Risk-based AIMS audit plan
The audit plan focuses on AIMS scope, AI risk, material changes, previous issues and the controls that matter most to system effectiveness.
AI Governance · Defined starting point
Test whether the AIMS works as a system. ISO 42001 Internal Audit.
An independent internal audit of ISO 42001 implementation, focused on conformity, operating evidence and whether AI governance is actually effective in practice.
What you get
Independent evidence that the AIMS operates.
The audit tests whether the management system is implemented, effective and producing the evidence management and external assurance will need.
Interviews and evidence sampling
Interviews and records are sampled across governance and AI lifecycle activities to test whether arrangements operate in practice.
Conformity and effectiveness testing
Requirements are tested for conformity and effectiveness, including how risk, impact, oversight and improvement work together.
Clear findings and rationale
Findings link the requirement, evidence and rationale so corrective action can be prioritised without ambiguity.
Management debrief and next actions
Management receives a debrief and clear next actions before certification, surveillance or other assurance activity.
How it works
From audit plan to evidence-backed AIMS findings.
The audit tests the management system as a connected whole rather than treating AI controls as isolated documents.
Plan
Agree audit scope, criteria, functions, systems and sampling.
Audit
Test management-system and AI-lifecycle evidence in practice.
Report
Separate nonconformity, risk and improvement observations clearly.
Improve
Give management a focused route before certification or further assurance.
Fit check
Use this when the AIMS exists and needs independent testing.
A good fit when the AIMS is operating and independent evidence is needed before certification, customer review or management sign-off.
Discuss your situationBack to AI Governance →Defined scopeThe work is bounded before it starts.
Senior-ledOne senior line through assessment and decision.
No forced follow-onThe output remains useful without a mandatory next engagement.
BEFORE YOU DECIDE
What an impartial AIMS audit actually tests
A documented AI policy is only one input. The audit looks at whether AI governance decisions, risk assessment, lifecycle controls, monitoring and improvement are operating in practice.
Scope and audit criteria
Agree the relevant AIMS processes, ISO 42001 criteria, selected AI use cases, business activities and sampling method before evidence collection begins.
Trace evidence end to end
Follow selected AI activities from registration and assessment to approval, change, monitoring and review. Identify findings supported by records and responsible-owner interviews.
Report independently
Deliver evidence-based findings and management priorities. Independence is organised so a consultant does not simply audit their own recent implementation work.
Questions to settle before commissioning
Is this a formal ISO 42001 certification audit?
No. An internal audit supports management-system assurance and improvement. Certification is a separate independent assessment.
Will individual AI models be technically tested?
Only where explicitly included. AIMS process audit and detailed technical model evaluation require different scopes and methods.
A practical first step
Test the AIMS before external assurance depends on it.
Tell us the AIMS scope, assurance timing and what has already been implemented. We will help determine the right audit depth.
Discuss your ISO 42001 Internal Audit