Internal audit for ISO 42001

The internal audit is your own quality check. ISO 42001 requires you to test periodically whether your AI management system works. Before the external auditor from an accredited certification body arrives, you check it yourself. This page explains how to carry out an effective internal audit.

Why internal audits for ISO 42001?

ISO 42001 requires internal audits. But they are more than a tick-box exercise.

Finding problems early. It is better to find a problem yourself than to have the external auditor find it.

Improving. Audits identify opportunities for improvement. They force you to look critically.

Proof that it works. You show that your management system does not exist only on paper.

Preparing for certification. The internal audit is a dress rehearsal for the external audit.

Who may carry out the ISO 42001 internal audit?

A personal certificate as a Lead Auditor can help. See the ISO 42001 exam for what that involves.

The auditor must be independent of the process being audited. You may not assess your own work.

Options:

Someone from another department
An internal audit function (if you have one)
An external consultant
A colleague from another location

In small organisations, this is difficult. Everyone is involved in everything. Solutions:

Train several people so they can audit each other’s work
Hire an external auditor for the internal audit
Swap with a friendly organisation

Independence is about the process, not the organisation. Someone from HR can audit IT processes, provided that person has been trained.

The ISO 42001 audit programme

You need an audit programme: a plan for what you audit and when.

Frequency

The standard does not specify exactly how often. Typically:

Annually, all parts of the AIMS
Before certification, at least one full audit
After major changes, an extra audit of that part

Scope

For each audit, decide what you assess:

Which clauses of the standard?
Which AI systems?
Which locations?
Which processes?

Over the cycle, you must cover all parts.

Planning

Plan audits in advance. Take into account:

Availability of auditors
Availability of auditees
Enough time for follow-up before the external audit

Carrying out the ISO 42001 internal audit step by step

Step	Activity	Output
1	Preparation	Audit plan, checklist, document review
2	Opening meeting	Scope confirmed, those involved informed
3	Gathering evidence	Interviews, document review, observations
4	Formulating findings	Conformities, observations, non-conformities
5	Closing meeting	Findings presented, next steps discussed
6	Reporting	Audit report with conclusions and recommendations

Schedule the internal audit at least 4 to 6 weeks before the external certification audit. That gives you enough time to address findings and close them before the external auditor arrives.

Preparation

Make an audit plan. What will you audit? When? Whom will you interview? Which documentation do you want to see?

Review the documentation. Read the relevant documentation in advance. Know the policy, the procedures and the risks.

Prepare a checklist. A list of questions and points to check, based on the requirements of the standard.

Opening meeting

Start with a short meeting:

Explain what you are going to do
Confirm the scope and schedule
Ask whether there are any particular points to note

This puts people at ease and creates clarity.

Gathering evidence

Now you collect evidence. You do this by:

Interviews. Talk to the people who do the work. Ask how processes work, what they do when problems arise and whether they know the policy.

Document review. Look at documents: are they up to date? Are they followed? Are the required elements present?

Observation. Watch how things work in practice. Ask for a live demonstration.

Data analysis. Look at metrics, logs and reports. Do the figures match what people say?

Formulating findings

Categorise what you find:

Conformity. Meets the requirement.

Observation. Not a deviation, but a point for improvement.

Minor non-conformity. A deviation that does not fundamentally undermine the system.

Major non-conformity. A serious deviation. A core requirement is not being met.

Formulate findings clearly:

What is the requirement?
What is the evidence?
What is the deviation?

Closing meeting

Close with a meeting:

Present the findings
Give the auditees the chance to respond
Discuss the next steps

Reporting

Write an audit report that includes:

Scope and date
Auditors and auditees
Overview of findings
Conclusions and recommendations

Following up on findings

An audit is only valuable if you act on its findings.

Corrective actions

For each non-conformity, you determine:

Correction: Fix the immediate problem
Root cause analysis: Why did it go wrong?
Corrective action: What will you do to prevent it from happening again?

Deadlines

Set deadlines for corrective actions. Typically:

Major: within 30-60 days
Minor: within 90 days

Verification

Verify that the actions have been carried out and are effective. The auditor can do this at the next audit, or in between.

Records

Document everything: findings, actions, status and verification. This is evidence for the external audit.

Specific points of attention for ISO 42001

ISO 42001 has AI-specific elements. Pay extra attention to:

AI system impact assessment

Is there an impact assessment for each AI system?
Is the assessment serious, or a tick-box exercise?
Have the effects on people been genuinely considered?
Have measures been taken?

Bias and fairness

Has testing for bias been carried out?
How are the results monitored?
What happens when bias is discovered?

Explainability

Can decisions be explained?
Do users know how the AI works?
Is there a process for questions or complaints?

Data governance

Where does the training data come from?
Has its quality been checked?
Is its origin documented?

Supplier management

Have AI suppliers been identified?
Have they been assessed for risks?
Are there contractual agreements?

AI literacy

Have employees been trained?
Do they know enough to work with AI responsibly?
Is there evidence of training?

Example questions for interviews

For management

How is top management involved in AI governance?
How are decisions made about new AI systems?
What are the objectives for the AIMS?
How are risks escalated?

For AI owners

Can you explain the impact assessment of your system?
Which risks have you identified?
How do you monitor the system?
What do you do when problems arise?

For users

Do you know the AI policy?
Do you know how the AI system works?
What do you do when the AI gives an odd result?
Have you had any training?

For developers

How do you document models?
How do you test for bias?
What is the process for new releases?
How is data managed?

Common findings in the ISO 42001 internal audit

Incomplete impact assessment. The assessment has been done, but superficially. No concrete examples and no real mitigation.

Documentation not up to date. Procedures describe an old process. Risk assessments are from last year.

Employees do not know the policy. There is a good policy, but nobody knows about it.

No ownership. It is unclear who is responsible for which AI system.

Suppliers not assessed. AI is purchased, but the supplier has not been assessed.

Training not documented. “We have trained everyone”, but there is no evidence.

The internal audit as a learning moment

The best internal audits are not policing exercises. They are learning moments.

Ask open questions. Not only “are you compliant?” but “how does it work?” and “what could be better?”

Share knowledge. If the auditor knows something that helps the auditee, share it.

Be constructive. The goal is to improve, not to punish.

Celebrate successes. Name what is going well too.

An internal audit that finds only shortcomings is suspicious. Either the system is genuinely poor, or the auditor is not looking at what works. Balance matters.

Relationship with the external audit

The external auditor will ask about your internal audits:

When were they carried out?
What were the findings?
Were corrective actions implemented?
Has their effectiveness been verified?

A good internal audit makes the external audit smoother. You have already found and resolved much of what might otherwise come up.

Read more about the external audit process.