ISO/IEC 42001 — Modern Auditing

The international standard for an artificial intelligence management system — the certifiable counterpart to ISO 27001 for organisations building or deploying AI.

Published in 2023, ISO 42001 applies the familiar management-system structure to AI: context, leadership, planning, support, operation, performance evaluation and improvement, with 38 Annex A controls covering AI policy, roles, impact assessment, data governance, lifecycle management, transparency and third-party use.

It matters to internal audit for two separate reasons, and the second is usually overlooked. The first is the obvious one: as the organisation deploys AI, someone has to provide assurance over how it is governed, and 42001 is the most likely framework the organisation will be measured against.

The second is that internal audit is itself becoming an AI deployer. A function running agents against production data is operating an AI system within the scope of its own organisation’s AIMS — with obligations around impact assessment, data governance and human oversight that it cannot exempt itself from on the grounds of being the auditor. Functions building agentic capability should read Annex A as a specification for their own programme before they read it as an audit programme for someone else’s.