Role
Internal auditor
Putting an AI system in the audit plan, and being asked to give an opinion on something probabilistic.
§ 1 — What you carry
Where the duty attaches
The duty here is owed by the function, not by the organisation it sits inside. The internal auditing standards bind the way the work is planned, evidenced and reported — competence to take the engagement on, sufficiency of evidence for the conclusion drawn, and the independence to report what was found.
The trap is treating an AI system as an IT system with a model in it. An IT control either operates or does not; a probabilistic control operates to a degree, and an audit programme written for the first produces a finding that cannot be sustained when challenged. The obligations below are the ones that decide what sufficient evidence looks like when the control does not give the same answer twice.
Also written as head of internal audit, IT auditor, audit manager. Everything below is drawn from the obligation dataset by the capacity that binds this role, not by job title — 19 provisions across 2 collections.
§ 2 — The obligations
What binds you
Auditing AI systems
10 provisions
- IIA Standard 13.3 — Engagement Objectives and Scope
- IIA Standard 13.4 — Evaluation Criteria
- IIA Standard 14.1 — Gathering Information for Analyses and Evaluation
- IIA Standard 14.6 — Engagement Documentation
- IIA Standards 14.2 and 14.3 — Analyses and Potential Engagement Findings; Evaluation of Findings
- ISO 19011:2026 clause 7 · ISO/IEC 42006:2025 clause 7.1 — Competence and evaluation of auditors · Competence of personnel
- ISO 19011:2026, clause 5 — Managing an audit programme
- ISO 19011:2026, clause 6 — Conducting an audit
- NIST AI RMF MEASURE 2.3 · IIA Standard 14.1 — AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)
- Standards 14.3, 15.1 and 15.2 — Evaluation of Findings · Final Engagement Communication · Confirming the Implementation of Recommendations or Action Plans
ISO/IEC 42001
9 provisions
- Annex A and Annex B — Reference control objectives and controls · Implementation guidance for AI controls
- Clause 4.1 — Understanding the organization and its context
- Clause 4.3 — Determining the scope of the AI management system
- Clause 5.2 — AI policy
- Clause 5.3 — Roles, responsibilities and authorities
- Clause 6.1.2 — AI risk assessment
- Clause 7.2 — Competence
- Clause 8.4 — AI system impact assessment
- Clause 9.2, with 9.2.1 and 9.2.2 — Internal audit · General · Internal audit programme
§ 3 — Evidence
The artefacts this role owns
Drawn from the evidence column of the provisions above, most widely demanded first. These are what an assessor asks this role to produce.
- 1xA boundary statement separating the model from the process around it
- 1xA cause analysis that terminates at a control
- 1xA challenge-test log with adversarial cases and outcomes
- 1xA communication record showing reach rather than circulation
- 1xA competence determination made before people are assigned
- 1xA context register keeping external and internal issues apart
- 1xA corroboration record where one source carried a conclusion
- 1xA coverage map from programme objectives to planned engagements
- 1xA criteria paper naming the source and authority of each criterion
- 1xA deployment-similarity argument for any performance figure relied on
- 1xA derivation trace from the policy to each AI objective
- 1xA documented statement of generalisability limits
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.