Title: ISO 42001 internal audit > Assess whether the AI management system is implemented and operating against agreed criteria, with attention to responsibilities, risk decisions and evidence. Source: https://aegentra.co.uk/services/govern/iso-42001-internal-audit Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT. Published: 2026-10-21 Updated: 2026-10-21 Licence: public web content; cite the source URL. Internal audit / United Kingdom # ISO 42001 internal audit Assess whether the AI management system is implemented and operating against agreed criteria, with attention to responsibilities, risk decisions and evidence. Last reviewed 21 October 2026. Fees in pounds sterling plus VAT. [Discuss your scope](https://aegentra.co.uk/contact?subject=ISO%2042001%20internal%20audit) [See a working example](https://aegentra.co.uk/services/govern/iso-42001-internal-audit#working-example) Trace the AI decision. Test the evidence behind it. Scope and fee ## Agree the work. Know the boundary. The written proposal defines the scope, responsibilities, price and delivery timetable. ### What shapes your quote - AIMS scope and variety of AI use cases - Availability and sensitivity of evidence - Audit depth, interfaces and agreed follow-up [Request a scoped proposal](https://aegentra.co.uk/contact?subject=ISO%2042001%20internal%20audit) The requirement in context ## Keep AIMS assurance distinct from model testing. An AIMS internal audit examines the management system against agreed criteria. Technical model evaluation may answer a different question and needs its own scope and expertise. The UK government’s AI assurance guidance helps distinguish assurance approaches; a management-system audit is not a universal safety test. Primary references [ISO: AI management systems](https://www.iso.org/standard/42001) [UK government: introduction to AI assurance](https://www.gov.uk/government/publications/introduction-to-ai-assurance) The UK evidence picture ## AI use needs an evidence trail. 24% Among UK businesses already using AI, adopting it or actively considering it, 24% reported having cyber security practices or processes to manage AI-related risks. [Cyber Security Breaches Survey 2025/2026 · Section 3.11](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026#chapter-3-approaches-to-cyber-security) Published 30 April 2026. Fieldwork: August–December 2025. Self-reported survey data, not an ISO 42001 compliance rate or an Aegentra result. A question for your audit ### Can you follow an AI decision through to the record? For an agreed AI use, connect the approved purpose and accountable owner to the risk decision, selected operating records and any follow-up. If a record is missing, document the limitation rather than filling the gap with an assumption. An internal audit examines the agreed management-system criteria and sampled evidence. It is not a guarantee of model safety, a substitute for scoped technical testing or a certification decision. [Explore the evidence example](https://aegentra.co.uk/services/govern/iso-42001-internal-audit#working-example) Inside the work ## Trace a change in purpose—not just a new version number. Fictional audit trail: an assistant originally approved for internal drafting is proposed for customer-facing advice. A finding depends on the actual criteria and evidence, not the change alone. | Trace point | Record to examine | Question to answer | | --- | --- | --- | | Proposed change | Intended-use description and change request. | Was the new use identified before deployment? | | Assessment | Risk and impact-assessment decision, with relevant supplier information. | Were changed effects and responsibilities considered? | | Approval and operation | Authorisation, oversight arrangements and operating records. | Did the approved controls actually operate? | | Follow-up | Monitoring, complaints or incidents and management actions. | Is the organisation learning from the use rather than keeping a static assessment? | Fictional example · Not a client result, legal determination or complete audit checklist. [Download this working example (CSV)](https://aegentra.co.uk/downloads/govern-iso-42001-internal-audit-working-example.csv) What you take away ## Evidence. Ownership. A practical next step. Assess whether the AI management system is implemented and operating against agreed criteria, with attention to responsibilities, risk decisions and evidence. - Agreed AIMS audit boundary and impartiality assessment - Audit plan informed by system roles and risk - Sampled governance, assessment and operating records - Evidence-linked findings and a report of limitations - Follow-up arrangements for management actions ### Separate responsibilities This is an internal AIMS audit, not a model-safety certification, legal opinion or certification-body audit. Any implementation involvement must be considered when allocating an impartial auditor. How the work moves forward ## Agree. Examine. Follow up. Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced. The conversation matters. The supporting record matters too. - ### Set the criteria Agree systems, organisational roles, scope, evidence handling and impartiality. - ### Trace decisions Sample inventories, assessments, approvals, changes and operating records. - ### Report and follow up Explain findings, sample limits and the evidence required for management follow-up. Your delivery team ## Team qualifications and credentials. Qualifications, professional credentials and formal training held across Aegentra’s delivery team. Credentials are held across the delivery team and matched to assigned roles. The proposal identifies the consultants, responsibilities and relevant qualification evidence before work begins. ### Management systems and audit - ISO/IEC 27001 Lead Implementer - ISO/IEC 27701 Lead Implementer - PECB ISO/IEC 27001 Lead Auditor - ISO/IEC 42001 Lead Auditor - CISA — Certified Information Systems Auditor - ISM Auditor ### Cybersecurity and cloud - CISSP — Certified Information Systems Security Professional - CISM — Certified Information Security Manager - Certificate of Cloud Security Knowledge (CCSK) - OSCP+ — OffSec Certified Professional Plus ### Service delivery and specialist training - ITIL Expert - PRINCE2 - Mastering Generative AI for Cybersecurity Certificate - Essential Eight Assessment Course certificate — TAFEcyber ### Further training and audit qualifications Further training and audit qualifications across the team include ISO/IEC 42001 Lead Implementer training, ASD ISM General and Technical audit codes, ISO/IEC 27017 and ISO/IEC 27018 audit codes, and ISO 9001 and ISO 19011 audit qualifications. ### Relevant competence. Clear responsibilities. For internal audit, competence, objectivity, impartiality and prior involvement are checked before the work is accepted. Implementation, internal audit and independent certification have separate roles. These are individual qualifications held across the wider team, not a claim that every consultant holds every credential or that Aegentra is an accredited certification body. [Read about our team’s capability](https://aegentra.co.uk/about#team) A practical starting point ## What evidence will the auditor need? The agreed scope determines the evidence. It may include the AI inventory, responsibilities, risk and impact assessments, control decisions, supplier records, monitoring, changes and management review. An auditor checks records against the agreed criteria, not an invented universal checklist. Fictional working exampleA fictional organisation changes the purpose of an AI system after its original assessment. An audit traces the change request, updated assessment, approval and operating controls. A finding is made only when the sampled evidence supports it. Before you commission the work ## Your questions. Clear answers. **Is this a technical AI model audit?** Not automatically. This service is an internal audit of the AI management system. Model testing, security testing, bias evaluation and legal advice require separately agreed methods, skills and deliverables. **Can the implementation consultant be the internal auditor?** Do not assume that is appropriate. Assess competence, prior involvement and impartiality before assignment. We separate implementation and audit roles and document remaining conflicts. **What evidence should we prepare?** Start with the agreed AIMS scope, AI inventory, responsibilities, assessments, control decisions, supplier information, changes, monitoring and management-review records. Evidence requests are tailored to the audit, not an unlimited data collection. **Will you need confidential prompts or personal data?** Only evidence necessary for the agreed objective should be accessed. Discuss minimisation, redaction, secure access and retention first. Never send production credentials or sensitive records through the enquiry form. **Can this audit guarantee our AI is safe?** No. The report describes the agreed criteria, samples, findings and limitations. It does not guarantee all future outputs, every use case or all legal compliance. **Does an AIMS internal audit include testing every model?** Not unless separately scoped and supported by appropriate competence. The internal audit evaluates agreed management-system criteria and evidence. Model evaluation, red teaming and legal assessment answer different questions and must not be implied by the audit label. **What AI evidence can we prepare without exposing sensitive data?** Start with an inventory, roles, assessment and approval records, monitoring responsibilities and a list of evidence locations. Agree secure access for any sensitive samples. Redacted or summarised records may assist planning, but their limitations must be considered when reaching audit conclusions. **What should we prepare for a scoping conversation?** Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately. ## Resources for this decision. [ISO 42001 in the UK: implementation, audit and certification](https://aegentra.co.uk/knowledge/iso-42001-certification-uk) Choose the right route ## Connected work. Distinct responsibilities. Commission organisational support, build your own knowledge or clarify what a customer has requested. ### Related services [ISO 42001 implementation](https://aegentra.co.uk/services/govern/iso-42001) [ISO 27001 internal audit](https://aegentra.co.uk/services/govern/iso-27001-internal-audit) ### Develop your knowledge [ISO 42001 lead auditor course & exam](https://aegentra.co.uk/academy/iso-42001-lead-auditor) [Read the decision guide](https://aegentra.co.uk/knowledge/checking-certification) ## Let’s define the work you actually need. Tell us what you need to achieve, what is in scope and where you are starting. [Talk about your project](https://aegentra.co.uk/contact)