Audit Readiness

What is audit readiness

Audit readiness is the state in which an organization is prepared for a formal compliance audit — with documentation, processes, and evidence in order. The goal is not to “pass an audit” but to have governance that actually works.

---

Audit readiness checklist

1. Documentation (foundation from L1)

Item	Status	Description
AI policy	-	Approved by management, distributed to employees
AI inventory	-	Complete list of AI systems with risk classification
Risk assessment	-	Risk assessment for each AI system
Employee training	-	Proof of AI literacy training completion
Incident reporting	-	Process for reporting and resolving AI incidents
DPIA (where relevant)	-	Data Protection Impact Assessment for AI systems

2. Processes (foundation from L1 + L3)

Item	Status	Description
Approval process	-	How new AI tools are approved
Monitoring	-	How AI systems are continuously monitored
Review cycle	-	Regular review of AI policies and processes
Escalation paths	-	Who resolves issues and how
Change management	-	How changes in AI systems are managed

3. Evidence

Item	Status	Description
Meeting minutes	-	Documentation of management decisions about AI
Training records	-	Attendance sheets, certificates, test results
Incident log	-	Records of AI incidents and their resolution
Audit trail	-	Who, when, and what was approved/changed
Metrics	-	Data on adoption, incidents, compliance

---

Preparation process

---

What the auditor asks

Typical questions during an AI governance audit:

1. “How do you identify AI systems in your organization?” — you need an AI inventory
2. “How do you classify AI system risks?” — you need a risk assessment methodology
3. “How do you ensure AI literacy among employees?” — you need proof of training
4. “What happens when an AI system fails?” — you need an incident response plan
5. “Who is responsible for AI governance?” — you need clear roles and responsibilities

---

Regulatory context

Regulation	Audit requirement	Article
AI Act	Conformity assessment for high-risk AI	Art. 43-49
AI Act	AI literacy — demonstrable	Art. 4
NIS2	ICT security audit	Art. 21
GDPR	DPIA for automated processing	Art. 35

---

Next steps

• ISO 42001 — if you are heading toward certification
• What to expect from an audit — practical audit guide