This step creates the internal audit plan, checklists and report from the data you designate. Its purpose is to check for yourselves whether the AI management system is operating as planned. You receive an internal audit plan, checklists by department and an internal audit report.
If you designate the organization chart, division of duties, AI certification scope, AI use cases, AI policy, Statement of Applicability (SoA), risks, impact assessment results and documentation system as folders or files (source data and reference documents), the following are created. An annual internal audit program and the execution plan for each round (auditor independence: auditors do not audit their own work) → checklists by department (main clauses 4 to 10 + the Annex A controls applied in the SoA) → an internal audit report, if audit records exist → management review input data. Findings are passed on to 15 Nonconformity and Corrective Action.
Output
- Internal audit program and execution plan for each roundPurpose, scope, criteria, schedule, timetable by department, auditor independence
- Checklists by departmentClauses and Annex A controls / points to check / audit method (documents, interviews, on-site) / examples of objective evidence (controls excluded from the SoA are omitted)
- Internal audit reportWhen audit records exist: number of nonconformities and observations, findings, conclusion, follow-up actions (passed to 15 Nonconformity and Corrective Action) and management review input data
- Mock auditQuestion-and-answer session with an AI auditor (ISO/IEC 42001), one question at a time, with a judgement and response tips after each answer, and a result report at the end (using a pass)
What to do in this step, by scope of application
| Development | Supply | Use |
|---|---|---|
| Trace-audit the development process, technical documents and logs | Trace-audit the provision of information to customers, contract performance and incident reporting | Trace-audit the department's actual use and compliance with usage guidelines |
Next steps
Preceding steps: 7 Control Implementation and Statement of Applicability (SoA) · 5 AI Risk Assessment · 9 Operational Control · 11 Monitoring, Change and Revision Control · 2 AI Policy, Roles and Objectives · 4 AI System Inventory · 15 Nonconformity and Corrective Action · 10 Documented Information Control · The results of this step are used in the following steps: 2 AI Policy, Roles and Objectives · 14 Management Review · 15 Nonconformity and Corrective Action · 16 Improvement
