Companies are increasingly entrusting complete tasks to AI agents, from monitoring information to executing certain actions. This autonomy raises concrete questions for the teams deploying them: which tasks to delegate, at what point human validation becomes necessary, and how to avoid it being reduced to a simple click. Gaetan Fron, Senior Sales Manager for France, Belgium, and Luxembourg at Diligent, a publisher of governance, risk, and compliance (GRC) solutions, details the uses observed in audit and risk management teams.
Agents That Go Beyond Answers
Agents are no longer limited to answering questions. They can monitor information, coordinate processes, prepare work, and highlight the next action to take. With Diligent One, specialized agents can help risk management teams move from periodic assessments to continuous monitoring: they monitor risk-related data, clean recorded data, coordinate assessments, follow up on overdue actions, escalate issues to relevant managers, and flag emerging risks.
On the internal audit side, these agents can help plan and execute audits more quickly, by identifying relevant risks, linking them to audit objectives, and connecting existing controls. They also facilitate the collection of evidence, testing, and formulation of findings. The whole is coordinated by Diligent One’s orchestration agent, which allows professionals to express their needs in natural language, i.e., in their own words rather than through technical commands. The agents rely on GRC data stored in the platform, giving them the necessary business context, without replacing human judgment.
Where to Draw the Line
Three levels are often distinguished: the agent that suggests, the one that prepares work, and the one that executes an action without prior validation. For Gaetan Fron, the line depends on the consequences of the action rather than its complexity. An agent can monitor, organize, draft, and formulate recommendations in the background. It can also execute routine and reversible tasks, such as sending reminders or preparing a workflow, within clearly defined permissions.
However, any action that modifies the organization’s risk exposure, changes recorded data, commits the company, or leads to the publication of an official report must, in his view, require explicit human approval. “Agents can handle the work; decisions that commit the organization remain the responsibility of people.”
To evaluate work prepared by an agent without having followed its progress, each recommendation must present the supporting evidence, explain its justification, and be accompanied by an action history. Those responsible for validation must be able to question the source, assumptions, and proposed action, and not just click “approve.” According to Gaetan Fron, Diligent’s approach is based on results with cited and traceable sources, which the user can correct or dismiss, with approval steps for actions that commit the organization.
Work Refocused on Analysis
Human judgment remains indispensable whenever responsibility is involved. Professionals must interpret the context, determine what matters, and stand behind the conclusions presented to executives, boards of directors, or regulatory authorities.
Delegation changes, according to Gaetan Fron, the very nature of the work. Teams move from administrative process management to strategic action: instead of requesting evidence, updating registers, or preparing presentations, risk and audit professionals can analyze the root causes of problems, anticipate emerging risks, and explain the real stakes to management. The goal, he specifies, is not to reduce the number of experts, but to allow them to focus their expertise where it creates the most value.
For a team starting out, he recommends beginning with a clear, well-defined use case, whose value is easily perceived and whose result is easily verified. Once this first case is mastered, the scope can be gradually expanded, while maintaining human responsibility for decisions that commit the organization.
