Skip to content
AIAC AI ASSURANCE COUNCIL™

Role

Internal auditor

Putting an AI system in the audit plan, and being asked to give an opinion on something probabilistic.

§ 1 — What you carry

Where the duty attaches

The duty here is owed by the function, not by the organisation it sits inside. The internal auditing standards bind the way the work is planned, evidenced and reported — competence to take the engagement on, sufficiency of evidence for the conclusion drawn, and the independence to report what was found.

The trap is treating an AI system as an IT system with a model in it. An IT control either operates or does not; a probabilistic control operates to a degree, and an audit programme written for the first produces a finding that cannot be sustained when challenged. The obligations below are the ones that decide what sufficient evidence looks like when the control does not give the same answer twice.

Also written as head of internal audit, IT auditor, audit manager. Everything below is drawn from the obligation dataset by the capacity that binds this role, not by job title — 4 provisions across 1 collection.

§ 2 — The obligations

What binds you

Auditing AI systems

4 provisions

§ 3 — Evidence

The artefacts this role owns

Drawn from the evidence column of the provisions above, most widely demanded first. These are what an assessor asks this role to produce.

  • 1xA boundary statement separating the model from the process around it
  • 1xA cause analysis that terminates at a control
  • 1xA corroboration record where one source carried a conclusion
  • 1xA finding sheet carrying criteria and condition as separate fields
  • 1xA likelihood count taken from the population, not the sample
  • 1xA reperformance note written by a second person
  • 1xA reperformance trace for every procedure run against the model
  • 1xA retention record checked against the artefacts the papers rely on
  • 1xA scope memorandum stating the versions and the period
  • 1xA work programme with a step against each objective
  • 1xAn effects statement separating what occurred from what could occur
  • 1xAn engagement risk assessment naming the AI systems excluded

§ 5 — Examined in

Where this is examined

Read from the syllabus entries the provisions above actually carry, not matched by job title. The count is how many of this role's obligations each credential examines, so you can see how much of the role it covers.