Module 125 minutes
What Makes AI Different to Audit
Probabilistic outputs, drift and agents.
The question: Why do audit techniques built for deterministic systems fall short?
You keep: AI system profile
Specialist programmeAI Audit and Assurance
Test an AI system, produce evidence that stands up to scrutiny, and report it to a board. For the people who have to answer how a model decided.
- 6 modules
- About 2 hours 40 minutes
- 6 artefacts you keep
- 30-day plan
Who it is for
For auditors and risk teams facing AI.
Internal auditors, model risk managers, assurance teams at audit firms, and compliance leads.
The problem
Audit methods for AI are still unsettled. The hardest question is also the most common: when an auditor asks how a model decided, can you produce a clean answer from evidence?
You leave with an audit work programme and an evidence pack.
Outcomes
By the end, you can
- Adapt classic audit to AI: sample many times with tolerances, pin versions and trace evidence through inputs, outputs and logs.
- Build an AI inventory, tier each use by impact and autonomy, and write control objectives you can test.
- Design repeatable tests for accuracy, bias, robustness and hallucination.
- Audit AI agents for least privilege, approval gates on irreversible actions and complete action logs.
- Assemble a dated evidence pack that reconstructs inputs, controls and approvals.
- Write findings a board can act on: plain, ranked by impact and owned.
Outline
Six modules. Each ends with something you keep.
Every module answers one question, then you apply it in a timed exercise on a fictional case and complete the artefact before you move on.
Module 225 minutes
Scoping and Risk Tiering
Inventory, tiers and control objectives.
The question: How do you decide what to audit first?
You keep: AI inventory with tiering
Module 330 minutes
Testing Models
Accuracy, bias, robustness and hallucination.
The question: How do you test something that gives different answers each time?
You keep: Test design sheet
Module 430 minutes
Auditing AI Agents
Permissions, tool use and traceability.
The question: When software acts, what do you audit?
You keep: Agent audit checklist
Module 525 minutes
Evidence Packs
Reconstruct inputs, controls and approvals.
The question: What do you hand an auditor, a regulator or a court?
You keep: Evidence pack index
Module 625 minutes
Reporting to Boards and Regulators
Findings that lead to action.
The question: How do you write findings that a board can act on?
You keep: Finding and board summary
CapstoneThen a 30-day plan
Apply it to your own organisation
An audit work programme and evidence pack for a live AI use case.
- Week 1. Build or obtain the AI inventory and tier each use by risk.
- Week 2. Write control objectives and test steps for the top two uses.
- Week 3. Run the tests and assemble the evidence pack, marking what cannot be shown.
- Week 4. Report findings in a one-page board format and agree owners and dates.
What you produce
Six artefacts, one binder.
A repeatable method for the next AI audit.
- Module 1AI system profile
- Module 2AI inventory with tiering
- Module 3Test design sheet
- Module 4Agent audit checklist
- Module 5Evidence pack index
- Module 6Finding and board summary
Capstone: An audit work programme and evidence pack for a live AI use case.