ISO 42001 for Internal Auditors: From Management System to Evidence
An organization can have an AI policy, an AI steering committee, and dozens of documented controls and still lack a management system that actually works. For internal auditors, that distinction matters more than the volume of documentation.
ISO/IEC 42001:2023 is not primarily a catalogue of technical AI controls or a standard for validating individual models. It is a management-system standard that connects organizational context, leadership, planning, operation, performance evaluation, and continual improvement. ISO describes that logic through the Plan-Do-Check-Act methodology.
For Internal Audit, the implication is practical: do not start by asking whether a control exists. Start by asking whether the organization can demonstrate a coherent chain from AI objectives and risks to decisions, controls, results, and improvement actions.
ISO 42001 is a management system, not a model checklist
The standard is intended for organizations that develop, provide, or use products or services involving AI systems. Its structure follows the common architecture used across ISO management-system standards.
Through an audit lens, that structure can be reduced to four questions:
- Plan: Does the organization understand its context, interested parties, AIMS scope, objectives, risks, and potential impacts?
- Do: Has it assigned accountability, resources, and competence, and does it operate processes and controls consistent with those decisions?
- Check: Does it monitor performance, evaluate effectiveness, conduct internal audits, and perform management reviews?
- Act: Does it address nonconformities and improve the system when evidence shows that intended results are not being achieved?
This is why treating ISO 42001 as a control library misses the point. The standard expects a system of governance and management capable of making risk-based decisions and producing evidence that those decisions are implemented and reviewed.
Follow the evidence chain, not the document list
ISO 42001 is especially useful to internal auditors because it turns broad governance concepts into auditable artifacts. Those artifacts should not be inspected in isolation. They should reconcile across the management cycle.
| AIMS element | Evidence Internal Audit can request | What the auditor should test |
|---|---|---|
| Context and scope | context analysis, interested-party needs, applicable requirements, documented AIMS scope | whether the stated scope reflects material AI use and avoids unsupported exclusions |
| Leadership and direction | AI policy, assigned roles, AI objectives, top-management decisions | whether policy is translated into authority, resources, priorities, and operational accountability |
| Risk and impact | risk methodology and results, risk criteria, AI system impact assessments | whether assessments are repeatable, decision-relevant, and consider consequences for the organization, individuals, and society where relevant |
| Treatment and controls | risk treatment plan, statement of applicability, selected controls, residual-risk approvals | whether control selection is traceable to risk and exclusions are justified |
| Operation and performance | lifecycle procedures and records, third-party controls, change records, metrics and monitoring results | whether processes operate as designed and control effectiveness is actually measured |
| Review and improvement | internal-audit results, management-review records, nonconformities, corrective actions | whether weaknesses trigger decisions, root-cause analysis, remediation, and effectiveness checks |
Reconciliation is often more persuasive than document inspection. A high-rated AI risk, for example, should be traceable to an approved treatment decision, specific controls, accountable owners, operating evidence, performance information, and corrective action when results fall short.
Annex A is not a universal mandatory-control checklist
One of the most important points for auditors is how the standard treats its reference controls.
Annex A covers control objectives and controls across topics such as AI policy, internal organization, resources, impact assessment, system lifecycle, data, information for interested parties, responsible use, and third-party relationships. But the organization is not required to implement every Annex A control automatically.
Clause 6.1.3 requires the organization to determine the controls needed to implement its chosen risk treatments, compare them with Annex A to ensure necessary controls have not been overlooked, and produce a statement of applicability that explains control inclusions and exclusions. Additional controls can also be designed where needed.
That changes the audit procedure. A clause-by-clause “yes/no” test against every Annex A control can create false findings. The stronger question is whether control selection is reasonable given the organization's context, risk assessment, impact assessment, and applicable requirements.
Annex B requires similar discipline. Although it is part of the normative structure of the document, its role is to provide implementation guidance for the controls. ISO explicitly allows organizations to adapt that guidance and does not require each piece of implementation guidance to be justified in the statement of applicability. Auditors should not turn guidance into a requirement the standard does not impose.
Clause 9.2 is not the same thing as the corporate Internal Audit function
ISO/IEC 42001 requires internal audits at planned intervals to determine whether the AIMS conforms to the organization's own requirements and to the standard, and whether it is effectively implemented and maintained. The audit programme must address matters such as frequency, methods, responsibilities, planning, and reporting; individual audits need defined objectives, criteria, and scope, with objectivity and impartiality protected.
However, “internal audit” in an ISO management-system standard does not automatically mean the corporate Internal Audit function. A first-party management-system audit can be performed by the organization itself or by an external party on its behalf, provided the audit process remains impartial. The corporate Internal Audit function has a broader professional mandate under the Global Internal Audit Standards.
In practice, three models can work: Internal Audit can perform selected AIMS audits; it can independently assess an AIMS audit programme administered elsewhere; or it can use ISO 42001 as evaluation criteria within a broader AI governance engagement.
The choice should protect Internal Audit's independence and avoid transferring management responsibility for the AIMS to the assurance function.
For management-system audit methodology, the current reference is ISO 19011:2026, published in May 2026. This matters because ISO 19011:2018 has been withdrawn and replaced. The 2026 edition provides guidance on audit principles, audit programme management, conducting audits, and auditor competence; it is guidance and does not itself lead to certification.
A useful audit programme is built around traceability
A practical first review of ISO 42001 can be organized into five moves.
- Set the criteria and scope. Decide which part of the AIMS is being assessed and which ISO clauses, internal requirements, and applicable external obligations form the criteria.
- Prioritize by risk. Focus on AI uses that affect significant decisions, people, sensitive data, critical processes, or material third-party dependencies.
- Build the evidence chain. Trace a sample of risks from identification through treatment, control selection, operation, monitoring, and improvement.
- Test design and operation. Policies and matrices are not enough. Inspect records, observe processes, interview accountable owners, examine exceptions, and test whether monitoring information reflects actual performance.
- Conclude on the system. An isolated nonconformity matters, but patterns matter more. The central question is whether the AIMS can keep AI risk under control as use cases, suppliers, technology, and expectations change.
The strongest evidence of a mature AIMS is not a complete folder. It is a closed loop in which risks change decisions, controls produce measurable results, and results change the system.
ISO 42001 gives Internal Audit a valuable bridge between AI governance and verifiable evidence. Used well, it does not reduce assurance to clause checking. It lets auditors test whether the organization knows what AI it governs, why it accepts particular risks, how those risks are controlled, and what happens when evidence shows that its assumptions are no longer valid.