Research · AI Governance, Risk & Compliance

AI Audit & Assurance

AI audit and assurance provide independent evidence that AI systems and the controls around them work as intended. Demand is rising from boards, regulators, customers and, in some cases, laws that require audits.

Types of assurance

• Internal audit of AI governance, controls and specific high-risk systems.
• Management system certification against ISO/IEC 42001 by accredited certification bodies.
• Bias audits, such as those required for automated employment decision tools under New York City Local Law 144.
• Technical testing, including red teaming and security assessments.
• Conformity assessment for high-risk AI under the EU AI Act, once those obligations apply.

What auditors look at

• Completeness of the AI inventory.
• Risk assessments and approvals for each system.
• Data provenance, quality and permissions.
• Testing before release and monitoring in production.
• Human oversight, incident handling and change management.
• Documentation sufficient to reconstruct decisions.

Building audit capability

AI audit requires a mix of audit discipline and technical understanding. Professional bodies have responded with specialized credentials; ISACA, for example, offers the Advanced in AI Audit (AAIA) certification for experienced IT auditors. See our guide to AI certifications by role.

Common pitfalls

• Auditing AI principles instead of evidence.
• Relying on vendor claims without testing.
• Documentation created only when an audit is announced.

How to get started

• Add AI governance to the internal audit plan.
• Start with the highest-risk AI systems.
• Define the evidence each AI system must maintain.
• Decide where external assurance adds credibility.