What boards, audit committees and auditors should require before an AI agent is allowed to act on the company’s systems and money
Every control environment in a well-run company rests on a simple idea: a named person does each task, within limits someone approved, and leaves a record that someone else can check. The accounts payable clerk can enter an invoice but cannot approve it. The finance manager can approve a payment but cannot change a supplier’s bank details. The auditor can pick any transaction and ask who did it, on whose authority, and why.
AI agents break that idea quietly. An agent is not a chatbot that answers a question; it is software that plans a task and carries it out, step by step, using the company’s systems. It can read an email, update a record, approve a match, schedule a payment and file the result. It often works under the login of the person who set it up. It does in a minute what used to take a team a morning, and it may leave no record of why it did any of it.
This ninth article of Hours Into Earnings™ is about the condition every AI agent must meet before it is trusted with real work. Its argument is short. An agent you cannot audit is not an efficiency. It is a liability that has not yet been recognized. The good news is that the controls an agent needs are not new. They are the same controls the company already applies to people, written down for a new kind of worker.
Agents are arriving faster than the controls
Agents are moving from experiments into everyday work. Gartner expects that by 2028, 15% of routine day-to-day work decisions will be made by AI agents without a person directing them, and that a third of enterprise software applications will include agent capabilities.
The controls have not kept pace. In a 2025 survey of 353 IT professionals by SailPoint, an identity security company, 80% of organizations said their AI agents had already taken actions they did not intend. About four in ten said agents had reached systems they should not have, 31% said agents had shared sensitive data such as financial information inappropriately, and 23% said an agent had been tricked into revealing access credentials. Like other vendor surveys, these figures should be read with care, but they describe failures every auditor will recognize.
The cost of weak control is already visible. Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear business value and inadequate risk controls. Some of those projects will fail on cost or value. Others will be stopped because nobody could show the board, the auditors or a regulator that the agent was under control.
The professions that oversee companies are responding. The Institute of Internal Auditors has published an artificial intelligence auditing framework for its members, and ISO/IEC 42001, the first international standard for AI management systems, now gives companies a structure that can be independently certified. Neither tells a board exactly what to require of a particular agent. That is the gap this article fills.
What makes an agent unauditable
An auditor faced with an agent asks the same questions as for any person or process. An agent becomes unauditable when those questions cannot be answered. Five failures are common.
It borrows someone’s identity. The simplest way to set up an agent is to give it the login of the person who built it. From that moment the system records the agent’s actions as that person’s. Nobody can tell which payments a clerk approved and which the agent approved, and the clerk may not know either.
Its authority is not written down. People have job descriptions, approval limits and segregation of duties. Agents are often given whatever access was convenient during the pilot, which may include the power both to change supplier records and to pay suppliers: the classic combination auditors look for in fraud.
It leaves no trail. A person who approves a payment leaves a signature and a reason. An agent may update a record with no note of what information it relied on or why it acted. When something goes wrong, there is nothing to reconstruct.
It cannot be stopped. An agent running in a loop, or one that has been manipulated by a fraudulent email, can repeat a mistake hundreds of times before anyone notices. Without limits on what it can do alone, and a way to switch it off immediately, the damage is bounded only by the size of the bank balance.
Nobody checks its work. Agents are often treated as finished once they are live. But their behaviour can drift as the data, the instructions or the underlying model change. Without regular independent testing, a working agent can become a faulty one without anyone noticing.
Each of these failures has a consequence beyond the immediate loss. External auditors who cannot rely on controls must test more transactions, which costs time and fees. A qualified internal control report can concern lenders and regulators. And an insurer may question a claim for a loss caused by a process the company could not show it controlled.
The Agent Licence Test™: five conditions before an agent acts alone
A person cannot drive a company vehicle until they hold a licence. The Agent Licence Test™ applies the same principle to AI agents within The Dawgen Earnings Crossing™: an agent may act on the company’s systems or money only when it meets five conditions, each supported by evidence an auditor can inspect. An agent that fails any condition may still assist people, but it does not act alone.
| Condition | What it means | The evidence an auditor asks for |
| 1. Identity | The agent has its own credentials and a named human owner accountable for it | A dedicated agent account, never a borrowed login; the owner recorded in the AI register |
| 2. Mandate | The agent may do only what is written down, within limits, and incompatible duties are kept apart | A written mandate stating permitted actions, J$ limits and the systems it may touch; access rights that match it |
| 3. Trail | Every action is logged with the information the agent used and the reason it acted | A complete, retained, tamper-evident log that links each action to its inputs and approvals |
| 4. Brake | People approve actions above set thresholds, the agent stops after a set number of steps, and it can be switched off at once | Approval thresholds in the system, step limits, a tested kill switch |
| 5. Review | The agent’s work is tested independently, on a schedule, and exceptions are reported | Sample testing by internal audit or an independent reviewer; monthly exception reports to the owner |
Three principles make the test practical rather than bureaucratic.
Licence the action, not the technology. An agent that drafts replies for a person to send needs a lighter licence than one that releases payments. The conditions are the same; the thresholds and the depth of review scale with what the agent can do.
Licences can be revoked. If an agent’s exception rate rises, its owner leaves or its underlying model changes, its licence is reviewed, just as a person’s access is reviewed when their role changes.
The licence lives in the AI register. Every licensed agent appears in the same register the Price Chip Review™ asks for in Article 7, with its owner, mandate, thresholds and last review date. The board can see at a glance what agents the company runs and what they are allowed to do.
The arithmetic: one agent, one J$40 million saving, two very different years
Consider an illustrative composite: a Caribbean manufacturer and distributor that pays about 4,000 supplier invoices a month. It introduces an AI agent in accounts payable that reads invoices arriving by email, matches them to purchase orders and goods received, schedules payments and keeps supplier records up to date. The agent does the work of several clerks and saves about J$40 million a year.
Without the licence. To move quickly, the agent is set up under the payables supervisor’s login. It inherits all her access, including the power to change supplier bank details and to release payments. Its instructions say to keep supplier records current from supplier correspondence. In the seventh month, a convincing email arrives, apparently from a long-standing packaging supplier, giving new bank details. The agent updates the record and, over the following two weeks, pays three invoices to the new account. J$18.6 million is gone before the real supplier calls to ask why it has not been paid.
The costs do not stop there. The investigation and recovery effort costs about J$2.5 million. The external auditors, unable to tell which payments were approved by a person and which by the agent, cannot rely on the payables controls and extend their testing, adding about J$4 million to the year’s audit and finance time. The agent’s first-year value of J$40 million shrinks to J$14.9 million, and the audit committee asks the question in this article’s card: who approved it?
With the licence. The same agent, licensed under the Agent Licence Test™ before going live, runs differently.
| Condition | How it was met |
| Identity | A dedicated agent account, owned by the financial controller |
| Mandate | The agent may match invoices and propose payments. It may not change supplier bank details; it flags requested changes for a person to verify by calling the supplier on a number already on file |
| Trail | Every match, proposal and flag is logged with the documents the agent relied on |
| Brake | Payments above J$2 million, and any payment to an account changed in the last 90 days, need a person’s approval; the agent stops after ten steps on any one invoice |
| Review | Internal audit tests a sample of the agent’s work each month and reviews all exceptions |
The same fraudulent email arrives. The agent flags the bank-detail change, the supervisor calls the supplier, and the fraud fails. The agent still handles more than nine in ten invoices without a person, so the saving remains J$40 million. Human approvals and monthly review cost about J$3 million a year, and setting up the licence costs about J$2.5 million once. Net value in the first year is J$34.5 million, and the auditors can rely on the controls.
The licence did not slow the agent down in any way that mattered. It changed what the agent was allowed to do alone, and it made every action visible. The difference in the first year is almost J$20 million, and the difference in the board’s confidence is greater still.
The composite is illustrative and does not describe any client. Figures are indicative.
Why this matters more in the Caribbean
Four features of regional business make the licence more urgent here.
Small teams make segregation of duties hard already. Many regional finance functions run with a handful of people, and keeping incompatible duties apart is a constant struggle. An agent given broad access can collapse the separation that does exist. Done properly, though, an agent can strengthen it, by taking on tasks that would otherwise force one person to hold too many roles.
Payment fraud by email is a familiar regional threat. Changes to supplier bank details requested by email are one of the most common routes to payment fraud, and they target exactly the kind of process agents are being built for. An agent that acts on emails without verification turns a known risk into an automated one.
Data protection obligations now apply. Jamaica’s Data Protection Act took full effect on 1 December 2023, and other territories have similar laws. Agents routinely read personal data in emails, applications and customer records. The Identity, Mandate and Trail conditions are also the evidence a company needs to show it is processing that data lawfully.
Auditors and regulators will ask. External auditors must understand the controls over financial reporting, and agents acting in payables, receivables or journals are part of those controls. Regulated businesses, such as banks, insurers, credit unions and pension funds, should expect their supervisors to ask how agents are governed. A licensed agent has an answer ready.
Three questions for the board and audit committee
Put three questions to management before the next audit cycle:
- Which AI agents can currently change records, move money or send communications on the company’s behalf, and under whose login does each one act?
- For each of them, where is the written mandate, and who approves the actions above its limits?
- If an agent made a wrong payment last month, could we show the auditors exactly what it saw, what it did and why?
If the answer to the first question includes the words “under the supervisor’s account”, the company has an unlicensed agent, and an audit finding waiting to happen.
The next article, Workflow, Not Tools, turns from control to design: why the AI programmes that pay are built around redesigned workflows rather than purchased tools, and how forward-deployed teams make that redesign happen.
Can your board see what your AI agents are doing?
Dawgen TRUST360™ is Dawgen Global’s continuous governance service for boards and audit committees, delivered on a subscription basis rather than once a year. For organizations using AI agents, it applies the Agent Licence Test™ to every agent that acts on systems or money, maintains the AI register, tests agent activity against each mandate throughout the year and reports exceptions to the board as they arise, not at year-end. It draws on our risk management, internal audit, cybersecurity, IT and AI transformation specialists across the Caribbean. Fees are customized to each client’s circumstances and agreed deliverables.
Request a scoping conversation: info@dawgen.global · (876) 926-5210 · US 855-354-2447 · dawgen.global
Dawgen Global — Big Firm Capabilities. Caribbean Understanding.
About Dawgen Global
Dawgen Global is an independent, integrated multidisciplinary professional services firm headquartered at 47 Trinidad Terrace, New Kingston, Jamaica, serving more than 15 territories across the Caribbean. Founded and led by Dr. Dawkins Brown, Executive Chairman, the firm is independent and not affiliated with any international network. It delivers a full suite of professional services under one roof: audit and assurance; tax advisory; IT and digital transformation; risk management; cybersecurity; actuarial and insurance regulatory advisory; HR advisory; mergers and acquisitions; corporate recovery; business advisory and strategy; accounting BPO and virtual CFO services; and legal process outsourcing.
The proposition is simple: big-firm capability without the big-firm price. Dawgen Global’s integrated approach is built for the specific complexities and opportunities of the Caribbean market, helping organizations make sharper, better-informed decisions that drive measurable progress.
To explore a partnership, reach out:
- Website: dawgen.global
- Email: info@dawgen.global
- WhatsApp (Global): +1 555-795-9071
- Caribbean offices: +1 876-665-5926 | +1 876-929-3670 | +1 876-926-5210
Related service: Explore how we can help →
