ISO 42001 Internal Audit

Overview

Draft internal audit procedure and audit report structure for the AIMS under ISO/IEC 42001:2023.

Getting Started

Add your source materials to the project workspace, then activate the ISO 42001 Internal Audit skill. The agent will guide you through the process step by step.

Example conversation

You: We need an internal audit procedure for the AIMS and a report template—scope, findings, nonconformities, corrective actions, follow-up—for certification.

Agent: I’ll draft the internal audit procedure and report template using the skill reference. I’ll define audit planning, criteria (ISO 42001 and AIMS documents), execution, reporting, and follow-up on findings and corrective actions. I’ll add a report structure: scope, audit results, findings (conformity/nonconformity/observation), corrective actions, and follow-up plan. I’ll run internal_audit_check on the procedure or report and fix any missing elements, then link to management review and the nonconformity process.

Output excerpt

Internal audit procedure and report excerpt

Procedure — Audit programme: [e.g. annual full AIMS audit; scope may be system-specific]. Criteria: ISO/IEC 42001:2023, AIMS policy, scope, procedures, SoA. Auditors: [e.g. independent from AIMS operation]. Planning: [e.g. checklist from clauses and Annex A]. Execution: [e.g. document review, interviews, sampling]. Report within [e.g. 2 weeks]; follow-up on actions.

Report structure — 1. Scope and criteria. 2. Audit results (summary). 3. Findings: ID; clause/control; description; classification (conformity / nonconformity / observation); evidence. 4. Corrective actions (owner, deadline). 5. Follow-up plan. 6. Distribution and retention.

Example finding — F-01. Clause 4.3 / Scope. Observation: One interface (analytics provider) was not in the scope document. Evidence: Interview; scope doc. Action: Update scope and interface register. Owner: AIMS owner. Due: [date].

Extension and validation

The skill includes internal_audit_check, which validates the internal audit procedure and report for: planning (programme, scope, criteria, frequency, auditor competence/independence); execution; reporting (findings, nonconformities, observations); follow-up (corrective actions tracked and closed); report content (scope, audit results, corrective actions, follow-up plan). Run it after drafting and address any missing elements.