ISO 42001 Clause 9.2.2: Build an Internal Audit Programme

What clause 9.2.2 requires in practice

Clause 9.2.2 turns the purpose of internal audit into an organised programme. The organisation must plan, establish, implement and maintain one or more audit programmes covering how often audits occur, the methods, who is responsible, planning needs and reporting. When setting the programme it must weigh how important the processes concerned are and what earlier audits found.

For each audit it must define the objectives, criteria and scope, select auditors and conduct audits in a way that ensures objectivity and impartiality, and make sure results are reported to relevant managers. Documented information must be available as evidence that the programme was implemented and of the audit results. The clause does not set one frequency for everyone. Its outputs are a risk-aware programme, individual audit plans and records that show what was actually examined and concluded.

Plan coverage according to significance

An audit programme is more than a list of dates. Determine which processes need examination and why. A rapidly changing AI service, a consequential decision path or an area with recurring findings may deserve different attention from a stable supporting process.

The standard does not require equal time for every department or a fixed audit frequency for all organisations. As an original planning approach, connect proposed coverage with important AI activities and known uncertainties. Check that shared processes and supplier interfaces do not fall between departmental audits.

Why clause 9.2.2 matters to the business

A programme is how audit effort is spent wisely. Without one, audits tend to follow convenience, leaving high-consequence processes untouched for long periods while minor ones are checked repeatedly. In an AI setting, where suppliers and uses shift quickly, a programme that adjusts to change finds problems sooner and cheaper. Impartial auditors also protect the organisation from the blind spots of those who built the process. Evidence that the programme actually ran, including what was dropped and why, gives senior managers, customers and certification auditors confidence that the system is monitored accurately rather than on a calendar that nobody follows.

How to implement clause 9.2.2

Build the programme around what matters and what has gone wrong before. The sequence below reflects practice Sterling teams commonly use, without being a prescribed method. A short written rationale for each choice helps later when someone asks why one area was examined and another was not.

1. List the AI processes and shared interfaces, ranking them by consequence and by pace of change.
2. Review past findings and repeated weaknesses, and reserve follow-up audits for causes that recur.
3. Set an audit frequency for each area, with room for an unscheduled audit after a major change.
4. Write objectives, criteria and scope for each audit, even when the scope crosses departments.
5. Check auditor impartiality, using cross-functional or outside support in small teams where roles overlap.
6. Match any specialist knowledge needed to each audit, rather than assuming seniority is enough.
7. Record every completed audit and every cancelled one, with the decision to cancel, and report results to the managers responsible.

Illustrative software example: changing model suppliers

Illustrative manufacturing example: a recurring review weakness

A manufacturer has repeated findings about incomplete verification of AI inspection controls. Different production teams close actions by issuing reminders, but later audits identify the same problem. Previous results should influence the programme.

A follow-up audit examines cause assessment, action effectiveness and whether similar exposure exists across lines. It does not merely count closed actions. The programme allocates enough attention to understand the repeated weakness and reports the result to management able to change the arrangement.

Define each audit clearly

Objectives explain what the audit should achieve; scope identifies its boundaries; criteria identify the requirements used to evaluate evidence. Avoid replacing all three with the name of a department. A focused audit can cross departments when the decision path does.

Choose methods that can answer the questions. Records, interviews and observation provide different perspectives. If remote review cannot show an important operating interaction, adapt the method rather than claim complete coverage from incomplete evidence. Document relevant limitations.

Arrange impartiality and competence

Auditors need to evaluate evidence objectively. Consider conflicts where a person would audit their own design or operating decisions. Small organisations can use cross-functional or external support where appropriate, but should still examine whether the arrangement protects impartiality.

Technical expertise may be needed for a particular subject. An audit team can combine audit skills and specialist knowledge. Neither a course certificate nor a senior title alone establishes suitability for every AI audit. Match capability to the criteria and activities being examined.

Report and retain the evidence

Common mistakes