An ISO 42001 internal audit checks whether the AI management system is running, which means sampling a live system on an ordinary week. The policy PDF is the map. The sample is the evidence. The person who built the control should not be the only one who reviews it.

How an ISO 42001 internal audit should run

Run the ISO 42001 internal audit against the inventory, not against a policy nobody opened. Clause 9 of ISO/IEC 42001:2023 is where you evaluate the system. The ISO 42001 internal audit is how you do that check before a certification body does it at Stage 2. Stage 1 will have looked at the documents. Stage 2 will look at life. Your own audit should look at life first.

The ISO 42001 internal audit program names the systems, the auditor and the month. Cover the AIMS at least once in the certification cycle, and sample a changed system sooner if you ship often. A program that says “all controls, every year, one week in March” and then slips is worse than a short program you keep.

Competence for an ISO 42001 internal audit means the person can read a model record, a log and a risk row. A certificate in generic auditing is not enough if the auditor cannot tell a prompt change from a policy header. Train the person, or hire someone who has sat with an AI system. Record the competence. Annex A cares about people as well as documents.

A nonconformity from an ISO 42001 internal audit needs a cause, a correction and a date. “We will revisit culture” is not a correction. “No test record for the support bot since March, owner to attach the last evaluation by Friday” is a correction. Grade what you found. Close it before you pretend the management review is clean.

Management review should see the ISO 42001 internal audit result before you talk dates with a certification body. Inputs include the findings, open actions, complaints, and whether the scope still matches production. If the right people are not in the room, move the meeting. A memo nobody opened is not a review.

Sample an ordinary week in the ISO 42001 internal audit. A demo day will lie to you. Ask for last Tuesday: the prompt that changed, the ticket that approved it, the person who could have stopped the release, and one output a customer actually saw. A spreadsheet named Final_v7 with a blank owner cell fails that hour in about a minute.

What an ISO 42001 internal audit samples on a live system

The builder can explain the system. The builder should not be the only person who signs the ISO 42001 internal audit. Independence is the point. On a large team you can swap auditors across products. When the whole team is three people, independence inside an ISO 42001 internal audit is a structural problem. The same founder wrote the policy, trained the model and would be marking their own homework.

Outsource the ISO 42001 internal audit when the only competent person also wrote the controls. Outsourced internal audit services are the practical independence when the team is three people. You still own the findings. The outsider owns the sample and the awkward question.

Buy internal audit services for the sample, not for a binder that repeats your policy. Good internal audit services will ask for logs, a changed prompt and a ticket from an ordinary week. Internal audit services should refuse to audit work they designed in the same quarter. If a firm built your Statement of Applicability in April, it should not be the only voice that declares it effective in May.

The fee for internal audit services is separate from the certification body invoice. Ask internal audit services who will do the interview, and whether that person has sat with an AI system before. You can keep internal audit services on an annual cycle and still own the findings yourself. Seven Step does not issue ISO certificates. The body that does should have ISO/IEC 42001 in an accredited scope you have checked on NABCB or the IAF directory.

Take one Annex A control into the ISO 42001 internal audit and follow it to a record. There are 38 controls, from A.2 through A.10. You are not trying to narrate all of them in one sitting. You are trying to see whether a control you marked applicable can be shown. A Statement of Applicability that says “implemented” with no sample will fail the ISO 42001 internal audit.

Repeat the ISO 42001 internal audit on a cycle you can keep. Once a year is the floor for most firms. A fast product team should sample a changed system more often. Write the ISO 42001 internal audit finding in language the owner can close. “Governance weakness” gives nobody a task. A missing test record does.

Checklist areas, not a 200-line dump

An AIMS internal audit checklist should fit on a few pages. Start the AIMS internal audit checklist from scope, inventory and owners. If a production system is missing, stop and fix the list before you score controls. The rest of the day will be fiction.

The AIMS internal audit checklist includes risk, impact, the Statement of Applicability and supplier changes. An AI risk assessment with no review date is a finding. An AI impact assessment is due where people are affected: hiring, credit-like scores, clinical suggestions, claims recommendations. A supplier that swapped the model without telling you is a finding even if your accuracy number still looks fine.

Competence and training sit on the AIMS internal audit checklist because an untrained owner produces empty rows. Nonconformity and corrective action close the AIMS internal audit checklist. An open finding with no owner is itself a finding. Management review inputs belong on the AIMS internal audit checklist, including actions from the last review. Do not inflate the AIMS internal audit checklist to 200 lines. Auditors sample. So should you.

ISO 42001 internal audit sampling a live model, a risk and a control record
Area What a sample looks like A miss you should write down
Scope and inventory Every in-production system has an owner and a purpose A model the expense file shows, absent from the sheet
AI risk assessment Harm, likelihood, control, owner, review date A color with no sentence behind it
AI impact assessment People affected, where the system decides A hiring model treated as “just IT”
Statement of Applicability Applicable controls have a record; exclusions have a reason “Implemented” with an empty folder
Suppliers and change A model update has a decision A silent vendor upgrade
Competence The owner can explain the last test A name on the row who has never opened it
Nonconformity Cause, correction, date A promise with no owner
Management review Findings were actually discussed Minutes copied forward with the year changed

ISO 27001 internal audits teach you how to sample and how to write a finding. They do not teach you whether an AI system is doing what the inventory claims. Keep the method. Change the questions. The DPDP Act belongs in the sample where personal data enters training, prompts or outputs. As of 31 October 2026 the full rulebook is not in force. The main fiduciary duties start on 13 May 2027. If you are already designing the check a Significant Data Fiduciary will need, the audit can ask whether that design exists. The EU AI Act, where a buyer has put it in the contract, is another question in the same interview, not a second program.

A surveillance audit later will ask whether you kept doing this after the certificate.

When the team is too small to mark its own work

Book an outsourced internal audit if the builder is the only person who understands the system. We will sample a live week and leave findings an owner can close. The contact page is here: https://www.sevenstepconsulting.com/contact-us/

If you already know the team cannot audit itself

Book an outsourced internal audit when you want an ISO 42001 internal audit that the builder does not sign alone. We will sample a live system, use a short checklist, and leave you a nonconformity list with owners.