AI Audit

As AI takes on more important roles, people want more than assurances that it works well and is used responsibly. They want evidence. An AI audit provides it. Auditors examine how an AI system was designed, trained and tested, how it performs in practice, whether it treats people fairly, how it is secured and monitored and whether it meets the organization's policies and legal requirements. Audits can also look at the organization as a whole, testing whether its AI governance program works. The results give leaders, regulators, customers and the public an independent view of AI risk. Independence matters because the teams that build AI are not always best placed to judge it.

AI audits are becoming more common and, in some places, mandatory. New York City has required annual independent bias audits of automated employment decision tools since 2023. ISO 42001 certification involves audits of an organization's AI management system. Internal audit functions increasingly include AI in their plans, and customers ask AI vendors for independent assurance. For risk, compliance, internal audit and technology leaders, AI audits are a key part of showing that AI is under control.

Definition of AI Audit

An AI audit is a systematic, evidence-based examination, carried out by internal or external auditors independent of the system's owners, of an AI system, use case or governance program against defined criteria, such as policies, standards, regulations, performance targets and fairness measures, with findings and recommendations reported to stakeholders.

AI audits extend the practice of internal audit to AI, test controls set out in an AI governance framework and often assess algorithmic bias.

Types of AI Audits

Governance audits evaluate whether the organization's AI governance program, including policies, inventory, risk assessments and oversight, is designed and operating effectively. They check whether governance works in practice, not just on paper.

System audits evaluate a specific AI system's design, data, performance, fairness, security, documentation and monitoring. They are usually reserved for high-risk or high-impact systems.

Bias audits focus on whether an AI system produces unfair differences in outcomes across groups, as required by some laws. Results are often published, so they must be clear and accurate.

Compliance audits test whether AI systems meet specific legal or contractual requirements, such as those of the EU AI Act. They often focus on documentation, oversight and transparency duties.

Certification audits, such as those for ISO 42001, are carried out by accredited bodies against a published standard. They lead to a certificate that can be shared with customers.

What Auditors Examine

Auditors review documentation, such as model cards, data sheets, risk assessments and approval records. Missing or outdated documentation is itself a common finding.

They examine data, including sources, quality, representativeness and handling of personal data.

They assess performance and fairness, through independent testing or review of the organization's test results. Independent testing gives stronger evidence than reviewing the owner's own results.

They test controls, such as human oversight, guardrails, access controls and change management.

They review monitoring and incident records, to see how the system behaves in use and how problems are handled.

Importance of AI Audits in AI Governance

AI audits provide independent assurance. Leaders and boards receive an objective view of whether AI risks are managed, rather than relying only on the teams that build and run AI. This helps boards meet their oversight duties.

They meet legal and customer requirements. Some laws require AI audits, and many customers expect independent evidence before trusting AI vendors.

They also drive improvement. Audit findings reveal gaps in governance, documentation, testing and monitoring that teams can fix. Recurring findings across audits point to weaknesses in the wider program.

AI Audits and Financial Management

External AI audits and certifications have direct costs, while internal audits require skilled staff time.

Audits that find problems early can prevent costly incidents, fines and lawsuits.

Independent assurance can shorten sales cycles when customers require evidence of responsible AI.

A risk-based audit plan focuses spending on high-impact AI systems rather than auditing everything equally. Lower-risk systems can be covered through sampling or self-assessment.

Common Challenges

Standards and methods for AI audits are still developing, so approaches vary. Using recognized frameworks as criteria helps make results comparable.

Auditors need a mix of technical, risk and domain expertise that is in short supply. Many audit teams pair internal auditors with data scientists or outside specialists.

Audits of vendor AI depend on vendors' willingness to share information and allow testing. Contract terms that grant audit rights make this easier.