AI Governance
AI audit: what it covers, what evidence reviewers ask for, and how to prepare
A plain guide for compliance, risk and technology leaders: what an AI audit looks at, the evidence a reviewer asks for, and how to get ready. Kriv AI helps you prepare. We do not certify AI systems and we do not issue audit opinions.
An AI audit is a structured, evidence-based review of how an organisation designs, runs and monitors an AI system, checked against criteria such as its own policy, a risk framework or a regulation. The U.S. Government Accountability Office organises its AI accountability framework around four areas: governance, data, performance and monitoring. An AI audit ends in findings and recommendations, not a certificate. Kriv AI helps teams prepare the records an auditor will ask for and close the gaps; we do not certify AI systems or give audit opinions.
definition
What is an AI audit?
An AI audit is a structured review of an AI system and the way it is governed. The reviewer compares what you say you do, in policies and design documents, with what the evidence shows you do. The criteria can be your own policy, an industry framework such as the NIST AI Risk Management Framework, or a law or regulation that applies to you.
Oversight of AI has its own difficulties. The U.S. Government Accountability Office (GAO) notes that third-party assessments and audits are important for responsible AI, and that AI systems pose unique challenges to such oversight because their inputs and operations are not always visible. That is why an AI audit leans on records: what data went in, who approved the system, how it was tested, and what happens when it goes wrong.
coverage
What does an AI audit cover?
GAO's AI accountability framework, published in June 2021, is organised around four complementary principles: governance, data, performance and monitoring. They are a useful way to lay out an audit. The questions below are our own plain examples of what a reviewer asks under each area; they are not quoted from GAO.
Governance: Who owns this system? Is there a written policy that covers it? Who approved it for use, and who can stop it?
Data: Where did the data come from, and are you allowed to use it for this purpose? How is its quality checked? Who can see it and change it?
Performance: How was the system tested before use, against what measures, and by whom? What are its known limits? Can a person review and override its output where it matters?
Monitoring: How do you know the system still works as intended after launch? What is logged, who reviews the logs, and what triggers a review or a shutdown?
evidence
What evidence do auditors ask for?
Reviewers work from documents and records, not statements. GAO describes its framework as including, for each practice, questions for entities, auditors and third-party assessors, along with procedures for auditors and third-party assessors. In plain terms, expect to be asked for the records below.
An inventory of AI systems, with an owner for each. The policy or standard each system is held to. Approval records and risk assessments. Data source and data-use records. Test plans and test results. Logs of use, overrides and incidents. Records of changes after launch, including model or prompt changes. Staff training records for the people who run the system.
kinds
Internal review, third-party audit and certification: what is the difference?
An internal review is run by your own team against your own policy. A third-party audit is run by an outside reviewer against criteria you agree on, and ends in a report. A certification is a separate thing: an outside certification body issues a certificate against a published standard. Our page on AI governance certification explains who certifies what.
An audit report is not a certificate, and a certificate does not replace an audit of your own systems. Ask any firm offering an AI audit which criteria it uses, what it will and will not give an opinion on, and who is independent of whom.
prepare
How do you prepare for an AI audit?
Start with the inventory: list every AI system in use, including tools staff bought or switched on themselves, and name an owner for each. Then choose the criteria: your own policy, a framework such as the NIST AI Risk Management Framework, and any regulation that applies to you. Our pages on the NIST framework and on the EU AI Act explain two of them.
Next, collect the evidence for the systems that matter most: approvals, test results, data records, logs and training records. Fix the gaps you find before the reviewer does. Finally, agree the scope, the criteria and the timetable with the reviewer in writing, and decide who answers questions.
how kriv helps
How Kriv AI helps
Kriv AI is an AI services company. We do not certify AI systems, we do not issue audit opinions, and we do not give legal advice. We help teams build the AI inventory, assign owners, set up logging and human review, and gather the evidence an auditor or your counsel will ask for. Our work is informed by frameworks such as the NIST AI Risk Management Framework. Engagements are scoped and priced after a short discovery call.
Sources
Cited sources
- U.S. Government Accountability Office, Artificial Intelligence: An Accountability Framework for Federal Agencies and Other Entities, GAO-21-519SP, 30 June 2021. Highlights page read 2026-11-10.
- NIST, AI Risk Management Framework (page read 2026-11-10; AI RMF 1.0 released 26 January 2023, voluntary use).
Straight answers
Frequently asked questions about AI audit: what it covers, what evidence reviewers ask for, and how to prepare
What is an AI audit?
A structured, evidence-based review of how an AI system is designed, run and monitored, checked against criteria such as your own policy, a risk framework or a regulation. It ends in findings and recommendations.
What does an AI audit cover?
A common way to lay it out is GAO's four areas: governance, data, performance and monitoring. That means ownership and policy, data sources and quality, testing and human review, and how the system is watched after launch.
Is an AI audit the same as an AI certification?
No. An audit is a review that ends in a report. A certification is a certificate issued by an outside certification body against a published standard. See our page on AI governance certification.
What should I have ready before an AI audit?
An inventory of AI systems with owners, the policy each is held to, approvals and risk assessments, data records, test results, logs and incident records, and staff training records.
Who can carry out an AI audit?
Your own team can run an internal review. A third-party audit is run by an outside reviewer against agreed criteria. Ask any reviewer which criteria it uses and what it will give an opinion on.
Does Kriv AI carry out AI audits or certify AI systems?
No. We help you prepare: inventory, ownership, logging, human review and evidence. We do not certify AI systems or issue audit opinions.
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call