AI auditing, accountability automation, and governance testing tools
An audit answers one question: can the organisation show that its AI governance actually operates? Everything in this topic — audit types, evidence, tooling — serves that question.
Why this matters for the AIGP exam
Auditing closes Domain IV because it is where every earlier control gets verified. The exam tests what auditors need and what makes a system auditable.
The essentials
- Internal audits check the organisation's own systems against its own policies and applicable law; independent audits add external credibility, and some regimes require them — NYC's bias-audit rule for hiring tools is the standing example, and ISO/IEC 42001 certification audits the management system itself.
- Auditability is built, not retrofitted. An audit consumes evidence: documentation of design and data, test results against thresholds, logs of operation and incidents, records of who approved what. Systems that never produced these cannot be meaningfully audited.
- Governance tooling automates the trail: inventory and registry systems, evaluation harnesses that run recurring tests, monitoring dashboards, and documentation generators. Tooling replaces manual evidence-gathering — not the judgement about what the evidence means.
- Scope follows risk. Audit depth and frequency should track a system's risk tier; auditing everything identically is as much a design failure as auditing nothing.
What the exam asks
Distinguish internal from independent audits and when each is required, and identify what missing evidence makes a described system unauditable.
Going deeper
This page is the condensed version. The full topic — with the detail above expanded and practice questions attached — is in the app, inside Domain IV. Domain I, a quarter of the course, is free to try first.
Back to the AIGP study guide.
AI Governance Study is an independent study aid. It does not represent a government entity: it is not affiliated with, endorsed by or authorised by any government, government agency or regulatory authority, and it does not provide government services or legal advice. Laws and frameworks are described in our own words — the official texts are listed at official sources. It is also not affiliated with, endorsed by, or sponsored by the IAPP. The AIGP name is used only to identify the exam this material helps you prepare for.