PECB Certified ISO/IEC 42001 Lead Auditor

Audit Fundamentals and Evidence

This module develops audit fundamentals for learners reviewing an ISO/IEC 42001 artificial intelligence management system. It is not an official PECB curriculum. The intended skill is careful reasoning: define the audit purpose, collect relevant evidence, test the evidence against applicable criteria, and communicate conclusions fairly.

Purpose, scope, criteria, and method

An audit begins with a clear purpose. The auditor should understand what is being assessed, the boundaries of the activity, the criteria being applied, and the method used to gather evidence. Without those elements, an audit can drift into general advice or technical preference. In an AIMS setting, scope may include a particular AI-enabled service, supporting processes, suppliers, locations, or lifecycle stages. Do not assume that every system used by an organisation belongs to the same audit scope.

Suppose an organisation uses one AI tool for internal drafting and another for customer-facing decisions. A useful audit plan distinguishes the different intended uses and likely impacts. The evidence needed to evaluate each may differ. A generic control statement can be relevant, but the auditor still needs to determine how it applies to the sampled activity. A narrow scope is not a weakness when it is defined and justified.

Evidence is more than documentation

Objective evidence may include records, observed activities, system settings, approvals, monitored results, and interviews. Each has strengths and limitations. A written procedure can show intended practice. An observation can show a process being performed at a particular time. An interview can explain context and uncover contradictions. A record can show that a decision occurred. Strong audit work combines evidence sources instead of treating any single artifact as conclusive.

Ask three questions for every item: Is it relevant to the criterion? Is it reliable enough for the conclusion? Is it sufficient with the other evidence available? A dashboard showing a risk score may be relevant, but an auditor should understand the period, population, owner, and exception handling before treating it as sufficient. A screenshot without context is weaker than a traceable record linked to the process it represents.

Sampling and traceability

Audits use sampling because it is rarely practical to examine every action. Sampling should be purposeful, documented, and appropriate to the audit objective. Select examples that illuminate the process, such as a recent change, a supplier dependency, an exception, or an incident. Explain why the sample was chosen and what its limits are. Do not infer a universal conclusion from one convenient example without considering the population.

Traceability means another competent person can follow the route from criterion to evidence to conclusion. Keep notes that identify the source, date, owner, and relevance of material reviewed. When an interview is important, record the role, topic, and corroborating evidence, not merely a personal impression. This discipline also protects the auditee, because a finding should be understandable and capable of response.

Interviews, observation, and professional judgement

Interviews are not interrogations. Start with open questions about how work is actually done, then use specific questions to test the process. Listen for ownership, sequence, exceptions, escalation, and records. If an answer conflicts with documentation, do not assume bad faith. Explore the difference. A procedure may be outdated, the interviewee may describe a local variation, or the evidence may reveal a genuine implementation problem.

Professional judgement is necessary, but it should be transparent. An auditor should avoid substituting a personal technical preference for a criterion. For example, the fact that an organisation uses a spreadsheet rather than a specialized tool does not by itself establish a failure. The audit question is whether its chosen process supports the applicable requirement and operates effectively in context.

Findings, evidence reasoning, and fair conclusions

A well-formed conclusion says what was assessed, which criterion applies, what evidence was observed, and why the evidence supports the conclusion. Avoid vague statements such as “governance is weak.” Instead, describe the observable gap. For example, a finding might identify that sampled AI change records lacked documented approval against the organisation's stated approval process. The auditee can then understand the issue and investigate its cause.

Scenario: A team presents a policy and two successful project reports, yet a sampled production change lacks a recorded risk review. The correct response is not to dismiss all evidence or to accept the policy as complete proof. Record the positive evidence, evaluate the missing record against the relevant process, and determine whether the sample supports a finding. Balanced conclusions improve credibility.

Practice checkpoint and misconceptions

Checkpoint: You are told that a model is “safe because it passed testing.” What do you ask next? Identify the intended use, test criteria, responsible role, evidence of review, relevant limitations, and how results are monitored after deployment. This question shifts the discussion from a slogan to an auditable process.

Misconception: More evidence is always better. Better approach: seek sufficient evidence that is relevant and reliable. Misconception: an auditor must propose the remedy. Better approach: state the evidence-based conclusion; the auditee is responsible for deciding actions. Misconception: an interview alone proves implementation. Better approach: corroborate important claims where practical.

Official Scope and Verification

Contract verified 2026-07-13; source rechecked 2026-07-31. This module uses the current public domain audit fundamentals. It does not claim detailed English objectives, item counts, weights, or historical handbook content. Verify current PECB details directly: https://pecb.com/en/education-and-certification-for-individuals/iso-iec-42001/iso-iec-42001-lead-auditor.