An ISO 42001 internal audit checks whether a company's AI management system, the policies, roles, risk assessments and operating controls it has set up around its use of AI, exists on paper, works in practice and is being improved. The checklist below gives audit questions and the evidence to ask for in seven areas: context and scope, leadership and policy, planning, support, operation, performance evaluation and improvement.
Two cautions first. The standard itself, ISO/IEC 42001:2023, is a paid document; buy it from ISO or from your national standards body (in India, the Bureau of Indian Standards) before you audit against it. And this checklist is a starting point written in our own words. It does not reproduce the standard's requirements and is not a substitute for reading them.
Start here if you want a working file:
| Need | Use this |
|---|---|
| Editable inventory, control test and evidence request sheets | AI Governance Internal Audit Workpaper |
| An audit programme for AI agents the company runs | How to audit AI agents |
| A written rule for how the audit team itself uses AI | Internal Audit AI Strategy Template |
What ISO/IEC 42001 is
We could not open ISO's own page for the standard while writing this (it refused automated access), so the description below comes from pages we could read, each named.
Microsoft's compliance documentation describes ISO/IEC 42001 as "an international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations". It says the standard is "designed for entities providing or utilizing AI-based products or services". Amazon Web Services' page on the standard uses the same description.
KPMG Switzerland calls it "the world's first AI Management System (AIMS) standard" and dates its introduction to December 2023. A-LIGN, a certification body, says it "applies to organizations of any size" and that the scope of certification depends on the AI systems and use cases in place.
Three points for an internal auditor:
- It is a management system standard. It asks whether the organisation has a working system for governing AI. It does not certify that a particular AI model is accurate or fair.
- It is voluntary. We know of no Indian law that requires it.
- It can be certified. NQA, another certification body, describes a certificate valid for three years, with surveillance audits in the first two years and recertification in the third.
How the standard is structured
A-LIGN notes that ISO 42001 and ISO 27001 "share a similar structure, covering leadership, planning, support, operation, performance evaluation, and improvement". ISMS.online, a compliance software provider, lists the requirement headings as Context of the Organisation, Leadership, Planning, Support, Operation, Performance Evaluation and Improvement. If your company already runs an information security or quality management system, the shape will be familiar.
A-LIGN describes four annexes:
| Annex | A-LIGN's description |
|---|---|
| A | A management guide for AI system development, including a list of controls |
| B | Implementation guidance for the controls listed in Annex A |
| C | AI-related organisational objectives and risk sources |
| D | Domain- and sector-specific standards |
ISMS.online lists the control topics in the first annex as covering AI policies, internal organisation, resources for AI systems, assessing the impacts of AI systems, the AI system life cycle, data for AI systems, information for interested parties, use of AI systems, and third-party and customer relationships. We have not reproduced control numbers or wording. Take those from your own copy of the standard.
Before you start: three things to obtain
- The standard. One licensed copy for the audit team.
- The scope statement. Which entities, locations, business units and AI systems the management system covers.
- The AI inventory. Every AI system the company develops, provides or uses within that scope, with an owner for each.
If the second or third does not exist, that is your first finding.
The checklist
Each area gives audit questions in plain words and the evidence to ask for. Mark each question as met, partly met or not met, and note the document you saw.
1. Context and scope
| Audit question | Evidence to ask for |
|---|---|
| Has the company written down which AI systems, units and locations are inside the management system, and why others are outside? | Scope statement, approved and dated |
| Does it know what role it plays for each system: developer, provider, or user of someone else's AI? | AI inventory with a role column |
| Is the inventory complete? | Compare with software purchase records, IT asset lists and a short survey of department heads |
| Has it identified who is affected by its AI: customers, employees, regulators, vendors? | Interested-party list with their expectations |
| Are legal and contractual obligations that touch AI listed? | Obligations register, including customer contract clauses |
Tools bought on a department credit card and AI features switched on inside existing software are the usual gaps in the inventory.
2. Leadership and policy
| Audit question | Evidence to ask for |
|---|---|
| Is there an AI policy approved by senior management? | Policy with approval date and approver |
| Does the policy say what the company will and will not use AI for? | Policy text; list of prohibited or restricted uses |
| Is a named person or committee accountable for the management system? | Role description, committee terms of reference |
| Do the Board or audit committee receive reports on AI? | Board or committee papers and minutes for the last year |
| Do staff know the policy exists? | Communication records; ask five employees |
3. Planning: risk and impact assessment
| Audit question | Evidence to ask for |
|---|---|
| Is there a written method for assessing AI risk, with criteria for what is acceptable? | Risk assessment procedure |
| Has a risk assessment been done for each system in the inventory? | Risk register, dated, with owners |
| Has the company assessed the impact of each system on the people it affects, not only on the company? | Impact assessments for each system |
| For each risk, is there a decision: treat, accept, avoid, transfer? | Risk treatment plan with sign-off |
| Has the company recorded which controls it applies and which it does not, with reasons? | Its statement of which controls apply, and the justification for exclusions |
| Are there measurable objectives for the management system? | Objectives, targets, and progress reports |
| Are assessments repeated when a system changes? | Change records matched to re-assessment dates |
Risk to the company and impact on people are separate questions. A system can be low risk commercially and still have a serious effect on a job applicant or a borrower.
4. Support: people, competence and documents
| Audit question | Evidence to ask for |
|---|---|
| Are the people who build, buy, run and oversee AI competent for the role? | Role requirements, training records, qualifications |
| Have general staff been told how they may and may not use AI tools? | Awareness training material and attendance |
| Are resources (people, data, computing, tools) identified for each system? | Resource records per system |
| Are policies and records controlled: versioned, approved, retrievable? | Document register; pick three documents and trace versions |
| Is there a way for staff or outsiders to raise a concern about an AI system? | Reporting channel and the log of concerns raised |
5. Operation
| Audit question | Evidence to ask for |
|---|---|
| Is each AI system taken through defined stages (design or selection, testing, approval, release, monitoring, retirement) with a record at each? | Life-cycle records for a sample of systems |
| Was each system tested before use, against stated acceptance criteria? | Test plans, results and approval to release |
| Is the origin, quality and permitted use of the data behind each system documented? | Data records: source, rights to use, quality checks |
| Are users and affected people told what they need to know about the system? | User documentation, notices, disclosures |
| Where a person is meant to review or override the system, does that happen? | Override logs; observe the process |
| Are suppliers of AI systems and components assessed and bound by contract? | Vendor assessments, contract clauses, vendor certificates |
| Are changes to a system controlled and logged? | Change log matched to approvals |
| Are operating logs kept so that an incident can be reconstructed? | Log samples and retention settings |
6. Performance evaluation
| Audit question | Evidence to ask for |
|---|---|
| Does the company monitor whether each system still performs as intended? | Monitoring reports and thresholds |
| Is there an internal audit programme for the management system, with independent auditors? | Audit plan, auditor assignments, reports |
| Does top management review the system at planned intervals? | Management review minutes, inputs and decisions |
| Are incidents and complaints recorded and analysed? | Incident register with root causes |
The internal audit you are performing is itself part of this area. Check that the auditors are independent of the AI systems they review, and that you are not auditing your own team's work.
7. Improvement
| Audit question | Evidence to ask for |
|---|---|
| When something goes wrong, is the cause found and fixed, not only the symptom? | Corrective action records with root cause |
| Are actions from earlier audits and reviews closed, with evidence? | Action tracker; retest a sample of closed items |
| Can the company show the system has improved over the last year? | Before-and-after measures; revised documents |
Worked example: one question, tested
This example is illustrative.
A services company uses a third-party AI tool to shortlist job applicants. The audit question, from area 3, is whether the company has assessed the tool's impact on the people affected.
| Step | What the auditor did | What was found |
|---|---|---|
| 1 | Confirmed the tool is in the AI inventory | Listed, owner is the HR head, role recorded as "user" |
| 2 | Asked for the risk assessment | Present, dated, covers data security and vendor dependence |
| 3 | Asked for the impact assessment | Not prepared; HR said the vendor's brochure covered fairness |
| 4 | Asked how a rejected applicant can ask for a human review | No process |
| 5 | Checked the vendor contract | No clause on testing for unfair outcomes; vendor holds an ISO 42001 certificate |
Observation. The company assessed risk to itself but not the effect on applicants. It relied on the vendor's certificate, which covers the vendor's management system, not the company's use of the tool. Recommendation. Prepare an impact assessment for the shortlisting tool, add a human review route for rejected applicants, and seek a contract clause giving access to the vendor's testing results. Owner: HR head. Target date agreed with management.
The lesson carries across the checklist: a vendor's certificate is evidence about the vendor, and the company still has to show its own controls.
The India lens
Who is asking for it. Certification has begun to appear among professional services firms in India: a PR Newswire release carried by WebIndia123 on 15 December 2025 reported that KPMG in India received ISO 42001 certification from SGS for its Gurugram and Noida offices. As a general observation, and not a statistic, the pressure on most Indian companies comes from customers: overseas clients of IT and business-services providers, and large buyers whose vendor questionnaires now ask how AI is governed. A company answering those questionnaires is often the one that asks internal audit for a readiness review.
Law. We know of no Indian law that makes ISO 42001 mandatory. Regulated entities should check what their own regulator expects on AI and model governance, which sits on top of any voluntary standard.
Beside the DPDP Act. The two do different jobs. The Digital Personal Data Protection Act is law, and it governs how personal data is handled, whether or not AI is involved. ISO 42001 is a voluntary system for governing AI, whether or not personal data is involved. They meet wherever an AI system uses personal data: the data records in area 5 and the impact assessment in area 3 are where the audit should confirm that the company's data protection duties have been considered. A certificate does not show compliance with the Act, and compliance with the Act does not amount to an AI management system. See DPDP for CA firms.
Internal audit standards. ICAI lists its Compendium of Standards on Internal Audit (as on February 2026) as applicable from 1 April 2026. Plan, evidence and report this review under the standards your function follows; see the site's Standards on Internal Audit section and check the compendium before citing a number.
ISO 42001 internal audit FAQ
What is an ISO 42001 internal audit?
It is the organisation's own review of whether its AI management system meets the standard and its own policies, and whether it is working in practice. It is performed by people independent of the AI systems reviewed and reported to management.
What should an ISO 42001 internal audit checklist cover in 2026?
It should cover context and scope, leadership and policy, planning with risk and impact assessment, support and competence, operation, performance evaluation and improvement, plus the controls the company has chosen to apply. For each, record the question, the evidence seen and the result.
Is ISO 42001 mandatory in India?
We know of no Indian law that makes it mandatory. It is a voluntary standard, usually adopted because customers ask for it or because the Board wants a recognised structure for AI governance.
Who can perform an ISO 42001 internal audit?
Anyone competent in management system auditing and in the AI systems in scope, and independent of the work being audited. This can be the internal audit function, a trained cross-functional team or an outside firm. The certification audit is separate and is done by an accredited certification body.
Where can I get the ISO 42001 standard?
Buy it from ISO or from your national standards body; in India, check the Bureau of Indian Standards. Free summaries, including this one, are not a substitute.
Related CORAA resources
- AI Governance Internal Audit Workpaper
- How to audit AI agents: an internal audit programme
- Internal Audit AI Strategy Template
- AI vendor due diligence checklist for internal audit
- Standards on Internal Audit
Sources
Pages read on 1 October 2026. ISO's own page for ISO/IEC 42001:2023 (iso.org/standard/81230.html) could not be opened and is not relied on above.
- Microsoft Learn, "ISO/IEC 42001:2023 Artificial Intelligence Management System Standards" — https://learn.microsoft.com/en-us/compliance/regulatory/offering-iso-42001
- Amazon Web Services, "ISO 42001 Artificial Intelligence Management System" FAQ — https://aws.amazon.com/compliance/iso-42001-faqs/
- KPMG Switzerland, "ISO/IEC 42001:2023 – A new standard for AI governance" — https://kpmg.com/ch/en/insights/artificial-intelligence/iso-iec-42001.html
- A-LIGN, "What Is ISO 42001? The AI Management System Standard Explained", 30 September 2026 — https://www.a-lign.com/articles/understanding-iso-42001
- ISMS.online, "Understanding ISO 42001 and Demonstrating Compliance" — https://www.isms.online/iso-42001/
- NQA, "ISO 42001 | Artificial Intelligence Management System" — https://www.nqa.com/en-gb/certification/standards/iso-42001
- BSI, ISO 42001 AI management system page — https://www.bsigroup.com/en-GB/products-and-services/standards/iso-42001-ai-management-system/
- PR Newswire via WebIndia123, "KPMG in India receives ISO 42001 Certification for Artificial Intelligence Management from SGS", 15 December 2025 — https://news.webindia123.com/news/Articles/Business/20251215/4394632.html