6.1 — The AI Audit Lifecycle
An AI audit follows a structured lifecycle from initial planning through remediation follow-up. Understanding each phase and its deliverables is critical for effective auditing.
Planning phase: Define audit objectives, scope (which AI systems, which controls), criteria (against which framework — NIST, ISO 42001, EU AI Act), timeline, and resource requirements. Engage stakeholders early — AI audits require cooperation from data science, engineering, legal, and business teams.
Systems affecting individuals' rights, safety, or financial outcomes receive the deepest audit scrutiny.
Automated decision-making without human oversight requires more extensive testing and control evaluation.
Large user base, sensitive data, or public-facing applications increase the scope requirements.
Systems subject to specific regulations (EU AI Act high-risk, RBI guidelines) need compliance-focused scoping.
Auditors must NOT have development responsibilities for the system being audited. An effective audit team includes: technical auditors (ML expertise), governance/compliance auditors, domain experts, and legal advisors. Independence is a fundamental audit principle — expect exam questions on this.