews and owns the output before it enters the system. A drafted procedure, a summarized audit finding, a suggested root cause. Audit burden: light. The control is the human review, and the evidence is the review record.
• Tier 2 — Delegated with gates. The agent performs the work and enters the result directly, but defined conditions escalate to a human — confidence below a threshold, a value outside a band, a category flagged as high-risk. Audit burden: substantial. The control is the gate, and the evidence is the gate firing correctly and the escalations being worked.
• Tier 3 — Autonomous. The agent performs the work, enters the result, and closes it with no routine human touchpoint. Audit burden: heavy, and this is where auditing AI agents becomes genuinely difficult. The control is the design of the system itself plus retrospective monitoring, and the evidence has to be built deliberately because it will not accumulate as a by-product of anyone’s workday.

Most organizations discover during scoping that they have more Tier 3 than they believed. A tool bought as assistive gets trusted, the review step erodes, and eighteen months later nobody reads the output before it posts. That drift is itself an audit finding, and it is one of the more common ones MSI client experience surfaces during internal audit planning. Auditing AI agents therefore begins well before the opening meeting, in the scoping conversation.

Section 2

Why the Old Audit Playbook Fails on Agent-Run Processes

Interview. Trace. Reconcile.

The classical internal audit method has three moves, and auditing AI agents puts pressure on two of them: interview the person doing the work, trace a transaction end to end, and reconcile what the record says against what the process actually does. Two of those three moves assume a human at the keyboard.

The interview is the one that collapses first when auditing AI agents. An auditor asks a technician how they decide whether a deviation warrants a corrective action, and the technician’s answer — hesitant, precise, or evasive — is itself the evidence. There is no equivalent conversation with a model. You cannot ask an agent what it was thinking and treat the answer as objective evidence, because a plausible-sounding explanation generated after the fact is not a record of the decision. It is new output.

The tracing move survives, but when auditing AI agents it changes character. Tracing a transaction through an agent-run process means following an identifier through log files, model version records, prompt or configuration history, and output stores — often across systems owned by IT rather than quality. Auditors who have never requested a system log find themselves negotiating access mid-audit, which is a planning failure, not a technology failure.

Reconciliation is the move that becomes more valuable, not less. When a human runs a process, anomalously clean records are suspicious. When an agent runs it, uniform records are expected — which means the auditor loses a signal they relied on and has to replace it with statistical sampling of outcomes rather than pattern-reading of paperwork. This is why auditing AI agents tends to expose audit programs that were built around a single strong auditor’s intuition rather than a documented method.

The Accountability Question Registrars Are Already Asking

There is one question in auditing AI agents that cuts through every technical complication, and external auditors have started asking it directly: who is accountable for this output?

Management system standards have never permitted accountability to be delegated to a tool. Clause 5.3 requires that responsibilities and authorities for relevant roles are assigned and communicated. A model is not a role. Somebody — a named person with a job title — owns the agent’s output, and the internal audit has to find that person and confirm they know it. When the answer to “who owns this” is a vendor name or a department, the finding writes itself. That principle anchors auditing AI agents more firmly than any technical control could.

MSI’s broader treatment of the policy layer above this — the postures, hard rules, and executive questions that precede any deployment — is set out in its guide to AI governance for business. This article assumes that layer either exists or is about to, and concentrates on what the auditor does next.

Section 3

Which Clauses Bear the Load When Auditing AI Agents?

Competence. Control. Records.

No management system standard contains a clause titled “artificial intelligence.” That is not a gap — it is the design working as intended. The harmonized structure shared by ISO 9001, ISO 14001, ISO 45001 and ISO 7101 is deliberately technology-neutral, which is why it absorbed statistical process control, ERP systems, and cloud document management without amendment. It absorbs agents the same way. Four clauses carry most of the weight when auditing AI agents.

Clause 7.2 — Competence, Relocated

Competence requirements apply to persons doing work under the organization’s control that affects performance. When an agent performs the work, the competence requirement does not vanish — it relocates to the people who configure, monitor, and accept the agent’s output. That is a different skill profile, and most competence matrices have not been updated to name it.

The audit question when auditing AI agents is concrete: show me the competence record for the person who set the escalation threshold. If the threshold was set by a vendor default that nobody in the organization can justify, the operational control is not owned. Note that in ISO 13485 the competence obligation sits in Clause 6.2 under a pre-Annex SL structure, so integrated audit programs need to map to both numbering schemes rather than assume alignment.

Clause 7.5 — Documented Information the Agent Consumes

Here is a control failure MSI expects to see repeatedly over the next two years. An organization uploads its procedures into an agent so the agent can answer questions and generate compliant outputs. Then the procedures get revised. The agent’s knowledge base does not.

The agent is now confidently producing outputs against a superseded revision, and document control — the clause that exists specifically to prevent unintended use of obsolete documents — has been breached in a way that no document register will show. When auditing AI agents, always reconcile the current revision of the governing procedure against the revision actually loaded into the agent. It is a five-minute check and it finds real nonconformities.

Clause 8.1 — Operational Control and the Externally Provided Model

Almost nobody builds their own model. That means the agent is an externally provided process, product, or service, and the standard requires the organization to determine the type and extent of control applied to it. ISO 14001:2026 states this plainly in Clause 8.1: externally provided processes, products or services relevant to the intended outcomes shall be controlled or influenced, with the type and extent of control defined within the management system.

So the supplier evaluation file is squarely in scope. Was the AI vendor evaluated? Against what criteria? Who approved them, and what happens when the vendor silently upgrades the underlying model — which they will, and which changes your process without a change request. Auditing AI agents almost always leads back through purchasing, and integrated auditors should plan for that trail. MSI covers how far that obligation now reaches in its analysis of ISO 14001 externally provided processes.

Clause 9.1 — Monitoring That Produces Valid Results

Clause 9.1 requires the organization to determine the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results. When an agent is the monitoring instrument — classifying defects, flagging emissions excursions, scoring supplier risk — the validity of the method is a live audit question, not a formality.

The parallel that makes this land with operations teams is calibration. Nobody would accept an uncalibrated gauge on a critical dimension. An unvalidated model performing a monitoring function is the same exposure with better packaging, and the same answer applies: periodic verification against a known reference, recorded. Auditing AI agents against this clause comes down to one question — where is that verification record?

Section 4

What ISO 19011:2026 Already Says About This

Guidance. Immediate. Applicable.

The auditing guidance standard was revised and published on 27 May 2026, and the 2018 edition was withdrawn at the same moment. Because ISO 19011 is guidance rather than a requirements standard, there is no transition period and no window in which both editions remain valid. The 2026 edition is the only current reference for what a credible audit looks like.

It does not contain a section on agents, and auditing AI agents is none the worse for that. MSI’s full read of the ISO 19011:2026 changes covers the six themes the revision actually moved. What it does contain is a strengthened treatment of technology in auditing that maps onto this problem more usefully than a bespoke AI clause would have:

• Evidence reliability. Auditors are expected to consider whether evidence obtained through technology is reliable and complete. A log export is evidence; a log export from a system whose retention policy purges at 30 days when your audit covers 12 months is incomplete evidence, and the auditor is expected to notice.
• Method selection. The choice of on-site, remote, or hybrid method is a documented decision. Agent-run processes push audits toward data-driven remote methods, and that choice should be recorded rather than defaulted into.
• Auditor competence with the technology. Auditors need competence in the platforms they audit through. An auditor who cannot read a system log cannot audit a Tier 3 process, and pretending otherwise produces a clean report with no assurance behind it.
• Data security and confidentiality. Pulling model inputs and outputs into an audit file has confidentiality implications, particularly where customer data or personal data is in the payload.
• Risk-based program inputs. Technology change is an explicit input to audit program risk. Deploying an agent into a core process is a re-planning trigger, not something to pick up at the next annual cycle.

The Distinction Being Misreported Right Now

One point deserves stating plainly, because it is currently being reported inaccurately in the trade press. ISO 19011:2026 addresses artificial intelligence and digital technology as tools the auditor uses — remote and hybrid methods, digital evidence, electronic records, data analytics applied during audit planning. It does not set out how to audit a process the auditee has handed to a model. Those are opposite directions of travel, and claims that the new edition requires auditors to systematically evaluate how companies deploy AI overstate what a guidance document can do. ISO 19011 contains no requirements at all; nobody certifies to it.

That gap is real, and it is precisely why this article exists. What the five points above give an audit program is a defensible method by extension rather than by citation: the expectations the standard sets for evidence obtained through technology apply just as coherently to evidence generated by it. So auditing AI agents under current guidance is a legitimate reading of ISO 19011:2026, not an invention — and none of it requires an organization to wait for a new standard. MSI translated the same edition into concrete document edits in its walkthrough of the ISO 19011:2026 internal audit procedure, and into scoring mechanics in its work on the internal audit risk matrix.

Where ISO/IEC 42001 Fits — and Where It Does Not

Readers researching this topic will encounter ISO/IEC 42001, the AI management system standard, alongside the NIST AI Risk Management Framework and the EU AI Act. All three are useful reference material for designing controls around an agent. To be explicit: MSI does not implement ISO 42001 in consulting engagements — it is cited here as a reference framework only, and the audit work described in this article is performed against the management system an organization already holds.

That distinction matters practically for anyone scoping auditing AI agents for the first time. An organization does not need to certify an AI management system to audit an agent inside its quality or environmental system. It needs the audit program it already runs, pointed at the right evidence, staffed by auditors who know what to ask for.

Section 5

The Eight Evidence Artifacts to Request Before Fieldwork

Request. Sample. Reconcile.

This is the operational heart of auditing AI agents. An auditor walking into an agent-run process with a generic checklist will produce a generic report. An auditor who requested these eight artifacts during planning will produce findings leadership acts on.

1. The Process Map Showing Where the Agent Sits

Before anything else in auditing AI agents, establish the boundary. Which steps does the agent perform, which does it merely inform, and where does the output cross into a controlled record? Organizations routinely cannot answer this on the first ask, and that inability is a finding against operational planning and control. A process map that predates the deployment and was never updated is worse than none, because it misdirects the audit.

2. The Named Output Owner

A person, not a department. Ask them directly whether they know they own it. In MSI’s experience across 200+ audits attended, the gap between the person the org chart names and the person who believes they are accountable is the single most reliable indicator of whether a control is real. When the named owner is surprised, the control does not exist regardless of what the procedure says.

3. The Governing Procedure and Its Current Revision

The procedure that describes how the process runs should describe the agent. If it describes a person performing steps the agent now performs, the documented information no longer reflects the process, and the organization is running an undocumented process while holding a document that says otherwise. Well-built procedures anticipate this by naming decision points and control gates rather than job titles — which is exactly why procedure design quality determines how gracefully a management system absorbs automation.

4. The Knowledge Base the Agent Actually Runs On

Ask to see the documents loaded into the agent and the date they were loaded. Then compare against the document register. This single reconciliation has, in MSI’s observation, the highest hit rate of any test in this list. Revision drift between the controlled document and the agent’s copy is common, invisible, and directly auditable. Of every test in auditing AI agents, this one earns its place first.

5. The Escalation Thresholds and Their Justification

Every Tier 2 deployment has thresholds — a confidence score, a value band, a category list. Ask what the threshold is, who set it, and on what basis. “It came that way” is a nonconformity against operational control, because the organization has adopted an operating criterion it did not determine. Thresholds should be traceable to risk, which links this directly to the risk criteria in the organization’s risk management procedure.

6. The Escalation Log With Worked Outcomes

A gate that never fires is either perfectly tuned or broken, and those look identical from the outside. Pull the escalation log. Zero escalations over a busy quarter is a red flag, not a success metric. Then check what happened to the ones that did fire — escalations that sit in a queue unworked mean the gate is decorative. Auditing AI agents means treating a silent gate as a question, never as a result.

7. The Model and Version Change History

Vendors update models. Those updates change process behavior without any internal change request, which is precisely the scenario the planning-of-changes requirement exists to catch. ISO 14001:2026 added a standalone planning-of-changes clause at 6.3, and ISO 9001 has carried a comparable obligation since 2015. Ask when the model last changed and what the organization did about it. MSI covers the mechanics of controlling this class of change in its work on change management automation.

8. Periodic Verification Against a Known Reference

The calibration analogue. Does the organization periodically take a sample of agent outputs and have a competent person independently assess them? What was the agreement rate? What happened when it dropped? If no such record exists, the organization cannot demonstrate that its monitoring method produces valid results, and that is a clean, defensible finding against Clause 9.1. It is also the finding that changes behavior fastest, which is why auditing AI agents should reach for it early.

Eight artifacts, requested during planning rather than discovered during fieldwork. That sequencing is what separates a productive engagement from a frustrating one, and it is why auditing AI agents rewards audit programs with disciplined planning far more than it rewards technical sophistication.

Section 6

Where Does the Human Signature Have to Stay?

Decide. Approve. Own.

Organizations ask this question in reverse — what can we automate? — and it produces sprawling debates. The auditable version is narrower and far more useful: which approvals does the management system require a competent person to make, such that a model cannot make them regardless of how good it gets?

Reading the standards strictly, several decisions are reserved by structure rather than by preference:

• Approval of documented information for suitability and adequacy. The clause requires review and approval. An agent may draft; a competent person approves. Records of that approval are the evidence.
• Determination of significance. Whether an environmental aspect is significant, whether a risk is acceptable, whether a nonconformity is systemic — these are organizational judgments made against criteria the organization itself established. An agent can apply criteria; it cannot own the decision that the criteria are right.
• Acceptance of corrective action effectiveness. Reviewing whether corrective action worked is an explicit requirement, and it is a judgment about whether reality changed — not a text comparison.
• Release decisions with safety or regulatory consequence. Product release, environmental compliance determinations, and anything with a named regulatory obligation behind it. The regulator will ask who released it.
• Management review conclusions. Top management concludes on continuing suitability, adequacy and effectiveness. That is a leadership act, and it is not delegable to software.

The pattern is consistent: agents are strong at generating candidate answers and weak at owning consequences. A management system is a machine for assigning consequences to named people. That is why auditing AI agents keeps returning to the same three questions — who decided, on what criteria, and what evidence shows they applied it.

The Rubber-Stamp Problem

A human approval step only functions as a control if the human is actually exercising judgment. When an agent produces high-quality output ninety-eight times in a row, the reviewer’s attention decays — a well-documented human factors effect that predates AI by decades and shows up in every automated inspection line ever installed.

Auditors should test this rather than accept the signature, because auditing AI agents means verifying that the human control fired — not that it exists on paper. Pull a sample of approved outputs and check whether the approver ever rejected anything. A hundred percent approval rate over a long period is evidence that the review became a rubber stamp. Then check timestamps: approvals occurring seconds after generation, in batches, tell the same story more bluntly.

Section 7

How Do You Interview People When the Agent Did the Work?

Ask. Listen. Probe.

The interview does not disappear from auditing AI agents. It moves to a different set of people and a different set of questions. There are four humans around every agent worth talking to, and each one holds a distinct piece of the evidence.

The Configurer

Ask what they changed most recently and why. Ask how the change was authorized and where it is recorded. Ask what would happen if they left tomorrow — whether anyone else can maintain the configuration. Single-person dependency on an undocumented configuration is a resource and competence finding in one.

The Reviewer

Ask for the last time they rejected an output and what was wrong with it. A reviewer who cannot recall a rejection is describing a rubber stamp, whatever the procedure claims. Ask what they look for and how long a review takes them. Then compare that answer to the timestamps.

The Downstream Recipient

The most underused interview in auditing AI agents, by a wide margin. Ask the person who receives the agent’s output whether they trust it, and whether they have built a private workaround. Shadow spreadsheets, informal double-checks, and quiet re-work are the clearest possible signal that the process is not performing as documented — and they never appear in any log.

The Process Owner

Ask how they know the agent is performing. If the answer is that complaints would surface a problem, the process has no monitoring — it has a customer-funded detection system. Ask what indicator they watch and where it is reported. This connects straight to internal audit program design and to the performance data that feeds leadership review, and it is where auditing AI agents stops being a technology exercise and becomes a management one.

Four interviews, four distinct evidence types, none of which requires the auditor to understand model architecture. This is the reassurance experienced auditors need: auditing AI agents is an extension of audit skill, not a replacement of it. The auditor who is good at finding the gap between the documented process and the real one is exactly the auditor this work needs.

Section 8

What Changes When ISO 9001:2026 Publishes on September 16?

Prepare. Align. Transition.

ISO 9001:2026 is scheduled to publish on 16 September 2026, following the close of the FDIS ballot on 9 July 2026. For organizations running agents inside quality processes, the practical question is whether the new edition changes anything about how those processes get audited.

The honest answer is that the fundamentals do not change, and that is the useful news. The revision brings ISO 9001 into the current harmonized structure, aligning it with the language already published in ISO 14001:2026 — a sequencing question MSI works through in its guide to the ISO 9001 and 14001 transition. Organizations should expect continuity in the clauses that govern this work — competence, documented information, operational control, monitoring — with sharpened wording rather than new obligations aimed at automation.

What that means for an internal audit program is straightforward. Do not wait for September to start auditing AI agents. The clauses you will audit against in 2027 are, in substance, the clauses you can audit against today. An audit program that builds this competence now enters the transition with a working method instead of a scramble. MSI’s broader read on sequencing the transitions sits in its analysis of ISO 9001:2026 for boardrooms.

A Note on Regulated Sectors

Medical device organizations carry an additional layer. Software that participates in a quality system process falls under software validation expectations, and the FDA has published extensive guidance on artificial intelligence in medical device software. With the FDA Quality Management System Regulation effective 2 February 2026 and aligning US requirements more closely with ISO 13485, device manufacturers should treat agent deployment as a validated-software question in addition to a management system question. The underlying regulation text is available through eCFR Part 820.

Section 9

Auditing AI Agents Inside an ISO 14001:2026 System

Monitor. Evaluate. Evidence.

Environmental management systems are, in practice, ahead of quality systems on this problem — because environmental monitoring was instrumented first. Continuous emissions monitoring, energy dashboards, water quality telemetry, and waste tracking platforms all now ship with analytics layers that classify, predict, and alert. EHS managers have been living with algorithmic monitoring for years without necessarily calling it AI, and the 2026 edition raised the bar on what that monitoring has to prove — see MSI’s guides to ISO 14001:2026 Clause 4.1 and ISO 14001 environmental conditions. Auditing AI agents in an environmental system is therefore less a new discipline than an overdue naming of an existing one.

ISO 14001:2026, published 15 April 2026 with a transition deadline of 30 April 2029, tightens several requirements that bear directly on this. Clause 9.1.1 now requires the organization to determine the criteria against which it will evaluate its environmental performance, and appropriate indicators, and to ensure that calibrated or verified monitoring and measurement equipment is used and maintained. Clause 9.1.2 requires processes to evaluate whether compliance obligations are being met and to maintain knowledge and understanding of compliance status.

That phrase — maintain knowledge and understanding of compliance status — is the one to sit with. An organization whose compliance status is only known to a dashboard has not maintained knowledge and understanding. It has outsourced it. When auditing AI agents in an environmental system, that clause is the sharpest available test, and it is a fair one.

The Audit Objectives Requirement Reaches Agent-Run Processes Too

ISO 14001:2026 Clause 9.2.2 now requires the organization to define the audit objectives, audit criteria and scope for each audit — a genuinely new obligation, and one that reaches quality and safety audits in any organization running an integrated program. For agent-run processes this is a gift rather than a burden, and a per-audit objective is the cheapest available discipline in auditing AI agents. A per-audit objective forces the auditor to state what the audit is trying to establish, which is exactly the discipline that prevents an agent audit from drifting into an unfocused technology review.

A well-formed objective for this work reads something like: to determine whether the automated emissions classification process operates under defined criteria, escalates as designed, and produces results the organization has verified. That sentence scopes the engagement, sets the evidence list, and tells the auditee what to prepare.

Section 10

How Should Agent Performance Reach Management Review?

Report. Conclude. Decide.

Management review is a required input-and-output process across ISO 9001, ISO 13485, ISO 14001 and ISO 45001, and it is where an organization’s use of agents either becomes governed or stays invisible to leadership. Internal audit results are a mandatory input to every one of those reviews. If auditing AI agents produced findings and those findings never surfaced at the review table, the audit was an exercise.

Four things belong in the review pack once auditing AI agents has been done properly:

• Verification agreement rate over time. The percentage of sampled agent outputs a competent reviewer agreed with, trended across periods. A declining trend is a leading indicator; a complaint is a lagging one.
• Escalation volume and disposition. How often the gate fired, and what happened to those cases. Sudden drops usually mean a configuration change nobody logged.
• Model or version changes during the period. Every change the vendor made, and the organization’s assessment of impact. This is the planning-of-changes evidence in reportable form.
• Nonconformities where an agent was in the causal chain. Not to assign blame, but because a pattern across two or three of these is a systemic signal that operational control needs redesign.

ISO 14001:2026 restructured Clause 9.3 into general, inputs, and results, and requires an explicit conclusion on continuing suitability, adequacy and effectiveness as a stated result. Applied here, that means top management has to conclude, in writing, whether a management system in which agents perform work remains effective. That is the governance moment, and it cannot happen without the data above. MSI’s treatment of the review itself is set out in its ISO Management Review Toolkits and in its guide to management review benefits.

Section 11

Six Failure Modes to Watch For

Spot. Name. Correct.

These are the recurring patterns MSI expects internal auditors to encounter when auditing AI agents as deployment spreads through regulated industries. Each one is auditable, each one has a clean clause reference, and each one is correctable before a registrar finds it.

1. Shadow Deployment

Individual employees using consumer AI tools on quality-affecting work with no organizational authorization. Procedures drafted in a chat window and pasted into the document system. Complaint responses generated and sent. Nobody approved it because nobody was asked. The audit approach is to ask people directly and without accusation what tools they use; the answers are usually freely given, because the employees do not perceive it as a violation. Shadow deployment is the first thing auditing AI agents should look for, precisely because nobody scoped it.

2. The Vanishing Review Step

A Tier 1 assistive deployment that silently became Tier 3. The review was real in month one, perfunctory by month six, and absent by month twelve, with no change to the procedure at any point. Timestamps and rejection rates find this reliably.

3. Knowledge Base Revision Drift

Covered above, and worth restating because of how often it appears. The controlled document was revised; the agent’s copy was not. Every output since is built on a superseded revision. This is a straightforward documented information nonconformity with a five-minute test.

4. Silent Model Substitution

The vendor upgraded the underlying model. Process behavior changed. No change request exists because no internal actor made a change. This is the clearest case for treating the AI provider as an external provider under Clause 8.1, with contractual notification of material changes as a defined control.

5. Metric Theater

The organization reports agent performance using vendor-supplied metrics — uptime, tickets processed, hours saved — none of which measure whether the outputs were correct. Efficiency metrics are not quality metrics, and an audit should say so plainly. Auditing AI agents means asking for the correctness measure, not the throughput one.

6. Competence Records Frozen in Time

The competence matrix still describes the role as it existed before the agent arrived. The person now supervising an automated process is qualified on the manual one. Nothing in the record acknowledges that the job changed, which means the organization has not determined the necessary competence for the work as it is currently performed.

Six patterns, all of them findable with conventional audit technique. What auditing AI agents demands is not new tooling — it is an auditor who knows these patterns exist and plans the engagement to look for them.

Section 12

Why Expert Internal Auditors Matter More, Not Less

Judge. Challenge. Improve.

There is a version of this story where AI eliminates the internal audit function. It is a tempting narrative and it gets the causality backwards.

Consider what an internal auditor actually provides. Not detection of individual errors — software is better at that. What the auditor provides is independent judgment about whether the system as a whole is doing what the organization intends. Independence, in the Clause 9.2 sense, means freedom from responsibility for the activity being audited and freedom from bias and conflict of interest. A model trained on the organization’s own historical data is, by construction, not independent of the organization’s historical assumptions. It will reproduce them confidently.

That is the durable case for the expert internal auditor, and it is why organizations investing in agents should be investing in the competence to perform auditing AI agents at the same time. The two are not alternatives. Engaging experienced ISO consulting support during that build-out shortens the learning curve considerably, because the method transfers faster than it develops.

A Practical Starting Sequence

For an audit program with no agent-specific method today, this is the order MSI recommends:

1. Inventory. Ask every process owner what AI-based tools touch their process. Do not assume IT has the list; shadow deployment means they do not.
2. Tier. Classify each as assistive, delegated with gates, or autonomous.
3. Re-plan. Feed the inventory into the audit program as a technology-change risk input and re-score affected processes.
4. Build the checksheet. Turn the eight artifacts into standing audit questions.
5. Update competence. Name log reading and evidence-reliability assessment in the auditor competence criteria, and train to it.
6. Report upward. Put the four data items into the next management review pack.

Public-sector audit functions carry an additional layer of federal internal-control expectation on top of this sequence; MSI addresses that overlay separately in its work on government internal audit.

Six steps, none of which requires new software or a new certification. Most organizations can complete the first three inside a month. Auditing AI agents is, in the end, ordinary audit discipline applied to an unfamiliar actor — and the organizations that treat it that way will be the ones whose registrars find nothing surprising.

Frequently Asked Questions

Auditing AI Agents: Common Questions Answered

Ask. Answer. Apply.

Do we need ISO 42001 before auditing AI agents?

Can an AI agent conduct our internal audits for us?

What if our auditors have no technical background?

How do we handle a vendor who will not share how the model works?

Does ISO 9001:2026 add AI requirements?

What is the single highest-yield test to run first?