Preparing for an Independent ISO 42001 Internal Audit: What Auditors Actually Check

Preparing for an ISO 42001 internal audit means looking beyond a standard ISO 27001 checklist to evaluate AI governance, impact assessments, lifecycle controls, accountability, and continual improvement.

Internal audits under ISO 42001 need to be conducted objectively and impartially, which in practice usually means bringing in someone who wasn't involved in building the AIMS and isn't the same person who'll run your external certification audit. That independence isn't a box-ticking requirement — an internal audit run by the people who built the system tends to just confirm what they already believe.

The most common shortcut I see is reusing an ISO 27001 internal audit checklist and swapping "information asset" for "AI system." It gets you partway there, honestly — the mechanics of an audit (evidence review, interviews, writing up nonconformities) don't change. What it misses is everything actually unique to an AI Management System.

A real ISO 42001 internal audit checks whether the AIMS scope and objectives are clearly defined and documented, whether impact assessments exist for the systems in scope and were actually done before deployment rather than after, whether data quality and provenance are documented for what's feeding each system, whether human oversight is a genuine intervention point rather than a rubber stamp, whether responsibilities with third-party AI suppliers are clearly allocated, and whether nonconformities flagged in prior reviews were actually closed out rather than just noted and forgotten.

The audit itself usually runs the way any ISO audit does: an opening meeting to confirm scope, a document review against ISO 42001's clauses and Annex A specifically — not a borrowed 27001 checklist — interviews with the people actually operating the AI systems day to day, and a written findings report with nonconformities and corrective actions attached.

An ISO 42001 internal audit is doing its job when it surfaces something specific to AI risk that wouldn't have come up in an information security audit. If your checklist can't tell the difference between the two, it's not really auditing the AIMS — it's auditing the ISMS a second time under a different name.