Governance & leadership
Covers: Organisational context · Interested parties · AIMS scope · Leadership · AI policy · Roles & responsibilities · AI objectives
Test whether your AIMS actually works.
Nalgo conducts independent ISO 42001 internal audits for organisations in the UK and Europe, to assess whether your AI Management System conforms to the standard, follows your own processes and is operating effectively in practice.
We review evidence, interview stakeholders, sample processes and report clear findings against defined audit criteria.
More than a document check.
An internal audit should test whether your AI Management System is actually being followed and whether the controls, processes and responsibilities you have defined are working in practice.
That means looking beyond policies and procedures.
We review evidence, speak to the people responsible, sample records and assess whether the AIMS is being implemented, maintained and improved as intended.
What we audit
Evidence is assessed against defined criteria across the areas in scope.
AI risk & impact
Covers: Risk methodology · AI risk assessment · Risk treatment · Risk acceptance · AI system impact assessment · Statement of Applicability
Operational controls
Covers: Applicable Annex A controls · AI lifecycle governance · Data governance · Responsible use · Human oversight · Suppliers & third parties
People & documented information
Covers: Competence · Awareness · Communication · Responsibilities · Document control · Records · Evidence
Performance & monitoring
Covers: Objectives · Monitoring & measurement · Control effectiveness · Performance evidence · Management information
Assurance & improvement
Covers: Internal audit programme · Management review · Nonconformity · Corrective action · Continual improvement
Audits can be full-scope or focused on specific areas of the AIMS depending on your audit programme and assurance needs.
How the audit works
01
Plan
Define the audit objectives, scope, criteria and audit plan.
Confirm the processes, AI systems, stakeholders and evidence that will be sampled.
02
Review
Review relevant AIMS documentation and existing evidence.
This may include policies, procedures, the Statement of Applicability, risk assessments, impact assessments, registers, previous findings and management review records.
03
Audit
Conduct the audit through stakeholder interviews, sampling, observation and evidence review.
Assess whether processes and controls are actually being followed and maintained.
04
Evaluate
Assess evidence against the audit criteria and develop the audit findings.
Identify conformities, nonconformities and opportunities for improvement.
05
Report & close
Present conclusions to relevant management and issue the formal audit report and findings register.
06
Follow up
Where agreed, verify that corrective actions have addressed the findings and are effective.
Optional follow-up
What you receive
ISO 42001 Internal Audit Report
A formal record of the audit scope, criteria, evidence reviewed, findings and conclusions.
Findings Register
A structured record of nonconformities, observations and improvement opportunities mapped to relevant requirements.
Closing Review
A walkthrough of the findings, conclusions and required next steps with relevant management.
Corrective Action Verification
Optional follow-up to verify that agreed corrective actions have been implemented and are effective.
- Deliverable
- Internal Audit Report + Findings Register
- Optional
- Corrective Action Verification
- Delivery
- Remote or onsite
Which ISO 42001 service do you need?
Each service supports a different stage of your ISO 42001 journey.
| Compare | Gap Analysis | Implementation | Internal Audit |
|---|---|---|---|
| Purpose | Understand where you are today | Build and implement your AIMS | Independently test your AIMS |
| Best for | Organisations starting their ISO 42001 journey | Organisations preparing for certification | Organisations with an AIMS already in place |
| What we do | Assess your current position against ISO 42001 | Help you design, document and operate the management system | Review conformity and test whether the system is working effectively |
| Main deliverable | Gap report and prioritised roadmap | Operational ISO 42001 AI Management System | Formal internal audit report and findings |
| Typical timing | Before implementation | After the initial assessment | Before certification and at planned intervals afterwards |
| Outcome | Know what needs to change | Become ready for certification | Demonstrate conformity and identify improvements |
| Explore each service | Explore Gap Analysis | Explore Implementation | Explore Internal Audit |
Gap Analysis
- Purpose
- Understand where you are today
- Best for
- Organisations starting their ISO 42001 journey
- What we do
- Assess your current position against ISO 42001
- Main deliverable
- Gap report and prioritised roadmap
- Typical timing
- Before implementation
- Outcome
- Know what needs to change
Implementation
- Purpose
- Build and implement your AIMS
- Best for
- Organisations preparing for certification
- What we do
- Help you design, document and operate the management system
- Main deliverable
- Operational ISO 42001 AI Management System
- Typical timing
- After the initial assessment
- Outcome
- Become ready for certification
Internal Audit
- Purpose
- Independently test your AIMS
- Best for
- Organisations with an AIMS already in place
- What we do
- Review conformity and test whether the system is working effectively
- Main deliverable
- Formal internal audit report and findings
- Typical timing
- Before certification and at planned intervals afterwards
- Outcome
- Demonstrate conformity and identify improvements
Who is it for?
Maintaining an AIMS
You need to perform planned internal audits as part of operating your ISO 42001 management system.
Preparing for certification
You need an independent assessment of how well the AIMS is operating before progressing towards certification.
Already certified
You need recurring internal audits to maintain and improve the management system.
Independent assurance
You want an objective assessment of whether your AI governance and controls are working in practice.
Independent assurance that goes beyond paperwork.
A useful internal audit should do more than confirm that policies exist.
It should test whether the organisation understands its responsibilities, follows its processes, applies its controls and can produce evidence that the AIMS is operating as intended.
Nalgo combines ISO 42001 audit expertise with practical understanding of AI products, systems and enterprise technology.
Objective
Findings based on defined criteria and evidence.
Practical
Focused on how the AIMS operates in the real organisation.
Actionable
Clear findings and next steps rather than a generic checklist.
Test your ISO 42001 AIMS.
Get an independent assessment of whether your AI Management System conforms, is being implemented and is operating effectively.