|
| 1 | +# Individual Audit Plan |
| 2 | +## ISO/IEC 42001:2023 | Clause 9.2 — Template |
| 3 | + |
| 4 | +**Audit Reference:** AUD-[###]-[YEAR] |
| 5 | +**Audit Area:** ___________________________ |
| 6 | +**ISO 42001 Clauses:** ___________________________ |
| 7 | +**Audit Type:** Full AIMS / Clause-specific / AI System Audit |
| 8 | +**Lead Auditor:** ___________________________ |
| 9 | +**Auditees:** ___________________________ |
| 10 | +**Programme Reference:** AIMS-AUDITPROG-[YEAR] |
| 11 | + |
| 12 | +--- |
| 13 | + |
| 14 | +## 1. Objectives |
| 15 | + |
| 16 | +1. Whether [area] conforms to ISO/IEC 42001:2023 requirements |
| 17 | +2. 2. Whether [area] conforms to the organisation's AIMS requirements |
| 18 | + 3. 3. Whether [area] is effectively implemented and maintained |
| 19 | + |
| 20 | + 4. --- |
| 21 | + |
| 22 | + 5. ## 2. Scope |
| 23 | + |
| 24 | + 6. **In Scope:** [Specific clauses, processes, AI systems, activities] |
| 25 | + |
| 26 | + 7. **Out of Scope:** [Excluded areas and justification] |
| 27 | + |
| 28 | + 8. **Sampling Approach:** [e.g., "All High-risk AI systems"; "Random sample of 3 recent Impact Assessments"] |
| 29 | + |
| 30 | + 9. --- |
| 31 | + |
| 32 | + 10. ## 3. Schedule |
| 33 | + |
| 34 | + 11. | Date | Time | Activity | Location | Auditee(s) | |
| 35 | + 12. |------|------|---------|---------|-----------| |
| 36 | + 13. | | | Opening Meeting | | AI Gov Lead, team | |
| 37 | + 14. | | | Document Review | Remote | Lead Auditor | |
| 38 | + 15. | | | Interviews | | [Names/Roles] | |
| 39 | + 16. | | | Process Observation | | [Names/Roles] | |
| 40 | + 17. | | | Auditor Caucus | | Lead Auditor | |
| 41 | + 18. | | | Closing Meeting | | AI Gov Lead, team | |
| 42 | + |
| 43 | + 19. --- |
| 44 | + |
| 45 | + 20. ## 4. Methods |
| 46 | + |
| 47 | + 21. | Method | What Will Be Reviewed | |
| 48 | + 22. |--------|----------------------| |
| 49 | + 23. | Document review | [e.g., AI Policy, Risk Register, Training Records] | |
| 50 | + 24. | Interviews | [Specific roles] | |
| 51 | + 25. | Process observation | [Specific processes] | |
| 52 | + 26. | Record sampling | [e.g., last 3 Impact Assessments] | |
| 53 | + |
| 54 | + 27. --- |
| 55 | + |
| 56 | + 28. ## 5. Audit Criteria |
| 57 | + |
| 58 | + 29. 1. ISO/IEC 42001:2023 — [specific clauses] |
| 59 | + 2. 2. Organisation's AIMS policies and procedures |
| 60 | + 3. 3. Applicable regulatory requirements |
| 61 | + |
| 62 | + 4. --- |
| 63 | + |
| 64 | + 5. ## 6. Documents Requested |
| 65 | + |
| 66 | + 6. | Document | Doc ID | Purpose | |
| 67 | + 7. |---------|--------|---------| |
| 68 | + 8. | AI Policy | AIMS-POLICY-001 | Verify currency | |
| 69 | + 9. | AI Risk Register | AI-RISK-REGISTER | Verify coverage | |
| 70 | + 10. | | | | |
| 71 | + |
| 72 | + 11. --- |
| 73 | + |
| 74 | + 12. ## 7. Independence Statement |
| 75 | + |
| 76 | + 13. I confirm no conflict of interest with areas being audited. |
| 77 | + |
| 78 | + 14. **Lead Auditor:** ___________________________ **Date:** ___________________________ |
| 79 | + |
| 80 | + 15. --- |
| 81 | + |
| 82 | + 16. ## 8. Report Reference |
| 83 | + |
| 84 | + 17. Findings reported in: AUD-[###]-[YEAR]-REPORT |
| 85 | + 18. NCRs raised in: NCR-REGISTER.md |
| 86 | + |
| 87 | + 19. --- |
| 88 | + |
| 89 | + 20. *ISO/IEC 42001:2023 AI Governance Toolkit | Clause 9.2 | See root README.md for full index* |
0 commit comments