External audit stage 2: Certification audit for AI systems
The main audit, typically spanning 3 to 9 days, evaluates AIMS effectiveness through evidence sampling, interviews, and observations across selected AI systems. Auditors trace high-risk models end-to-end, confirming controls work in practice per clauses 8–10.
What happens:
- Sampling: Auditors pick 5–10 representative AI systems based on criticality, reviewing lifecycle artifacts (design specs, bias tests, drift logs, HITL records).
- Interviews and walkthroughs: Sessions with AI owners, operators, and leadership to validate procedures, oversight, and decision-making.
- Evidence deep-dive: Operational records like intervention logs, incident reports, monitoring dashboards, and management review minutes to prove continual improvement.
- Findings classification: Conformities, minors (fixable gaps), majors (systemic failures blocking certification), and observations.
SOC Frameworks Overview
SOC 2 Basics
SOC 2 Compliance Process
SOC 2 Compliance Process
Sprinto: Your ally for all things compliance, risk, governance
