A policy requires approval before an AI model is used in production. In the audit case, the operating log shows use two weeks before the recorded approval. Compare the events and investigate what the discrepancy establishes. Formulate a finding and record your work in an audit file.
Plan a limited internal audit, select criteria and examine approval and operating records. Formulate a finding and seek clarification about timing, possible exceptions and other uses. Reassess the finding when a dated exception appears. Specify how new extracts will be checked and how inaccurate timestamps will be handled.
A planned course tool lets you enter criteria, evidence and findings to create an audit file and report. Real standards-based audits require access to current standards; interviews and other audit activities require additional practice.
What you will work on
Plan an AI governance audit with criteria and independence considerations
Repeatedly compare operating and approval records and investigate discrepancies
Assess production use two weeks before recorded approval
Who it is for
Internal auditors
Internal AI management system auditors
Internal AI governance assurance professionals
Topics
Audit mandate and independence
AI governance and management system criteria
Controls, sampling and evidence
Findings and evidential limits
Clarification and follow-up
Your result
Your completed AI governance audit file contains criteria, operating records, findings and follow-up questions. The audit guide supports review of new extracts.
Prerequisites
Basic internal audit and AI governance knowledge. You need an approved process extract or an audit case study. Real standards-based audits require separate access to current standards and expert review of them.
Format and approach
Planned: 8–10 hours of self-study, with a document case and self-checks with explanations.
How is an AI application used in a management system, and what findings can the available evidence support? Develop an audit assignment with questions and a list of suitable evidence for your area.
An internal ISMS audit should give management a reliable basis for decisions on corrective action and further review. Plan an audit, assess different evidence and write findings. Build your audit programme, audit plan and template for the management report.
Build an AI-supported tool to check records of periodic access rights reviews. It compares the records with an internal policy, flags missing or outdated evidence and checks newly received records again. Configure the workflow, test error cases and keep your configuration.