You've written good instructions. The bot seems to work. But does it actually follow the system, every time, in the cases that matter?
ISO's answer is the internal audit. The bot version is a tester bot.
Internal audit in ISO
ISO asks an organization to run internal audits at planned intervals. They check whether the quality management system:
- conforms to what the organization planned and to the standard
- is actually implemented and kept up
Auditors should be objective. They don't audit their own work. Results are recorded and reported, and problems lead to corrective action.
The tester bot
A tester bot does something similar for bots. It:
- Reads a test script. What to say, in what order, and what a good response looks like.
- Plays the user. It sends the bot under test the script's messages, one at a time.
- Checks each response against the script's checks.
- Records the run. Transcript, results, summary.
| Internal audit | Tester bot |
|---|---|
| Audit plan | Test script |
| Auditor is independent | Tester is a separate bot |
| Checks the system is followed | Checks the bot follows its instructions |
| Audit report | Run folder: transcript, results, summary |
| Findings lead to corrective action | Failures lead to fixing the skill |
Keep the test apart from the real work
An auditor shouldn't change production records. A tester bot shouldn't touch real files.
So testing happens in a separate test folder, with a test copy of the bot, never the working one. The test bot is told plainly that it's a test bot and which folder to use.
A real example
Our AN Creation office has a Bot Tester, on revision 8 as of October 20, 2026. It works in its own test folder, apart from the real project folder. Each run gets its own folder, never changed after, with a transcript, a results file and a summary. An index file gets one line per run: date, script, bot under test, passed, failed, not reached.
The tester never edits a test script itself. If a check is unclear, it says so and suggests wording for the owner to approve. It only tests test copies, never the working bots in use, because a test could change their files.
What a test script looks like
A simple script has:
- Who the tester plays. "A new customer asking about lead times."
- The turns. What to say, in order.
- The checks. "The bot drafts, doesn't send." "The bot asks one question at a time."
- Pass and fail. Each check has a clear yes or no.
A check with no clear pass or fail isn't a check. Rewrite it.
When to test
- After any change to a bot's instructions or skills.
- After changing the model.
- On a schedule, for bots you depend on.
Where it differs from an audit
A human auditor brings judgment and can follow a hunch. A tester bot follows its script. It's consistent but narrow. It catches what the script looks for. So a person still reviews the results now and then, and adds new checks when something slips through. See Management review for bots.
What this means for you
- Write a short test script for each bot you rely on.
- Test copies, in a test folder, never the real thing.
- Record every run.
- Turn failures into skill fixes, then retest.
An audit isn't about catching people out. It's about knowing the system works. Same for bots.