Certified AI Audit Foundation

Who this certification is for

For internal and IT-audit functions that must plan, execute, and report an audit of an AI system — and stand behind the finding. An open, no-prerequisite entry point below the advanced audit credentials in the market.

Who it is for. Internal auditors, IT auditors, and assurance providers extending into AI systems.

Prerequisites

No formal prerequisites. Recommended: an audit qualification or experience in an internal or IT audit function.

Status

Open for registrationOpen for registration · Examinations from October 2026

This is the Foundation grade of the AI Audit family — Practitioner and Fellow follow it.

What the examination covers

The examination is mapped to AI audit and evidence practice: control testing, evidence sufficiency, and the audit trail. Weightings are indicative until each syllabus issues.

1. 01

   Audit planning and scoping20%

   Converting "audit our AI" into an executable scope with defined criteria, boundary, and period.

2. 02

   Control identification and testing25%

   Identifying and testing controls across the AI lifecycle, including systems whose behaviour is probabilistic.

3. 03

   Evidence and working papers25%

   Evidence sufficiency, audit trail, and working-paper standards that let another auditor reach the same conclusion from the same file.

4. 04

   Assurance concepts and boundaries15%

   Assurance concepts, and the boundary between an audit and a conformity assessment.

5. 05

   Reporting the finding15%

   Reporting a finding a sceptical reader can challenge, graded proportionately and tracked to closure.

Curriculum mapping indicates alignment of learning content with published frameworks. It does not constitute endorsement by, or certification under, any standards organisation or regulator.

What preparation is anchored to

Anchored to recognised audit frameworks and ISO/IEC 42001, with ISO/IEC 42006 conformity-assessment concepts referenced. Candidates prepare independently against the published materials.

The Council certifies individuals — it sells no preparation of any kind, and how a candidate prepared is never visible to an assessor. How impartiality is protected.

One route: the examination

The full rules — registration, identity verification, examination conduct, adjustments, retakes — are in the candidate handbook.

Fees and the pass standard are fixed in the scheme rules and confirmed ahead of the October 2026 examination window.

How candidates are assessed

Examination centred on an audit context supplied at the start, requiring an evidence sufficiency assessment and a written finding with a proposed grading.

Every script is marked twice — an AI assessor first and provisional, an independent human assessor second and final. The credential carries a unique identifier any employer can check on the public register.

Questions about this certification

What are the prerequisites?

No formal prerequisites. Recommended: an audit qualification or experience in an internal or IT audit function.

When can I sit the examination?

Registration is open now through the candidate portal; examination sittings run from the October 2026 window and are scheduled at booking.

How is the examination marked?

Every script is marked twice, in a fixed order: an AI assessor first, producing a provisional mark, and an independent human assessor second, whose determination is final on any divergence. No result is issued on automated marking alone, and no adverse decision — a fail, a suspension, a withdrawal — is ever made without a human assessor.

How long is the credential valid?

2 years from the date of issue, recorded on the public register. The term and what follows it are set out in the revalidation policy.

Scheme-wide questions are answered on the FAQ and in the candidate handbook.

Background reading

• AI assurance vs AI audit vs AI risk assessment

  Three terms used interchangeably that mean different things, have different outputs, and require different independence. A practitioner-level distinction.

• What is AI assurance? A practitioner's definition

  Producing credible, independently reviewable evidence that an AI system works as intended — and how that differs from governance and compliance.