ISO/IEC 42001 Internal Audit Programme Planner
Build the internal audit programme clause 9.2 asks for. Rate each clause and Annex A area by risk, list your auditors, and get a 12-month schedule that covers everything in the cycle, audits high-risk areas more often and never sends an auditor to audit their own work. Each audit comes with scope, criteria, dates, an area-level checklist and a findings log you can pass to the nonconformity tracker.
Loaded with a sample programme for a fictional insurer. Saved in your browser only. A template, not certification advice.
You are looking at a sample programme for a fictional insurer. Edit anything, or . Changes are saved in this browser only.
Audits in cycle
33
2026-07-01 to 2027-06-30
Areas covered
16/16
clauses + Annex A areas
Overdue
1
past end date, not completed
Audit days
36
indicative effort
Flags (2)
- Overdue
- Own area
Auditor load: Priya Natarajan 7 · Tom Okafor 10 · Lena Brandt 8 · External contractor 8
| Audit | Area | Risk | Dates | Auditor | Status | Findings |
|---|---|---|---|---|---|---|
| Clause 6 Planning | high | 2026-07-02 → 2026-07-02 | Completed | – | ||
| Clause 10 Improvement | medium | 2026-07-09 → 2026-07-09 | Completed | – | ||
| Annex A.7 Data for AI systems | high | 2026-07-16 → 2026-07-16 | Completed | – | ||
| Clause 5 Leadership | medium | 2026-08-03 → 2026-08-03 | Completed | – | ||
| Clause 8 Operation | high | 2026-08-10 → 2026-08-11 | Completed | – | ||
| Annex A.10 Third-party and customer relationships | medium | 2026-08-17 → 2026-08-17 | Completed | – | ||
| Clause 4 Context of the organization | low | 2026-09-02 → 2026-09-02 | Completed | – | ||
| Annex A.5 Assessing impacts of AI systems | high | 2026-09-09 → 2026-09-09 | Completed | – | ||
| Annex A.8 Information for interested parties | medium | 2026-09-16 → 2026-09-16 | Completed | – | ||
| Clause 7 Support | medium | 2026-10-02 → 2026-10-02 | Completed | – | ||
| Annex A.2 Policies related to AI | low | 2026-10-09 → 2026-10-09 | In progressOverdue | 1 | ||
| Annex A.6 AI system life cycle | high | 2026-10-16 → 2026-10-16 | Completed | 3 (1 NC) | ||
| Clause 6 Planning | high | 2026-11-02 → 2026-11-02 | Planned | – | ||
| Annex A.7 Data for AI systems | high | 2026-11-09 → 2026-11-09 | Audits own area | Planned | – | |
| Annex A.9 Use of AI systems | medium | 2026-11-16 → 2026-11-16 | Planned | – | ||
| Clause 8 Operation | high | 2026-12-02 → 2026-12-03 | Planned | – | ||
| Clause 9 Performance evaluation | medium | 2026-12-09 → 2026-12-09 | Planned | – | ||
| Annex A.3 Internal organization | low | 2026-12-16 → 2026-12-16 | Planned | – | ||
| Clause 10 Improvement | medium | 2027-01-04 → 2027-01-04 | Planned | – | ||
| Annex A.4 Resources for AI systems | low | 2027-01-11 → 2027-01-11 | Planned | – | ||
| Annex A.5 Assessing impacts of AI systems | high | 2027-01-18 → 2027-01-18 | Planned | – | ||
| Clause 5 Leadership | medium | 2027-02-02 → 2027-02-02 | Planned | – | ||
| Annex A.6 AI system life cycle | high | 2027-02-09 → 2027-02-09 | Planned | – | ||
| Annex A.10 Third-party and customer relationships | medium | 2027-02-16 → 2027-02-16 | Planned | – | ||
| Clause 6 Planning | high | 2027-03-02 → 2027-03-02 | Planned | – | ||
| Annex A.7 Data for AI systems | high | 2027-03-09 → 2027-03-09 | Planned | – | ||
| Annex A.8 Information for interested parties | medium | 2027-03-16 → 2027-03-16 | Planned | – | ||
| Clause 7 Support | medium | 2027-04-02 → 2027-04-02 | Planned | – | ||
| Clause 8 Operation | high | 2027-04-09 → 2027-04-12 | Planned | – | ||
| Annex A.5 Assessing impacts of AI systems | high | 2027-05-03 → 2027-05-03 | Planned | – | ||
| Annex A.9 Use of AI systems | medium | 2027-05-10 → 2027-05-10 | Planned | – | ||
| Clause 9 Performance evaluation | medium | 2027-06-02 → 2027-06-02 | Planned | – | ||
| Annex A.6 AI system life cycle | high | 2027-06-09 → 2027-06-09 | Planned | – |
TL;DRWhat this planner does
5 points
- ISO/IEC 42001 clause 9.2 expects internal audits at planned intervals under an audit programme that sets frequency, methods, responsibilities and reporting, with auditors who are objective and impartial.
- This planner takes clauses 4 to 10 and the Annex A areas as audit topics, a risk rating and owner for each, your AI systems and your auditors, and builds a 12-month programme: high-risk areas every 4 months, medium every 6, low once.
- Each audit gets a scope, criteria, auditor, dates, an area-level checklist and a findings log (conformity, major or minor nonconformity, observation, opportunity for improvement).
- Flags show an auditor scheduled to audit their own area, areas not covered in the cycle and overdue audits. View the programme as a table or a timeline.
- Free to use, saved in your browser. CSV and Markdown export, including a CSV in the nonconformity tracker's format, are part of Pro.
What an auditor checks in your internal audit programme
At Stage 1 and Stage 2 the certification auditor will ask to see the programme itself, not just audit reports. They look for a plan that covers the whole AIMS scope within the cycle, a reason why some areas are audited more often than others, evidence that audits happened when planned, and auditors who did not audit their own work. An overdue audit or an area nobody looked at all year is a common finding against clause 9.2.
For an AI management system the riskiest areas are usually where AI systems are actually built and run: impact assessment, the AI system life cycle and data. Those are also where the people best placed to audit tend to work, which is why independence conflicts show up so often in small teams. The planner assigns around them and tells you when it cannot.
Findings flow on to the nonconformity tracker for corrective action, and the results of the programme are an input to the management review. To rehearse being on the other side of the table, try the Stage 2 audit lab. Running ISO/IEC 27001 too? The integrated management system planner shows how to share one audit programme.
Frequently asked questions
What does ISO/IEC 42001 clause 9.2 require for internal audit?
The organisation conducts internal audits at planned intervals to find out whether the AI management system conforms to its own requirements and to the standard, and whether it is effectively implemented and maintained. It plans, establishes, implements and maintains an audit programme (frequency, methods, responsibilities, planning requirements and reporting), defines the criteria and scope of each audit, selects auditors so the process is objective and impartial, reports results to relevant management, and keeps documented information as evidence of the programme and the results.
How often should each area be audited?
The standard leaves frequency to you, based on the importance of the processes and the results of previous audits. This planner uses a simple risk rule: high-risk areas every 4 months, medium every 6 months and low once in the 12-month cycle, so every clause and in-scope Annex A area is covered at least once a year. Many certification bodies expect the full scope to be covered within the cycle; check with yours.
Can someone audit their own area?
No. Auditors must not audit their own work. The planner treats an auditor as not independent of any area owned by their home function and of any area you mark against them, assigns audits only to independent auditors, and flags any audit you reassign to someone who is not independent. Small organisations often use a peer from another function, an auditor from a group company or an external contractor.
What is the difference between an observation and an opportunity for improvement?
Practice varies between certification bodies. In this planner an observation is a weakness that is not yet a nonconformity but could become one if left alone, and an opportunity for improvement is something that conforms but could be done better. Neither requires a corrective action, but both are worth tracking.
Can I send findings to the nonconformity tracker?
Yes, as a CSV. The export uses exactly the columns of the PlayCISO ISO 42001 nonconformity tracker's own export, with the source set to internal audit and the clause or Annex A area filled in. The tracker does not import files yet, so add the rows to your register file or log them in the tracker. Conformities are left out.
Where is my data stored, and is this tool free?
Everything is saved in your own browser with localStorage; nothing is sent to PlayCISO, and clearing site data or using a private window removes it. Planning, checklists, findings and flags are free. Exporting the programme or findings to CSV or Markdown is part of Pro ($5/month or $40/year).
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.