ISO 42001 – Clause 9.2 Internal Audit
](/assets/img/ru_10.png)
📄 Clause 9.2 – Internal Audit
Keeping Your AI Management System Honest
Clause 9.2 ensures that your AI Management System (AIMS) isn’t just built on paper but is actually working in practice. It’s about performing objective, systematic checks on your processes, controls, and compliance — without bias, without assumptions.
An internal audit under ISO 42001 is not about “catching people doing things wrong.” It’s about finding gaps before they become problems and ensuring continuous alignment with the standard, your policies, and your AI governance goals.
✅ What Clause 9.2 Requires
Organizations must:
-
Plan, establish, and maintain an internal audit program — defining scope, frequency, and methods.
-
Audit all parts of the AIMS at planned intervals.
-
Select objective and impartial auditors (or audit teams) — internal staff who are independent from the area being audited or external professionals.
-
Report audit results to relevant management for corrective actions.
-
Retain documented information as evidence of audit results and follow-up.
🧠 Why It Matters in AI Governance
AI systems can change over time due to updates, retraining, or environmental factors. Without internal audits:
-
Undetected risks could compromise fairness, compliance, or performance.
-
Control weaknesses may go unnoticed until a regulator or customer raises the issue.
-
Documentation gaps could leave you vulnerable during external certification audits.
Internal audits give you a safe, internal checkpoint to detect and address issues early.
🛠️ Implementation Tips for Clause 9.2
| Step | Actions |
|---|---|
| Define audit scope | Cover all AIMS processes, AI lifecycle stages, and compliance areas. |
| Use risk-based frequency | Audit higher-risk AI models more often. |
| Prepare checklists | Map questions to ISO 42001 requirements. |
| Interview stakeholders | Interview developers, data scientists, and compliance teams. |
| Verify evidence | Check logs, model monitoring reports, and change management records. |
| Follow up | Track corrective actions until closure. |
📌 Example Internal Audit Questions for AI Systems
-
Does the AI system still align with its documented purpose?
-
Are risk assessments updated when data, models, or regulations change?
-
Is bias monitoring being performed and documented?
-
Are model retraining and version control properly managed?
-
Are stakeholders informed of significant changes in AI behavior?
🔍 Pro Tip
Your internal audit should be both technical and governance-focused. Reviewing just model accuracy isn’t enough — you must also verify ethical compliance, transparency measures, and stakeholder engagement processes.
In tomorrow’s article by Kimova.AI, we’ll explore Clause 9.3 – Management Review, where leadership evaluates the AIMS’s overall performance and decides on the strategic improvements needed to keep AI governance strong.