Audit or Review Cycle¶

Audit — instantiates Principal–Agent Alignment

Periodically examines the agent's actual work against the record, on a cadence and depth scaled to how much the agent is trusted.

An Audit or Review Cycle aligns an agent by independently verifying what actually happened, after it happened. Rather than trusting the agent's own account, a reviewer pulls the underlying evidence — records, transactions, samples of the work — and checks it against what was supposed to occur. Its defining trait is that observability here is pull, not push: the principal (or an independent party) goes and looks, on a set cadence, rather than waiting for the agent to disclose. And because looking is costly, the cycle's depth and frequency are themselves a dial — a highly trusted agent gets a light annual sample; a new or shaky one gets frequent, deep review. Audit is what makes hidden action checkable, and it is deliberately periodic: it accepts blind spots between cycles in exchange for not surveilling everything all the time.

Example¶

A consumer-electronics brand builds its products through a contract manufacturer overseas. The brand cannot watch the line daily, and the factory has every local incentive to quietly substitute cheaper components or relax test coverage to protect its own margins. The alignment mechanism is a quarterly supplier-quality audit. An independent inspection team visits the plant, pulls a random sample of finished units, checks the actual bill of materials against spec, reviews test logs for gaps, and traces a batch back through the process records.

The cycle's teeth are in what it finds without being told. One quarter the audit catches a substituted capacitor that passed the factory's own (weakened) test — something no self-report would ever have surfaced. Because the audit is independent and evidence-based, the finding is hard to argue with, and it feeds the consequence machinery: a corrective-action plan, and a shift to monthly audits until trust is re-earned. That last move is the calibration dial in action — the factory's audit burden is now a direct function of how much it can be trusted.

How it works¶

The cycle runs scope → sample → test → finding. Scope names what will be examined and against what standard; because exhaustive review is infeasible, the reviewer samples — random, risk-weighted, or full-population for the highest-stakes items — and tests each sampled item against the record. Findings are documented with evidence and handed to whoever owns the consequences. The two design levers that make it this mechanism are independence (the reviewer must not be the reviewed, or the check is theater) and proportionality — audit intensity scaled to risk and to earned trust, so scarce review effort lands where deviation would hurt most. An audit produces the findings; acting on them belongs to a separate consequence mechanism.

Tuning parameters¶

Cadence — how often the cycle runs. Frequent audits catch drift early but cost more and can signal distrust; rare ones are cheap but let problems compound between looks.
Sample depth — fraction of work examined, from a light spot-check to full-population. Deeper samples catch more but cost more and slow the agent; the right depth tracks the stakes.
Trust scaling — whether audit burden falls as an agent earns a clean record. Steep scaling rewards good agents and concentrates scrutiny on risky ones; flat scaling is fairer-seeming but wastes effort on the trustworthy.
Independence distance — how separated the reviewer is from the reviewed (self-audit → internal → external third party). More distance buys credibility; it also costs more and knows the context less.

When it helps, and when it misleads¶

Its strength is turning hidden action into evidence: it surfaces deviations the agent would never volunteer, and does so with a credibility self-reports can't match. Scaled to risk, it lets a principal extend real autonomy while still keeping an eye on the failure modes that matter.

It misleads in two ways. First, an audit examines a sample, so a clean audit never means clean everything — undetected deviation between and outside the sample is a permanent residual, and treating "passed the audit" as "all is well" is a classic overreach.^[1] Second, audits decay into ceremonial compliance when they're not paired with real consequences — the agent learns to survive the check rather than do the work, dressing up for audit day and reverting after. The related misuse is the audit run to confirm a conclusion already reached rather than to test one. The guard is to keep findings tied to a live consequence path, vary and risk-weight the sample so it can't be gamed, and preserve the reviewer's independence.

How it implements the components¶

observability_and_monitoring_plan — the sampling scope, cadence, and evidence procedure are the plan that makes past agent action independently inspectable.
trust_and_autonomy_calibration — audit depth and frequency scale to earned trust, so the amount of scrutiny is the concrete expression of how much autonomy the agent has earned.

It does not carry the agent's own routine self-report — that is Reporting Requirement; it does not impose the sanction that follows a finding — that is Governance Board; and it neither sets the metric targets (Service-Level Agreement) nor the incentives (Incentive Compensation Plan).

Instantiates: Principal–Agent Alignment — supplies the observability side of the relationship through independent after-the-fact examination.
Consumes: Reporting Requirement — audits often test the agent's own reports against the underlying evidence.
Sibling mechanisms: Reporting Requirement · Governance Board · Service-Level Agreement · Performance Contract · Decision-Rights Matrix · Incentive Compensation Plan · Reputation System · Fiduciary Duty Rule · Escalation Protocol · Clawback Clause

References¶

[1] Sampling risk — because an audit inspects only a subset of the work, there is an irreducible chance a real deviation sits in the unexamined remainder. A passed audit bounds the problem; it does not prove its absence. ↩