What ISO/IEC 42001 requires of internal audit
Internal audit under ISO/IEC 42001 is not a paper-only policy review. It is a planned programme that evaluates whether the AIMS conforms to the standard and to the organization’s established requirements, and whether the system is effectively implemented and maintained. Independence and objectivity matter: auditors should not audit their own work where impartiality would be compromised.
Successful programmes define frequency, methods, roles, sampling, and reporting in proportion to process importance and prior results. Findings feed corrective action and management review so leadership can adjust scope, resources, and risk treatment.
Internal audit outcomes for AIMS conformance
A well-run ISO 42001 internal audit typically demonstrates four outcomes that certification bodies and enterprise stakeholders expect to see retained as records:
- Planned programmeDefined frequency, methods, roles, sampling, and reporting aligned to process importance and prior results.
- Independent auditorsObjectivity and impartiality preserved; auditors do not audit their own work where independence is compromised.
- Operational evidenceDesign and operating-effectiveness tests using policies, configurations, logs, interviews, and walkthroughs.
- Closed-loop findingsNonconformities corrected, effectiveness evaluated, and status retained for management review and certification readiness.
Define scope, criteria, and a risk-based audit programme
Scope should reflect where AI risk and process maturity actually sit in the enterprise. Map the AIMS boundary across systems, teams, suppliers, and runtime environments. Include AI lifecycle processes from conception through retirement, and treat Annex A control objectives as audit criteria when they are in scope.
Risk-based planning weighs process importance, changes since the last audit, prior nonconformities, and the criticality of decisions the AI systems support. Sampling should reach operational instances, not only central policy owners. For multi-system portfolios, rotate deep-dive areas while still covering mandatory AIMS processes on a defined cycle.
Evidence that shows controls are designed and operating
Auditors need more than approved documents. Useful evidence includes configuration exports, access and permission records, change tickets, monitoring alerts, human-oversight logs, training records, supplier agreements, impact and risk assessments, and walkthrough notes that show how work is actually performed.
Which AIMS processes and controls to prioritize
ISO/IEC 42001 expects organizations to determine AI system impacts and risks and to maintain appropriate processes across the AI system life cycle. That expectation should drive internal-audit prioritization. A practical map ties AIMS processes to lifecycle stages: conception, design and development, verification and validation, deployment, operation and monitoring, and retirement.
Annex A control objectives commonly form audit criteria when they are in scope. Typical priority areas include:
- Organizational roles and accountability for AI
- Resources and competence
- Impact and risk treatment
- Human oversight across the lifecycle
- Third-party relationships
Related terminology from ISO/IEC 22989 helps keep criteria and evidence interpretation consistent when systems include models, agents, tools, and automated decision paths.
For agentic workflows, expand the boundary beyond a single model endpoint. Orchestration, tool access, external service calls, and human override points often determine whether claimed governance is real. Where the enterprise also runs an ISO/IEC 27001 ISMS, integrate overlapping testing of access control, change management, logging, and supplier evidence rather than duplicating interviews and samples without coordination.
Document findings and close corrective actions
Findings only improve the AIMS when they are structured, classified under programme rules, and closed with verified evidence. Use the following practice set when writing and remediating audit results:
- Use a consistent finding structure: Record criteria reference, condition observed, cause if known, risk or impact, and evidence pointers. Avoid vague statements that cannot be re-tested.
- Classify under programme rules: Separate nonconformities from observations and improvement opportunities. Classification should reflect failure against ISO/IEC 42001 or internal AIMS requirements, not auditor preference.
- Drive root-cause corrective action: Require correction of the immediate issue and corrective action that addresses cause. Assign owners, due dates, and success criteria before the report is finalized.
- Verify closure with re-test evidence: Do not close on promise or plan alone. Re-sample configurations, logs, tickets, or walkthroughs to confirm operating effectiveness, then retain the verification record.
- Escalate through management review: Feed open and overdue items, systemic themes, and resource needs into management review so leadership can adjust scope, funding, or risk treatment.
Operationalizing runtime governance evidence
Policy statements alone rarely prove that AI controls work in production. Runtime governance evidence (agent permissions, policy enforcement decisions, tool-call logs, human override records, and monitoring outputs) gives auditors attributable samples they can test for design and operating effectiveness.
When internal audit scope includes agentic systems, agree early on which runtime artifacts are authoritative, how long they are retained, and how sample sets will be extracted without disrupting operations. Clear ownership of these evidence sources shortens fieldwork and reduces last-minute reconstruction before certification or customer assurance reviews.