ISO/IEC 42001 requires internal audits at planned intervals to check that your AI management system meets your own requirements and the standard, and works in practice. For AI agents, a good internal audit samples agents by risk, traces each from policy to records, and re-performs a handful of real actions to check they stayed inside their bounds.
What does the standard require of internal audit?
ISO/IEC 42001:2023 asks for an internal audit programme. In substance, that means:
- Audits at planned intervals, covering whether the management system conforms to your own requirements and the standard, and whether it is effectively implemented and maintained.
- A programme that sets frequency, methods, responsibilities and reporting, taking into account the importance of the processes and the results of earlier audits.
- Defined criteria and scope for each audit.
- Auditors chosen to ensure objectivity and impartiality, so nobody audits their own work.
- Results reported to relevant management, with evidence retained.
Findings then feed corrective action and management review. A certification body will expect to see at least one cycle of internal audit before it certifies, which is why internal audit is the rehearsal for the certification audit.
Who should do the auditing?
Anyone competent and independent of the area being audited. Larger firms use their internal audit function, often with a technical specialist alongside. Smaller firms can use a trained colleague from another team, or an external auditor working to the firm's programme. What matters is that the person checking an agent did not build, own or approve it.
Internal audit teams new to agents often need a primer. Our guide on how to brief internal audit on how agents are governed covers what they need to know before fieldwork.
What changes when the AI under audit is an agent?
Auditing a predictive model usually means reviewing its documentation, validation and monitoring. Auditing an agent adds the actions it took, and those leave a trail you can test directly.
Sample by risk, not by convenience. Prioritise agents with the highest depth, the widest tool access and the most customer impact. A reading agent at depth 1 is a lower priority than one that releases refunds at depth 3.
Trace top-down. For each sampled agent, follow the chain: AI policy, inventory entry, owner, risk assessment, impact assessment, selected controls, test results, current authority. Gaps between links are the commonest findings.
Re-perform bottom-up. Take a sample of actual agent actions from the record. For each, check that the agent held a valid certificate for that capability at that moment, that the action was within its bounds, and that any action needing approval was approved by a named person. This is where paper controls are separated from real ones.
Test oversight quality. Look at approval times and rejection rates. An approver who clears hundreds of held actions with seconds each and no rejections is not providing oversight. Record it as a finding even if every approval is technically present.
Check change discipline. Compare the brief and sources deployed today with the last approved version. Any difference without a change record is a nonconformity.
What evidence should the auditor sample?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Agents identified | Inventory entry per agent and capability | Inventory extract with owner and date |
| Risks treated | Agent-specific risk entries linked to controls | Risk register entries and control references |
| Impacts assessed | Impact assessment for agents affecting people | Signed assessment and review date |
| Authority earned | Capability tests against real cases before authority granted | Test results and certificate dates |
| Actions within bounds | Each action checked against bounds at the moment it ran | Verdict records for sampled actions |
| Oversight real | Held actions approved by named people with time to judge | Approval logs with times and rejection rates |
| Changes controlled | Brief, source and tool changes approved and re-tested | Change tickets and re-test results |
| Corrective action works | Earlier findings closed with evidence | Finding tracker with closure evidence |
A well-built agent platform makes much of this cheap. If every verdict is filed in an append-only record, re-performance is a query rather than a forensic exercise.
What will the certification body or a supervisor ask about your internal audit?
- Show us the audit programme and how you chose which agents to audit.
- Who audited, and how was their independence assured?
- What did the audit find, and what has been done about it?
- Did the audit re-perform any agent actions, or only review documents?
- How were results reported to management, and what did management decide?
What does internal audit not cover?
It checks that your management system conforms and works. It is not a validation of each agent's accuracy, which is a first-line or second-line task carried out through testing and certification of capabilities. It does not determine legal compliance, though it can check that your process for identifying legal requirements runs. If you also run ISO/IEC 27001, the two audit programmes can share planning and reporting; see ISO/IEC 42001 vs ISO/IEC 27001. For background, see what ISO/IEC 42001 is and our guide to what it means to certify an agent.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme files every verdict in an append-only record that names the agent, capability, certificate and bound that decided. An internal auditor can pick any action and see whether the agent held authority at that moment, who approved it if it was held, and what changed since. That turns re-performance into a sample, not a reconstruction.
Questions people ask
How often should agents be internally audited?
Set frequency by risk. High-depth agents with customer impact belong in every cycle; low-depth reading agents can rotate. Change the plan when incidents or findings suggest more attention is needed.
Can the agent platform team audit its own agents?
No. The standard requires objectivity and impartiality. The platform team should support the audit with evidence but not perform it.
What is the most common internal audit finding for agents?
Oversight that exists on paper but not in practice: approvals so fast or so uniform that they cannot be real review. It is easy to detect from approval records and easy to miss without them.