ISO 42001 Internal Audit Program: Best Practices from Clause 9.2

ISO/IEC 42001 Clause 9.2 establishes requirements for internal audit programs that ensure AI Management Systems remain effective and compliant. This clause provides the check-up mechanism organizations need to validate their AI governance posture.

Understanding Clause 9.2 Requirements

Clause 9.2 requires organizations to conduct internal audits at planned intervals to determine whether the AIMS:

• Conforms to the organization's own requirements for its AI management system
• Conforms to the requirements of ISO 42001
• Is effectively implemented and maintained

These audits serve as essential governance checkpoints, helping organizations identify issues before they become compliance failures or operational problems.

Establishing Your Audit Program

1. Define Audit Program Scope

Your internal audit program should cover:

• All clauses of ISO 42001 (4-10)
• Applicable Annex A controls based on your Statement of Applicability
• AI-specific processes including development, deployment, and monitoring
• Supporting functions (HR, procurement, IT) with AI responsibilities

2. Determine Audit Frequency

Clause 9.2 requires audits at planned intervals, but doesn't prescribe specific frequencies. Consider:

• Risk-Based Approach: Higher-risk AI activities warrant more frequent audits
• Regulatory Requirements: Some industries may mandate specific audit frequencies
• Previous Findings: Areas with past issues may need increased attention
• Organizational Changes: New AI deployments or significant changes trigger additional audits

Recommended Minimum: Annual coverage of all AIMS elements, with quarterly reviews of high-risk AI systems.

3. Develop the Audit Schedule

Create an annual audit schedule that ensures:

• Complete coverage of all AIMS requirements over the audit cycle
• Logical sequencing of related audits
• Resource availability during audit periods
• Timing considerations for surveillance audits if certified

Auditor Competence Requirements

ISO 42001 internal auditors must possess specific competencies beyond traditional audit skills.

Essential Technical Knowledge:

• Understanding of AI/ML concepts and terminology
• Familiarity with AI lifecycle stages
• Knowledge of common AI risks (bias, drift, explainability)
• Understanding of data governance principles

Audit Skills:

• Internal audit methodology (ISO 19011 principles)
• Evidence collection and evaluation techniques
• Nonconformity identification and classification
• Report writing and communication

Independence Requirements:

Auditors must not audit their own work. Ensure:

• Separation between auditors and audited activities
• Documented auditor assignment criteria
• Alternative arrangements when independence cannot be maintained internally

Conducting Effective AIMS Audits

Phase 1: Preparation

• Review previous audit findings and corrective actions
• Examine relevant documentation (policies, procedures, records)
• Develop audit checklists specific to AI management
• Notify auditees and schedule interviews
• Confirm audit objectives and scope

Phase 2: Execution

Document Review: AI policies and guiding principles, risk assessments and treatment plans, AI system impact assessments, training and competence records, supplier assessments for AI components

Process Observation: AI development workflows, data quality verification procedures, model testing and validation activities, deployment and release processes, monitoring and alerting mechanisms

Personnel Interviews: Management commitment and resource allocation, understanding of AI policies and responsibilities, awareness of AI risks and controls, incident response procedures

Phase 3: Reporting

Structure your audit report to include:

• Executive Summary: Overall AIMS effectiveness assessment
• Scope and Objectives: What was audited and why
• Findings: Classified as conformities, minor nonconformities, major nonconformities, or observations
• Evidence: Specific documentation or observations supporting findings
• Recommendations: Suggested improvements beyond compliance

AI-Specific Audit Considerations

Bias and Fairness Testing

Verify that organizations:

• Have defined fairness metrics and thresholds
• Conduct regular bias assessments
• Document testing results and remediation actions
• Monitor for bias in production systems

Explainability by Design

Confirm existence of:

• Model cards or capability statements
• Documentation suitable for different stakeholder audiences
• Mechanisms for providing explanations on request

Human Oversight Safeguards

Evaluate:

• Defined escalation triggers (confidence thresholds, anomaly detection)
• Override procedures and authority assignments
• Records of human interventions and their outcomes

Event Logging

ISO 42001 Annex A Control A.6.2.8 requires identifying which AI system lifecycle phases need event logging. Verify:

• Comprehensive logging across design, development, deployment phases
• Tamper-proof timestamps
• Clear identification of responsible parties
• Appropriate retention periods

Managing Audit Findings

Classification Framework:

• Major Nonconformity: Absence or complete breakdown of a required system element
• Minor Nonconformity: Single lapse or partial implementation issue
• Observation: Area of potential risk not yet a violation
• Opportunity for Improvement: Enhancement suggestion beyond compliance

Corrective Action Process:

1. Analyze root cause of nonconformity
2. Develop corrective action plan with owner and timeline
3. Implement corrective actions
4. Verify effectiveness of actions
5. Close findings with documented evidence

Continuous Improvement

Use audit findings to drive AIMS improvement:

• Track metrics (findings by type, closure rates, recurrence)
• Identify systemic issues requiring process changes
• Report trends to management review
• Update risk assessments based on audit insights
• Refine audit procedures based on lessons learned

Conclusion

A well-designed internal audit program is essential for maintaining ISO 42001 compliance and driving continuous improvement in AI governance. By following Clause 9.2 requirements and incorporating AI-specific considerations, organizations can ensure their AIMS remains effective, compliant, and trustworthy.

Remember that internal audits are not just compliance exercises—they provide valuable insights for improving AI governance and building organizational confidence in AI systems.