What Clause 9.2 Expects From an Internal Audit Programme

Clause 9.2 of ISO/IEC 42001 requires every organisation to establish and maintain an internal audit programme. This is not optional bureaucracy; it is the backbone of evidence collection that demonstrates your AI management system actually works. Without it, auditors have no foundation for claiming conformity, and management has no visibility into real practice versus documented procedures.

The standard demands that your audit programme defines objectives clearly. These objectives must go beyond ticking boxes. Instead, they must answer three concrete questions: Are the controls working? Are people following documented procedures? Has the system changed in ways we have not recorded? A weak objective states “audit the system.” A strong objective states “verify that every approved AI system has model documentation meeting Annex A.4.1 criteria, and that approved changes to production models are logged within 24 hours.” Specific objectives guide auditors toward what matters and give management measurable outcomes.

Clause 9.2 also requires you to set the scope. Scope means boundaries. You must decide which parts of the organisation fall under your AI management system, which AI systems matter most, which Annex A controls apply to your operations, and which you can legitimately exclude. A financial services firm using AI only for customer know-your-customer screening has different scope than a healthcare provider deploying diagnostic AI. Scope is not permission to ignore risk; it is a statement of which systems your audit programme monitors. A well-defined scope prevents confusion later about which systems were or were not audited.

The standard explicitly requires a methodology. Methodology describes how you will conduct audits. Will you audit on a fixed schedule or risk-based? Will you use a checklist or open-ended interviewing? Will you sample 100 percent of systems or a statistical subset? Methodology also addresses frequency. Clause 9.2 does not dictate “once per year,” but if you audit every five years, you will struggle to defend that choice when certification auditors ask about it. Most organisations audit high-risk systems annually and lower-risk systems every two years. A documented methodology ensures consistency and allows new auditors to understand the approach.

You must also identify the competence of internal auditors. This requirement sounds simple but trips many organisations. Competence is not a role; it is evidence. You need people who understand ISO 42001 structure, who can recognise what good AI governance looks like, who can ask data scientists intelligent questions without being lost in mathematical detail, and who can identify when documented procedures are bypassed. This does not mean every auditor needs a PhD in machine learning. It means internal auditors must have sufficient technical knowledge to understand what they are auditing. Competence should be documented for each auditor, showing their training and qualifications.

The programme must cover conformity assessment too. Conformity assessment means judging whether the organisation meets ISO 42001 requirements. This includes evaluating whether controls are designed appropriately, whether implementation is effective, and whether monitoring data is collected properly. Your audit programme must structure this evaluation so that management review has clear input. Without a structured conformity assessment approach, audit findings become subjective and difficult for management to act on.

Finally, Clause 9.2 requires that you document the audit programme and make it available. This is not for the certification auditor; this is for your own team and for demonstrating readiness when auditors arrive. A written audit programme helps consistency year to year and ensures that no critical system is forgotten. The documented programme becomes evidence of planning and commitment to systematic oversight. When the certification auditor asks to see the audit programme, you should produce it without hesitation.

An effective audit programme should balance breadth and depth. Breadth means covering all relevant clauses and controls at least once per certification cycle. Depth means examining high-risk areas thoroughly. A maturity trap is to audit broadly but shallowly, finding no real problems. The opposite trap is to audit one area exhaustively every year while ignoring others. Risk-based scheduling allows you to do both: audit everything eventually, but audit high-risk areas frequently.

Consider also the practical constraints of your organisation. How many qualified auditors do you have? How much time can they dedicate to audits? A programme that requires 500 hours per year from three part-time auditors is unrealistic. A realistic programme is one that your organisation will actually follow. It is better to audit four systems thoroughly each year than to plan audits of twelve systems and complete none.

Document the audit programme formally so that all stakeholders know what will happen and when. When departments know an audit is coming, they can prepare evidence in advance. This efficiency improves audit quality and reduces disruption. An audit programme that is hidden or known only to auditors creates surprise and defensiveness when audits arrive.

Frequently asked questions

What does an ISO 42001 internal auditor do?

An internal auditor plans, conducts and reports on audits of the organisation’s AI management system against ISO/IEC 42001 requirements. They examine whether controls are designed appropriately, implemented effectively and monitored properly, then report findings to management review for corrective action.

How often should ISO 42001 internal audits be carried out?

Clause 9.2 does not mandate a fixed frequency, but risk-based programmes typically audit high-risk systems annually, medium-risk systems every 18 months and low-risk systems every two years. The audit programme must cover all relevant clauses and controls at least once per certification cycle.

What is the difference between an internal audit and a certification audit?

An internal audit is conducted by the organisation on its own system. A certification audit is conducted by an external accredited certification body. Certification Stage 1 focuses on documentation and readiness; Stage 2 focuses on operational evidence and interviews. Internal audits prepare the organisation for certification.

What qualifications do you need to audit an AI management system?

You must understand ISO/IEC 42001 and AI governance concepts. You do not need a PhD in machine learning but must be able to ask intelligent questions about data governance, model documentation, monitoring and controls. Competence is typically demonstrated through training (auditor training courses) and documented experience.

What evidence do ISO 42001 auditors ask for?

Auditors request model documentation, data governance procedures, approval records, monitoring logs and data, training records, risk assessments, incident reports and corrective action tracking. Evidence can be documents, logs, interviews or physical examination of systems and processes.

What is a major nonconformity in ISO 42001?

A major nonconformity is a gap that undermines the control’s effectiveness. Examples include a required control does not exist at all, a procedure is not followed systematically, or evidence cannot be produced to demonstrate conformity. Major nonconformities require immediate corrective action.

Can an internal auditor audit their own department?

No. Auditor independence requires that auditors do not audit systems they designed or operate. Conflicts of interest should be documented and managed by assigning different auditors. An auditor who was recently promoted out of a role should wait at least one year before auditing that area.

How do you audit an AI model for conformity?

Examine the model’s documentation (model card), review data governance evidence for the training dataset, verify that the model went through approved deployment procedures, check that performance is monitored in production and verify that the organisation can trace changes to the model and its data.

What is ISO 19011 and how does it apply to AI audits?

ISO/IEC 19011 describes seven audit principles: integrity, impartiality, professional care, confidentiality, evidence-based findings, constructive approach and risk focus. These principles guide internal auditors conducting AI management system audits, ensuring audits are fair, objective and focused on what matters most.