Preparation map
Four decisions to connect
Audit boundariesAIMS scope, AI systems, lifecycle stages, locations, providers and audit criteria.
AI-specific sampleHigh-impact uses, material changes, incidents, data dependencies and outsourced activities.
Evidence trailPurpose and impact decisions traced into controls, operation, monitoring and review.
Impartial conclusionFindings supported by sufficient evidence without prescribing the technical fix.
Original reasoning example
The unchanged model, changed system
An auditee says reassessment was unnecessary because the model code did not change. The system is now used for a new customer group, receives data from a new provider and automatically triggers a higher-consequence decision.
Competent next decisionSample change-management, impact-assessment, data-governance, approval and monitoring evidence for the changed use context. Evaluate whether the organisation’s trigger criteria captured the material system change.
Why it mattersAn AI system can change without a new model version. Auditors must examine purpose, data, environment, users and decision consequence across the lifecycle.
This is an Aegentra Labs teaching scenario, not a recalled or official examination item.A workable sequence
Study plan
Days 1–2ISO 19011 audit methodMap principles, programme, planning, conduct, reporting and follow-up.
Days 3–4AIMS requirementsCreate an audit trail from context and policy through operation, monitoring and improvement.
Days 5–7AI evidenceDesign samples for inventory, impact, data, validation, oversight, providers, monitoring and incidents.
Days 8–9FindingsWrite concise criteria-evidence-conclusion findings without consulting language.
Days 10–12Scenario practiceTest role boundaries, material change and evidence sufficiency under time limits.
Audit the AIMS and the AI system contextThe management system and its AI systems must be sampled as one connected evidence trail.
PECB publishes seven Lead Auditor domains covering AIMS and audit fundamentals, audit preparation, conduct, closure and programme management. The AI-specific challenge is deciding what to sample when systems, data, providers and impacts change quickly.
Start with the audit objective, scope and criteria, then identify AI uses that can materially affect the organisation or stakeholders. A risk-based plan may give more time to high-impact deployments, material change, incidents, external providers and areas where monitoring evidence conflicts with policy.
Test connected evidence chainsOne document rarely demonstrates that an AI control operated throughout the lifecycle.
Trace intended purpose into the inventory, risk and impact work, control decisions, validation, deployment approval, monitoring and change review. Corroborate interviews with system records and select samples that can reveal whether the stated process is consistently applied.
For human oversight, examine competence, authority, information available to the reviewer, intervention records and what happens when thresholds are breached. For external providers, examine assigned responsibilities, required evidence, change notification and the organisation’s own review.
Preserve auditor independenceIdentify the conformity gap without becoming the person who designs its remedy.
A clear finding states the criteria, objective evidence and conclusion. It does not invent a root cause, select the auditee’s model architecture or prescribe a detailed control design. Follow-up evaluates the proposed correction and corrective action against the finding and agreed process.
- Do not assume a completed impact template proves adequate assessment.
- Do not limit change sampling to source-code or model-version changes.
- Do not accept supplier assurance as a substitute for the organisation’s accountability.
- Do not extrapolate a systemic conclusion from one anomaly without considering sufficient evidence.
After this pathway
Choose the next capability for the work you want to do.
Passing one exam does not automatically grant another credential or a job outcome. These are complementary study directions, each with separate requirements.
ISO 19011:2026
Useful continuing study for management-system audit programmes, planning, conduct and auditor competence.
It is guidance and does not replace ISO/IEC 42001 criteria or a certification scheme’s requirements.Check the official source ↗ISO/IEC 42005 and NIST AI RMF
Useful for deeper impact-assessment and AI-risk evidence when auditing high-consequence use cases.
Use them as complementary references and keep the audit conclusion tied to the agreed criteria.Check the official source ↗Continue with the exact qualification
Guide → sample → practice → official training
