How do I run a mid-year audit of six months of AI agent work?
Run the same five passes as the year-end audit, at half scale: inventory the agents and connections still live, sample the half-year's job records and recompute receipts, test approvals on consequential outputs, reconcile spend against the caps in force, and write the gap page with an owner and a date for every fix.
The mid-year audit exists because drift compounds quietly: a connection granted for a June project is still live in December, a recording habit that slipped in a busy month never resumed, a cap set in January no longer matches the work. Caught at six months, each of those is a small fix. Caught at year end, under a client's audit or an incident, each is a finding.
The passes mirror the Q4 audit in this cluster, deliberately, so the two audits are comparable. Inventory first: agents, connections, access, owners, with the ownerless revoked on the spot. Sampling second: ten jobs across the half-year's clients and systems, steps read, one receipt per job recomputed at https://zambo.dev/verify/ , approvals checked on the consequential ones. Spend third: the half-year's agent costs against statements, caps reviewed against actuals, refusals counted as controls working.
The gap page is the deliverable, as it is in December: what ran unrecorded, what is connected that should not be, what approval is missing where it matters, each with an owner and a fix date inside the next quarter. A team that writes this page twice a year stops having audit seasons; it has a records system that occasionally gets inspected.
Checklist: the five-pass mid-year audit
Pass 1, inventory: agents, connections, access, owners; revoke the ownerless today. Pass 2, sample: 10 jobs across the half-year; steps read; one receipt per job recomputed. Pass 3, approvals: consequential outputs carry recorded decisions; list the exceptions. Pass 4, spend: totals against statements; caps against actuals; refusals reviewed. Pass 5, gap page: each gap with an owner and a fix date in the next quarter. Time budget: one afternoon for a small team; file the output with the half-year's records.
Worked example
Pass 2's recompute, at sampling speed: open any sampled job, for example the public record shape at https://zambo.dev/handover/bd7e5325-33fd-4c5e-b029-76b781fa2f51 , read its five steps, and recompute one receipt at the verify page. Ten jobs at that rate is under an hour, which is why recorded work makes audits cheap.
Frequently asked questions
How is this different from the Q4 audit in this cluster?
Scale and intent. The Q4 audit closes the year for clients, tax, and auditors; the mid-year audit is internal and corrective, sized to find drift while fixes are still small. Same passes, same gap page, different audience.
We started recording only two months ago. Is an audit premature?
It is the best-timed audit you will run: the gap page writes itself (the unrecorded four months, bounded and dated), the recorded two months sample clean, and the system gets its first honest baseline.
Who should see the gap page?
Whoever owns the systems it names, and leadership. It is an internal working document; clients and auditors get the records themselves and, where relevant, the fact that the audit ran, not your internal fix list.
By Brennan Zambo, founder of Zambo.
Last verified: 2026-10-17.
Try a handover
A handover gives your client one proof link with verifiable receipts to review, then Accept or Flag.
try it: say 'use zambo to hand this over to <client>' in your ai