ISO 42001 Internal Audit: Finding the Gaps Before the Auditor Does

An internal audit is the one chance you get to find the problems in your AI management system before a certification body does. Under ISO 42001 it is not optional, and treating it as a box to tick is how organizations walk into their external audit surprised by findings they could have caught themselves.

The requirement sits in Clause 9.2, inside the performance-evaluation part of the standard. In plain terms, you have to check your own system, at planned intervals, against both your own requirements and the standard, and act on what you find. The internal audit is where an AI management system proves to itself that it works before anyone outside the organization checks.

This guide from the AI Governance Certification Institute (AIGCI) explains what Clause 9.2 actually asks for, who is allowed to run the audit, the four-step cycle it follows, what an AI-specific audit covers, and the sample questions a good internal audit asks. It ends with the mistakes that make an internal audit worthless.

What Clause 9.2 Requires

Clause 9.2 has two parts, and together they turn self-checking from a good idea into a defined obligation.

The first, 9.2.1, is the general requirement: conduct internal audits at planned intervals to confirm the AI management system conforms to your own policies and procedures and to the standard, and that it is effectively implemented and maintained. That last phrase matters, because it means testing whether people actually follow the documented controls, not just whether the documents exist. The second, 9.2.2, is the audit program: you plan, establish, implement, and maintain a program covering frequency, methods, responsibilities, and reporting. General guidance on how to audit a management system comes from ISO 19011, the standard written for exactly this.

The program has to be risk-based, which means it weighs the importance of each process, any changes such as new AI deployments or scope updates, and the results of previous audits. High-stakes and recently changed areas get more attention; stable, low-risk ones get less.

Who Can Conduct the Internal Audit

An internal audit is a first-party audit, meaning the organization checks itself, but that does not mean anyone can run it. As a form of internal audit generally, it depends on competence and independence. The auditor can be an employee or an external consultant, provided they are competent in both auditing practice and AI, and provided they are objective.

The independence rule is specific and strict: auditors must not audit their own work or processes they are directly responsible for operating. An engineer cannot audit the controls they built, because they cannot be objective about them. This is why many organizations rotate internal auditors across areas, or bring in an outside auditor for parts of the system their own people own.

The Internal Audit Cycle: Plan, Conduct, Report, Act

A sound internal audit runs through four stages, and skipping any of them weakens the whole exercise.

• Plan. Set the audit program, then for each audit define the scope, the criteria, and which auditors will run it, weighted by risk and recent change.

• Conduct. Gather evidence by reviewing records, sampling controls, and interviewing the people who operate them, testing whether the system works in practice.

• Report. Document the findings, including any nonconformities, and report the results to relevant management.

• Act. Feed the findings into corrective action and into the management review, so problems are fixed and leadership sees the real state of the system.

The last stage is where internal audits earn their keep. An audit that produces findings nobody acts on is theater. The results are meant to flow directly into the management review that follows, closing the loop between finding a problem and deciding what to do about it.

What Goes in the Internal Audit Report

The audit is only as useful as the report it produces, and a good report is specific enough to act on. It records a few things clearly.

A sound internal audit report states the scope and criteria of the audit, the evidence examined, and the findings, separating nonconformities, where a requirement is not met, from observations and opportunities for improvement. A nonconformity is classed as major when it undermines the system’s effectiveness and minor when it is isolated, and each one names the requirement it breaches and the evidence behind it. The report ends with a conclusion on whether the system conforms and is effective, which is exactly what leadership needs for the management review. Vague findings that cannot be traced to a requirement or an action are the most common way a report fails the people who rely on it.

What an ISO 42001 Internal Audit Covers

An AI management system audit looks at domains a general IT audit would miss. These are the areas a competent auditor works through:

Preparing for Your First Internal Audit

The first internal audit is the one that feels daunting, but a little preparation makes it routine. Four moves set it up to be useful rather than stressful.

• Assemble the documents. Gather the scope statement, AI policy, risk assessment, Statement of Applicability, and the records that prove the controls run, so the auditor is not chasing paper on the day.

• Fix the scope and criteria. Decide which parts of the system this audit covers and what it will be judged against, so the audit has clear edges.

• Choose an independent auditor. Pick someone competent who did not build the controls being audited, from inside or outside the organization.

• Schedule and notify. Give the teams being audited notice and a plan, because an internal audit is a check, not an ambush.

Done this way, the first audit becomes the template for every one after it, and the program turns from an obligation into a habit.

Internal Audit Versus the Certification Audit

The internal audit is often confused with the external one, but they are different in who runs them and why. The internal audit is first-party: you check yourself to catch and fix gaps. The certification audit is third-party: an accredited body checks you to decide whether to issue a certificate, in the two-stage process described in the certification audit. The honest way to see the relationship is that the internal audit is the rehearsal and the certification audit is the performance.

That framing also sets the standard for a good internal audit: it should ask the same hard questions the external auditor will, so that nothing in the certification audit comes as a surprise. An internal audit that goes easy on itself simply moves the findings to a more expensive stage.

Sample Internal Audit Questions by Clause

A useful internal audit is a set of pointed questions, each tied to a requirement in clauses 4-10 and answerable with evidence. Copy these as a starting checklist and expand them for your own systems.

Common Internal Audit Mistakes

A few errors hollow out an internal audit until it passes everything and prevents nothing:

• Auditing your own work. Letting people review the controls they built, which destroys objectivity.

• Checking documents, not practice. Confirming a policy exists without testing whether anyone follows it.

• Findings with no follow-up. Recording nonconformities that never turn into corrective action.

• Going easy to look ready. Soft internal audits that simply push the findings into the external one.

• Auditing once and stopping. Treating it as a one-time event rather than a planned, repeating program.

Frequently Asked Questions

Is an Internal Audit Mandatory in ISO 42001?

Yes. Clause 9.2 requires internal audits at planned intervals, and you cannot be certified or stay certified without them. The internal audit is the mechanism the standard uses to make an organization check its own AI management system between external audits.

Who Can Perform an ISO 42001 Internal Audit?

An employee or an external consultant, as long as they are competent in both auditing and AI and are independent of the area being audited. The key rule is that auditors must not audit their own work, so organizations often rotate auditors or bring in outside help for the parts their own teams operate.

Do Internal Auditors Need to Be Certified?

The standard requires competence, not a specific certificate, so certification is not strictly mandatory for an internal auditor. In practice, a recognized internal auditor credential is a common and efficient way to demonstrate that competence, and many organizations prefer it for exactly that reason.

What Is the Difference Between an Internal and a Certification Audit?

An internal audit is first-party: the organization audits itself to find and fix gaps. A certification audit is third-party: an accredited body audits the organization to decide whether to issue a certificate. The internal audit is preparation and improvement; the certification audit is the independent verification.

How Long Does an ISO 42001 Internal Audit Take?

It depends on scope and system complexity, but a focused internal audit of a tightly scoped AI management system often runs a few days of auditor time, while a broad system across many teams takes longer and is usually split into several audits across the year. The point is coverage over the cycle, not finishing in one sitting, so the program matters more than any single audit length.

What Is the Difference Between a Nonconformity and an Observation?

A nonconformity is a failure to meet a requirement of the standard or your own system, and it has to be corrected; it is classed as major when it undermines the system and minor when it is isolated. An observation is not a breach but a weakness or a risk worth noting, often raised as an opportunity for improvement. Both belong in the report, but only nonconformities trigger mandatory corrective action.

How Often Should Internal Audits Be Conducted?

At planned intervals set by your audit program, which must cover the whole system over time and weight higher-risk and recently changed areas more heavily. Most organizations run at least an annual cycle, with additional audits triggered by significant changes such as a new AI system or a major scope update.

Build the Skills to Audit Well

A strong internal audit depends on auditors who know what good evidence looks like and are willing to ask the uncomfortable questions. That competence is built through training. You can explore the audit path through the internal auditor certification and see every route among the ISO 42001 courses, so your internal audit catches what matters rather than confirming what you hoped.