Auditing AI systems
ISO 19011:2026, clause 5 — Managing an audit programme
An audit programme is the layer above any single engagement: what will be audited over a period, by whom, in what order, and why that order. Clause 5 of ISO 19011:2026 requires the programme to carry its own risk assessment. For AI systems the first programme risk is that nobody knows how many there are.
§ 1 — Who it binds
Who manages a programme, and who just runs engagements
Internal audit function
Any function that manages a programme of audits rather than a single engagement — internal audit functions, second-line assurance teams, and organisations running supplier audit programmes. ISO 19011 states its applicability in those terms, and it is guidance: nothing here creates a duty, and the programme risks it names are the ones a function would otherwise discover late.
§ 2 — In practice
The programme’s risks are not the auditee’s risks
Clause 5 runs from 5.1 to 5.7 and treats the programme as a managed thing — established, resourced, implemented, monitored and reviewed. The sub-clause carrying the weight is 5.3, determining and evaluating audit programme risks and opportunities, and the distinction it depends on is the one functions most often lose. The risks at 5.3 are risks to the programme: that coverage is incomplete, that the people available cannot do the work planned, that access will not be granted in time, that conclusions will be out of date before they are reported. They are not the auditee’s AI risks. A programme document whose risk section describes model bias and hallucination has described the subject matter and left the programme itself unassessed.
Two of those programme risks are specific to AI estates and neither is theoretical. The first is population: the audit universe for AI systems is not derivable from the asset register, because much of the estate arrives as a feature of software already bought, as a model called through an API, or as a workflow someone built without procuring anything. A programme resting on an inventory nobody has reconciled is asserting coverage it cannot evidence. The second is timing — a system reviewed in March may have been retrained twice by the time the report is issued, which is a scheduling constraint on the programme rather than a defect in the engagement, and it belongs where it can change the cycle. The engagement-level consequences of both surface at scoping an AI audit.
The current edition lists a risk-based approach at 4.8 among its principles of auditing, alongside the evidence-based approach at 4.7. Read against clause 5, that is an instruction about where audit effort goes: the programme is the instrument that allocates scarce capacity, and on an AI estate capacity is genuinely scarce, because the competence needed is not evenly distributed across the function. A programme that spreads itself evenly across every system it can name is not risk-based; it is inventory-based. The more useful programme states what it deliberately did not cover this cycle and why — which is also the first question an audit committee asks once it understands the estate is larger than the plan. What each covered engagement then does with that mandate is conducting an AI audit.
§ 3 — When it applies
Current edition, no deadline attached
27 May 2026
BSI publication of ISO 19011:2026, the current edition. A current-edition date for voluntary guidance, not a compliance deadline. Clause numbering differs from the 2018 edition, so older references to programme clauses should be re-checked.
§ 4 — What discharges it
What the programme file must produce
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
A programme risk assessment about the programme, under 5.3
Coverage, competence, access and timeliness, each with what the programme does about it. If the section could be lifted into the auditee’s own risk register unchanged, it is assessing the wrong subject.
02
The AI system inventory the programme claims coverage against, with its reconciliation
A list is easy. The reconciliation is the artefact — expenditure, egress to model endpoints, or software asset data compared against the list, and the delta explained. Coverage asserted against an unreconciled inventory is a percentage of an unknown.
03
A coverage map from programme objectives to planned engagements
Each engagement tied to what the programme is trying to establish, and every named system either in the cycle or explicitly out of it. Systems appearing in neither column are the ones that surface at the audit committee.
04
The programme review record, showing the plan changed when the estate did
Clause 5 treats the programme as monitored and reviewed rather than set annually. On an AI estate the evidence that this happened is a mid-cycle change: something added, something deferred, and the reason recorded in both cases.
§ 5 — Worked example
Worked example — four systems that were never procured
An insurer’s three-year internal audit plan carries two AI-related lines: a governance review in year one and a model validation review in year two. Between the plan being approved and year one starting, the business licensed a claims-triage model, enabled an AI feature in its existing policy administration system, and stood up two internal assistants on a hosted model. None of the three was procured as an AI system.
What does clause 5 require the function to do, and what does it not require?
It does not require the plan to be torn up, and it does not require all four systems to be reviewed. What it requires is that the programme be re-examined rather than executed on assumptions that have expired. Three things follow. The inventory the plan’s coverage rests on is now known to be incomplete, and the way the three arrived — inside a licence, as a feature, on a hosted endpoint — tells the function that it will keep being incomplete, which is a programme risk under 5.3 rather than a one-off correction. The coverage claim has to be restated: two engagements against an estate of unknown size is a different assertion from two engagements against four systems. And the deferral decisions have to be recorded, because an audit committee is entitled to know which systems the function chose not to reach this cycle and on what basis. A programme that absorbs the change silently has lost the only record that would show it was managed.
§ 6 — What a weak answer looks like
One line in the annual plan
One line in the annual plan reading “AI governance review — Q3”. It passes the audit committee, it produces an engagement, and it answers none of the questions clause 5 asks. Nobody has said what the programme is trying to establish about the AI estate over the cycle, what fraction of that estate a single engagement reaches, or what was left out. The failure is not the engagement, which may be perfectly good. It is that a programme was never written, so there is nothing against which the coverage of that engagement can be judged.
§ 7 — Elsewhere
Where the requirement to audit comes from
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
ISO/IEC 42001 places internal audit at clause 9.2, inside its performance-evaluation clause between 9.1 and 9.3. The programme through which such audits are delivered is what clause 5 here addresses; the standard’s own requirement is treated in its collection.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 8 — provenance
The provision itself
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
- ISO 19011:2026, Guidelines for auditing management systems — clause 5 Managing an audit programme (5.1 to 5.7), with 5.3 Determining and evaluating audit programme risks and opportunities, and clause 4 principle 4.8.
- Current edition published by BSI on 27 May 2026. An edition date, not a compliance date.
§ 9 — Also read
Also read
Scoping an AI audit
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.