ISO 42001 Audit Process: How an AIMS Audit Actually Works

Whether an audit is run by your own team or by an external certification body, it follows the same process. The difference between an internal audit and a certification audit is who conducts it and what rides on the result, not how it is done. Learn the process once and every audit of an AI management system becomes familiar rather than daunting.

That shared process is not improvised. It follows the discipline of management-system auditing, the same approach described for quality audit generally and codified in the international auditing guidelines, so an AIMS audit has a predictable shape: plan it, open it, gather evidence, record findings, close it, report, and follow up. Each step has a purpose, and skipping any of them weakens the audit.

This guide from the AI Governance Certification Institute (AIGCI) walks through that process end to end, shows how auditors actually gather and grade evidence, and explains where the same process plays out differently in an internal audit versus a certification audit.

The Audit Process at a Glance

Every AIMS audit moves through the same sequence of steps. The table lays them out in order, so the rest of this guide can take each in turn.

Who Is in the Audit Team

An audit is run by people with defined roles, and knowing who does what explains how the process stays objective.

A lead auditor runs the audit, owns the plan and the report, and makes the final call on findings. Other auditors cover specific areas, and technical experts may advise on AI-specific questions such as model behavior or data pipelines without themselves auditing. The one rule that holds across every role is independence: no one audits work they are responsible for operating, because an auditor cannot be objective about their own controls. In an internal audit this often means rotating people across areas; in a certification audit the accredited body supplies a team with no stake in the outcome.

Step 1: Planning the Audit

An audit starts long before anyone is interviewed. Planning sets the boundaries and the standard the audit will judge against, and a vague plan produces a vague audit.

The auditor defines the scope, which parts of the AI management system are in this audit; the criteria, what the system is being judged against, usually the standard plus your own policies; and the objectives, what the audit is meant to establish. These are written into an audit plan with a schedule, so everyone knows what will be examined, when, and by whom. In a risk-based program, higher-stakes and recently changed areas get more time than stable ones.

Step 2: The Opening Meeting

The opening meeting is short but it sets the tone. The auditor confirms the scope and criteria, explains how the audit will run, agrees logistics and availability, and clarifies how findings will be communicated.

Its real value is removing surprises. When everyone agrees up front what is in scope and how evidence will be gathered, the audit runs as a professional examination rather than an ambush, which is how the standard intends it to work and how a well-run audit keeps the relationship between auditor and organization constructive.

Step 3: Gathering Evidence

This is the heart of the audit. An audit finding has to rest on audit evidence, not opinion, so the auditor collects it through a few established methods, usually in combination.

These methods are not improvised. The way an auditor plans, conducts, and reports an audit follows the profession-wide guidelines set out in ISO 19011, which is why audits of very different systems still look recognizably alike.

Sampling matters because an auditor cannot examine everything. They test enough to form a confident judgment, which is why clean, well-organized records make an audit faster and smoother: the sample is easy to pull, easy to read, and easy to trust. When records are scattered or incomplete, the auditor has to widen the sample and dig deeper, which lengthens the audit and tends to surface more findings rather than fewer.

Step 4: Findings, Graded by Severity

Every piece of evidence is turned into a finding, and findings are graded so their seriousness is clear.

• Conformity. The evidence shows a requirement is met.

• Nonconformity. A requirement is not met, classed as major when it undermines the system and minor when it is isolated.

• Observation or opportunity for improvement. Not a breach, but a weakness or a risk worth noting.

Each nonconformity names the requirement it breaches and the evidence behind it, so it can be acted on rather than argued about. A finding an auditor cannot tie to a requirement is not a finding.

Step 5: The Closing Meeting

The closing meeting presents the results to the people who were audited. The auditor walks through the findings, confirms the nonconformities and their grading, and agrees the timeline for corrective action.

Done well, nothing in the closing meeting is a shock, because the findings were raised as they were discovered. The meeting formalizes them and hands the organization a clear picture of what has to change and by when.

Step 6: The Audit Report and Follow-Up

The audit ends with a report, but the process ends with follow-up. The report states the scope and criteria, the evidence examined, the findings and their grading, and a conclusion on whether the system conforms and is effective. Then the real work begins: the organization addresses the nonconformities through corrective action, and the auditor verifies that each one is genuinely closed. An audit whose findings are never acted on is theater, which is why the internal audit that an organization runs on itself only matters if its findings feed change.

The Audit Program Versus a Single Audit

One audit is not the whole picture. Behind any individual audit sits an audit program, and the two are easy to confuse.

The audit program plans all the audits an organization will run over time, deciding their frequency, coverage, and priority so that the whole management system is examined across a cycle rather than the same corner every time. A single audit is one instance within that program. The program is risk-based, weighting higher-stakes and recently changed areas more heavily, and it is reviewed and adjusted as the AI systems and their risks change. Thinking at the program level is what turns a series of one-off audits into genuine, continuous assurance.

Internal Versus Certification Audit: Same Process, Different Stakes

The six steps are identical whether the audit is first-party or third-party, but the stakes and the independence differ. An internal audit is you checking yourself to find and fix gaps before they cost you. A certification audit is an accredited body, one that operates under ISO/IEC 17021, checking you to decide whether to issue a certificate, run as the two-stage process described in the certification audit. The process is the same examination; the difference is who holds the result and what it is worth.

That shared shape is the reason internal audits are such good preparation. If your internal audit asks the same questions and gathers evidence the same way, the certification audit holds no new surprises.

The Role of the Audit Checklist

Running the process consistently is far easier with a checklist, which turns the standard into a set of questions the auditor works through. A good the audit checklist keeps the evidence gathering structured, makes sure no clause is skipped, and gives the audit a repeatable spine across internal cycles and external stages alike.

Frequently Asked Questions

What Are the Steps of an ISO 42001 Audit?

Planning the audit, an opening meeting, gathering evidence, recording and grading findings, a closing meeting, and the report with follow-up on corrective actions. The sequence is the same for internal and certification audits; what changes is who runs it and what the outcome decides.

How Is Audit Evidence Gathered?

Through interviews with the people who run controls, review of documents and records, direct observation of processes, and sampling a representative subset of cases. Auditors combine these methods because no single one is enough, and because a finding has to rest on evidence rather than assertion.

What Is the Difference Between an Opening and Closing Meeting?

The opening meeting starts the audit by confirming scope, criteria, and logistics so there are no surprises. The closing meeting ends the on-site work by presenting the findings, confirming the nonconformities, and agreeing the timeline for corrective action. One sets expectations; the other delivers results.

Is the Internal Audit Process the Same as the Certification Audit Process?

The process steps are the same, but the context differs. An internal audit is first-party, run by the organization to improve; a certification audit is third-party, run by an accredited body to decide on a certificate. Because the process is shared, a thorough internal audit is the best preparation for the certification one.

What Is the Role of the Lead Auditor?

The lead auditor runs the audit from planning to report. They set the plan, lead the opening and closing meetings, coordinate the audit team, decide how findings are graded, and own the final conclusion. In a certification audit the lead auditor reports findings, but the decision to certify is made separately by the certification body, not by the auditor.

What Happens After an ISO 42001 Audit?

The organization receives a report, addresses any nonconformities through corrective action, and the auditor verifies those actions are completed. For a certification audit, closing the findings leads to the certification decision; for an internal audit, the findings feed the management review and continual improvement.

How Is an AIMS Audit Scheduled?

Through the audit program, which sets the frequency and coverage of audits so the whole system is examined over a cycle, weighting higher-risk and recently changed areas more heavily. Individual audits are then planned within that program, each with its own scope, criteria, and schedule, rather than being arranged ad hoc whenever a deadline looms.

Learn the Process, Then Run It Well

Understanding the audit process is the first step; conducting one with the judgment to gather the right evidence and grade it fairly is a skill. That skill is built through training. You can see every route through the ISO 42001 courses, with the implementer path taught clause by clause in the Lead Implementer certification, so an audit becomes a process you can run, not just sit through.