An ISO audit is a comparison between what the organisation says it does, what the standard requires and what actually happens. AI helps most with the first two. The third needs a person standing in the place where the work is done. That split decides where to use a model and where not to.
The audit method itself is set out in how to run an ISO internal audit using ISO 19011 guidance. This post looks at the places where AI fits into that method.
Where a model helps
Document review before the visit. Management system documents are long: manuals, procedures, work instructions, risk registers, supplier lists. A model can read a procedure and list which clauses of the standard it appears to address and which it does not mention. The output is a set of questions to ask, not findings.
Gap lists. Given the standard's requirements as you have them, and the organisation's procedure, the model can draft a table of requirement, where covered, and apparent gap. Treat it as a starting checklist. Models misquote clause numbers, so check each against the standard you hold.
Interview preparation. Based on the process and the evidence list, a model can propose open questions for each role. "Walk me through what happens when a customer complaint arrives" is better than "do you have a complaints procedure". Edit the list to suit the auditee.
Sampling lists for records. If records are held in a sheet, a model can help summarise them, spot blanks and late dates, and prepare a list of items to examine. Pick the actual sample by a stated method.
Drafting. Audit plans, opening and closing meeting notes, report summaries and the wording of nonconformities, from facts you provide.
Where it does not belong
- Observation of the process. A procedure may be perfect on paper and ignored in practice. Only observation, interviews and sampled records tell you which.
- Deciding major or minor. Grading a nonconformity depends on the system's ability to achieve its objectives and on the pattern of failure. See major versus minor nonconformities.
- Confirming certification outcomes. A certification body decides certification. An internal audit prepares for it but does not predict it.
- Replacing auditor competence. Auditors need to understand the process they audit. A model that explains a clause does not give the auditor judgement about whether the evidence is enough.
A worked pattern for a clause-by-clause audit
Take a quality management audit.
- Give the model the organisation's purchasing procedure with identifiers removed.
- Ask: "List the requirements of the supplier control clause that this procedure does not clearly address. Quote the sentence of the procedure you relied on for each point."
- Read the quotes. Remove any that do not appear in the procedure.
- Turn the remaining gaps into interview questions for the purchasing lead.
- At the visit, sample supplier approvals, re-evaluations and purchase orders, and compare with the procedure.
- Write the finding from what you saw. Use the model, if you like, to improve the wording.
Step 3 is not optional. Models can attribute sentences to documents that do not contain them.
Information security and AI standards
For information security audits, a model can map controls in a statement of applicability to the organisation's policies and show where evidence is thin. See the ISO 27001 internal audit guide. For organisations that themselves use AI and are looking at the AI management system standard, the ISO 42001 internal audit checklist sets out questions. In both cases, sensitive information, such as network diagrams and vulnerability reports, should not go to a tool without a review of its data terms.
Evidence rules still apply
Audit evidence in ISO terms is records and statements that are verifiable. A model's summary is not verifiable on its own. Reference the original record in the working notes and keep the model's output as a drafting aid. Where a finding goes into a report, a person should have seen the evidence.
Confidentiality and independence
Internal auditors handle confidential commercial information, and the auditee may be asked for consent before documents go to an external tool. Independence is also in play: the person using the model should not use it to audit their own work. If a model helped write the procedure being audited, say so and consider who reviews.
Making the output useful
- Provide the exact version of the standard and the clause text you want assessed.
- Ask for quotes and page numbers from the documents.
- Request questions, not conclusions.
- Keep a record of the model, date and prompt in the audit file, as in the AI-use note.
- Rework the draft in your own voice so the report is the auditor's, not the model's.
Frequently Asked Questions
Can AI write an ISO audit report?
It can draft wording from findings you supply. The findings themselves must come from evidence you collected.
Will a certification body accept AI-assisted internal audits?
Internal audit requirements concern competence, objectivity and evidence. Check with your certification body if you have doubts about your approach.
Which clauses are models best at?
There is no safe general answer. Test on your own documents and check clause references each time.
Last reviewed: 17 October 2026. Facts checked. No ISO, IAF or certification body page was opened in this session. Clause numbers and standard text are not quoted, because they must be taken from the licensed standard. The audit method is described in general terms. No model comparison, price or release date is claimed.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error