On September 17, 2026, SiliconANGLE reported from Workiva's Amplify conference on what it called a new audit assurance gap around AI agents working in platforms such as NetSuite. Josh Robinson, chief audit executive at Vast Space, described the shift in plain terms. When people did the work, auditors could see judgment at play through handwritten notes, emails or Slack messages. When an agent does it, that trail has been "removed from the equation." The article's conclusion was refreshingly practical: the answer is not a new category of tool but familiar audit discipline, meaning completeness and accuracy testing, applied to agent workflows.
That conclusion is right, and it deserves to be made concrete. The ERP will still tell you that a journal was posted, a reconciliation matched or an approval was recorded, under which identity and at what time. What it usually cannot tell you is which data the agent read, which rule, prompt or model version made the call, which control the action was meant to satisfy, and who approved it on what basis. A conventional audit trail records transactions. An agent-era audit trail must also record decisions.
Crest.Digital's Agentic Risk & Continuous Assurance practice builds the evidence chain around the AI agents you already run, so every material agent decision arrives in the audit file with its data, basis, approval and outcome attached.
Explore Agentic GRCWhy the Conventional Audit Trail Was Not Built for Agents
Traditional automation is deterministic: the same input produces the same output, so auditors test the logic once, confirm change control, and sample transactions. Human judgment is not deterministic, but it leaves residue. A reviewer's email, a marked-up schedule or a chat thread lets an auditor reconstruct why an exception was accepted. AI agents sit awkwardly between the two. They choose their own sequence of steps at run time, their outputs can vary between runs, and the residue that people leave behind rarely exists unless someone designs it in.
Three specific breaks follow. First, the decision basis is invisible: the log shows the outcome but not the criteria. Second, the data context moves: an agent may have read a version of a record, spreadsheet or policy that has since changed, and without a snapshot nobody can re-perform the decision. Third, identity blurs: if several agents and integrations share one service account, the log cannot say which agent acted, which is the same weakness we examined in our piece on agent identity and access governance. Our earlier article on why AI agents need audit trails made the accountability case; this one focuses on what the auditor actually tests.
Completeness and Accuracy: The Old Discipline That Still Applies
Auditors do not need to invent a new method. The PCAOB's audit evidence standard, AS 1105, expects auditors to test the accuracy and completeness of information produced by the company when they use it as evidence. The IIA's Global Internal Audit Standards expect internal audit to evaluate whether controls are designed and operating, and COSO's Internal Control–Integrated Framework has long treated documented, testable control operation as the basis for reliance. Agents change the object being tested, not the principle.
Applied to an agent, completeness asks whether it processed the whole population in scope, every invoice, every vendor-bank change, every journal above threshold, rather than the subset a retrieval limit or a truncated context happened to return. Accuracy asks whether it applied the rule correctly to what it processed. Agents add a failure mode conventional automation lacked: they can fail quietly, producing a plausible but wrong answer with no error raised. That is why the discipline must be paired with evidence captured at the moment of decision, not reconstructed months later.
The Eight-Link Evidence Chain for Any Agent Decision
Crest.Digital frames the answer as a chain: Input, Data Used, Decision Basis, Control Tested, Approval, Action, Timestamp, Evidence. If any link is missing, the auditor is left to take the agent's word for what happened, which is exactly the reliance internal audit exists to avoid.
Input
The event, request or document that triggered the run, with its source and time. Without it, you cannot tell whether the agent acted on a legitimate trigger or on something it should have ignored.
Data Used
The exact records, file versions and external sources the agent read, captured as a snapshot or hash, plus confirmation that the full in-scope population was retrieved rather than a truncated subset.
Decision Basis
The rule, policy, prompt and model version applied, with a structured summary of the criteria and confidence behind the outcome. This is the link most enterprises cannot produce today.
Control Tested
The control the action was meant to perform or rely on, mapped to a risk and control matrix ID so every agent decision sits inside a control the audit team already recognises.
Approval
Who, or which threshold gate, authorised the action, in what role, and on what information. Includes proof the approver had authority and was independent of the initiator.
Action
The precise write to the system of record, with before-and-after values, executed under a distinct agent identity rather than a shared service account.
Timestamp
An ordered, synchronised time sequence across every system touched, so the run can be reconstructed and period cut-off can be tested.
Evidence
A retained, immutable package that links the first seven elements to the transaction and can be retrieved by internal audit or the external auditor without asking the builder.
Most finance teams can already produce the sixth and seventh links, because the ERP records the action and the time. The gap usually sits in the second, third and fourth: the data used, the decision basis and the control being tested. A useful diagnostic is a walkthrough. Pick any item an agent posted last month and ask whether audit can retrieve all eight links within a working day, without calling the person who built the agent. If it cannot, the control is not yet evidenced, and the conclusion of our earlier piece on why evidence is not the same as assurance applies: activity was recorded, but reliance is not yet earned.
Executive Takeaways
- The gap is about decisions, not transactions: ERP logs show what changed; agent-era assurance needs why, on what data and under whose authority.
- Old tests still work: completeness and accuracy testing, design walkthroughs and re-performance apply directly to agent workflows.
- Capture at run time: the data snapshot, decision basis and approval must be recorded when the agent acts, not reconstructed later.
- Move from sampling to monitoring: agent behaviour varies by run, so continuous tests outperform an annual sample.
How Auditors Actually Test an Agent's Decisions
Three layers of testing make the chain auditable. The first is a design walkthrough: follow one transaction end to end and confirm every link exists and is retained. The second is operating effectiveness. Auditors re-perform the agent's logic on the same data snapshot and compare results, reconcile the population the agent should have processed with the population it did process, and examine exceptions for accuracy. The third is continuous monitoring, because an agent that behaves correctly on the sample day may not behave correctly next Tuesday. Useful monitoring rules include:
- Action without approval: a posting or change with no matching approval record inside the agreed threshold.
- Decision without a snapshot: an agent outcome with no stored data context, so it cannot be re-performed.
- Unrecorded change to the agent: a model, prompt or rule-set version change with no change ticket.
- Approver equals initiator: a segregation-of-duties conflict inside the agent workflow.
- Population shortfall: fewer items processed than the system of record shows in scope for the period.
This is where the audit model shifts from sampling to continuous assurance, and where agentic internal audit helps the auditor rather than replacing them: agents assemble the evidence, match it to control requirements and flag gaps, as described in our article on agentic evidence validation. The auditor remains the decision-maker on what is a finding. When an approval or supporting document is missing, follow-up can be automated too, including conversational chasing of control owners through Voice AI for GRC, so that exceptions close faster and the chain is completed with real evidence.
Crest.Digital's agents test agent decisions continuously across ERP, procurement, identity and document systems, and the TPRM platform extends the same intelligence to third parties whose AI touches your data and processes.
A Six-Step Playbook to Close the Agent Audit-Trail Gap
Crest.Digital delivers this as a configurable "Risk Automation Pod" rather than a bespoke software build. The reusable stack includes integration connectors, an agent orchestration layer, a workflow and approval engine, a rules and risk-scoring engine, an evidence repository, AI logs and explainability, role-based access and audit trails. The client-specific work is mainly data mapping, control logic, approvals and dashboards, applied first to the agents closest to financial reporting.
The Discover → Design → Connect → Deploy → Validate → Transfer Model
- Discover: Inventory every AI agent that reads or writes finance and audit-relevant data, the controls it performs or supports, and which of the eight evidence links each one can already produce.
- Design: Define the evidence chain per agent: the data snapshot, decision basis, approval gate and retention rules, mapped to the risk and control matrix and to named owners.
- Connect: Integrate with ERP, identity, GRC, document and ticketing systems so each link is captured automatically at run time and written to a tamper-evident record.
- Deploy: Switch on continuous tests for the highest-risk agents and route every exception to a named owner with a root-cause hypothesis.
- Validate: Re-perform sampled agent decisions, run completeness reconciliations and calibrate exception thresholds in parallel before relying on the results.
- Transfer or manage: Hand the tested monitoring set to internal audit, finance or risk to operate, or continue it as a Crest.Digital-managed service as the agent estate grows.
Human-in-the-loop governance stays in place throughout. Agents handle the repetitive capture, matching and follow-up; people decide thresholds, accept risk and sign off findings. Begin with one or two agents that already influence reconciliations, journals or vendor-master data, so the validate step gives a clear before-and-after comparison of what the audit file contains.
What CAEs and CFOs Should Ask This Quarter
Four questions turn the discussion into action. Which AI agents touch financial reporting, whether directly or by preparing inputs? For each, can we produce all eight evidence links for a sampled transaction today? Who owns each control the agent performs, and does that owner agree the agent's approval thresholds? And what happens when the agent's model, prompt or data source changes? Our analysis of AI agents in financial reporting and human approval covers the approval side, and the ten-control audit checklist for autonomous AI covers stop paths and access boundaries. ISACA's 2026 guidance on securing AI agents is a useful companion for the identity and monitoring side.
The third-party dimension deserves equal attention. Finance and procurement platforms your vendors operate increasingly embed agents of their own, and their audit trails are part of your control environment. The agentic AI capabilities on the Crest platform support due diligence questions on exactly this point, including what evidence a vendor can produce for its agents' decisions. The organizations that can answer these questions with evidence, rather than with assurances, will find the next audit cycle a confirmation rather than a scramble.
Crest Perspective
AI systems create a new category of audit trail problem: the decision log exists, but it does not show the reasoning. Traditional ERP audit trails capture who approved what and when. An AI agent’s audit trail must also capture what data the model accessed, what weights or prompts were active at decision time, and whether any human had a meaningful opportunity to intervene before the action was taken. Internal audit teams that have not yet defined what a sufficient AI audit trail looks like are already behind their own regulators.
Frequently Asked Questions
The AI agent audit assurance gap is the difference between what a conventional system log records and what an auditor needs to rely on a decision. When an AI agent reconciles, approves or remediates inside an ERP or finance platform such as NetSuite, the system usually records that a record changed, which identity changed it and when. It often does not record which data the agent read, which rule, prompt or model version drove the decision, which control the action was meant to satisfy, or who approved it and on what basis. With human staff, auditors could infer judgment from emails, notes and chat threads. With an agent, that visible residue is largely gone, so the organization must design the evidence trail deliberately. SiliconANGLE reported the theme from Workiva's Amplify conference on September 17, 2026, where a chief audit executive argued the answer is familiar discipline, namely completeness and accuracy testing applied to agent workflows, rather than a brand-new tool.
Conventional audit trails were designed around two assumptions: that transactions are created by identifiable people, and that automated workflows are deterministic, so the same input always produces the same output and the logic can be tested once. AI agents break both assumptions. They may share a service identity, they choose their own sequence of steps at run time, they read context that changes after the fact, and their outputs can vary between runs. The ERP log therefore proves that a posting happened but not why. Auditors need the decision basis, the data snapshot, the control being applied and the approval evidence linked to each transaction, which is why an agent-specific evidence chain is needed on top of the standard log.
A defensible agent audit trail links eight elements for every material decision: the input or trigger that started the run, the data the agent used, the decision basis (rule, policy, prompt and model version), the control the action was meant to perform, the approval or threshold gate that authorised it, the action taken with before-and-after values, a synchronized tamper-evident timestamp sequence, and a retained evidence package tying all of it to the transaction. The test of completeness is simple. Pick any posted item and ask whether the audit team can retrieve all eight links within a working day without asking the agent's builder to explain what happened.
Auditors can combine three techniques. A design walkthrough follows one transaction end to end and checks that all eight evidence links exist. Operating tests re-perform the agent's logic on the same data snapshot, reconcile the population the agent was meant to process against what it actually processed to test completeness, and examine exceptions for accuracy. Continuous monitoring then replaces annual sampling, because agent behaviour varies by run: rules flag actions with no matching approval, decisions with no stored data snapshot, model or prompt changes without a change record, and approver-equals-initiator conflicts. This mirrors the completeness-and-accuracy discipline already expected of information used as audit evidence under standards such as the PCAOB's AS 1105.
It can. If an AI agent performs, supports or evidences a control that is relevant to financial reporting, such as reconciliations, journal review, approvals or access reviews, then management and its auditors will expect evidence that the control operated as designed, which includes being able to show what the agent did and on what basis. COSO's Internal Control Integrated Framework, the IIA's Global Internal Audit Standards and the PCAOB's audit evidence requirements all point toward documented, testable control operation. Organizations should agree the expectations with their external auditors and legal advisers early. Crest.Digital's guidance here is operational rather than legal or accounting advice.