Model Online / On-Site
Duration
Modules 5 modules

Course Objective & Scope

Auditing an ISO/IEC 42001 AI Management System requires more than ticking off policy documents; internal auditors need to know how to probe AI lifecycle artefacts, data provenance records, human oversight logs and system impact assessments. This course equips auditors with practical AIMS internal auditing skills aligned with ISO 19011.

It covers risk-based audit planning, clause-by-clause and Annex A audit checklists, interviewing technical and business stakeholders, grading major versus minor nonconformities, and verifying root-cause corrective actions. Through a simulated audit case study, participants inspect realistic AIMS evidence and draft formal audit findings.

Who Should Attend?

  • Internal auditors and ISMS/QMS auditors assigned to audit ISO/IEC 42001 systems
  • ISO 27001 or ISO 9001 auditors expanding their scope to AI management systems
  • Second- and third-line compliance, risk and assurance professionals
  • AIMS process owners preparing their teams for internal or external audits

Key Takeaways

  • Build a risk-based ISO/IEC 42001 internal audit programme and engagement plan per ISO 19011
  • Audit alignment across the scope statement, risk register, impact assessments and SoA
  • Verify objective evidence for Annex A controls covering AI lifecycle (A.6), data (A.7) and third parties (A.10)
  • Distinguish paper compliance from effective operational execution through sampling and interviews
  • Write clear, clause-referenced Nonconformity Reports (NCRs) and evaluate corrective action plans

Curriculum

AIMS Internal Auditing Principles and Planning (ISO 19011)
  • Applying independence, objectivity and evidence-based auditing to AI systems
  • Scoping the audit programme based on AI system criticality and prior findings
  • Conducting desk reviews of documented information and building audit workpapers
Auditing Clauses 4–10 Management System Requirements
  • Testing scope boundaries, value-chain role determinations and leadership accountability
  • Auditing Clause 6.1: consistency between risk assessments, impact assessments and the SoA
  • Checking competence records, operational change logs, metrics and management review outputs
Field Auditing Annex A Controls (A.2–A.10)
  • A.4 and A.7: Sampling AI resource inventories, data provenance, quality checks and bias handling
  • A.6 and A.9: Auditing lifecycle verification/validation, production monitoring and intended-use guardrails
  • A.8 and A.10: Checking stakeholder disclosures, concern-reporting channels and supplier/customer allocation
Interviewing Techniques, Sampling and Challenging Exclusions
  • How to interview ML engineers, product owners, procurement and human-in-the-loop operators
  • Challenging unjustified control exclusions in the Statement of Applicability (SoA)
Audit Simulation: Writing Nonconformity Reports (NCRs) and Follow-Up
  • Structuring major and minor findings around Requirement, Objective Evidence and Nature of Gap
  • Evaluating root-cause analysis and verifying corrective action closure

Other Courses in This Category

  • AI Risk Management with the NIST AI RMF (Govern, Map, Measure, Manage)

    Operationalise the NIST AI Risk Management Framework (Govern, Map, Measure, Manage) and Playbook, implement TEVV (Testing, Evaluation, Verification and Validation) practices, and build a target AI risk profile.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • Integrating ISO/IEC 42001 (AIMS) with ISO/IEC 27001 (ISMS)

    Integrate ISO/IEC 42001 (AIMS) into an existing ISO/IEC 27001 ISMS without duplicating governance overhead: align Harmonized Structure clauses, unify risk registers and SoAs, and run combined audits.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • ISO/IEC 42005 AI System Impact Assessment and FRIA Practice

    Conduct structured AI System Impact Assessments under ISO/IEC 42005 and EU AI Act Article 27 (FRIA), evaluate harms to individuals and society, and produce auditable impact assessment reports.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • Governing Generative AI Risks with NIST AI RMF and NIST AI 600-1

    Apply the NIST AI 600-1 Generative AI Profile on top of the NIST AI RMF to govern the 12 core generative AI risks—including confabulation, data privacy, IP, cyberattacks and value-chain dependencies.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • Shadow AI Discovery, SaaS AI Controls and Safe Enablement

    Discover and govern Shadow AI—unapproved web LLMs, browser extensions and silently enabled AI features inside existing SaaS tools—using CASB/DLP controls, SaaS opt-out reviews and safe internal alternatives.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View
  • Responsible AI Principles and Operational Practice

    Translate fairness, transparency, accountability, privacy, safety and human agency from abstract commitments into practical checklists across AI design, procurement and daily business operations.

    Responsible AI & AI Governance Corporate
    Live Course
    5 modules
    View

Get in touch