Audit and continuous monitoring
Organisation: [complete] · Owner: [complete] · Approved by: [complete]
Effective from: [complete after approval] · Review: [complete]
Purpose of the review
Define the question in advance: whether documentation exists, a process works, a system meets test criteria, or evidence is ready for a specific independent assessment. These conclusions are not interchangeable.
Review plan
| Item | Information to complete |
|---|---|
| Scope | Systems, processes and period |
| Criteria | Specific obligations, standard or internal requirements and versions |
| Method | Evidence review, interviews, event samples or technical testing |
| Competence | Reviewer and management of conflicts of interest |
| Output | Findings, evidence, severity, limitations and recipient |
| Remediation | Owner, deadline, completion evidence and effectiveness check |
Frequency follows risk, changes and a specific obligation or contract. External audit or certification is not a universal annual requirement for every AI use.
Evidence and metrics
Attach concrete evidence and sampling scope to each conclusion. Document counts and percentages of checked controls do not establish legal compliance. A metric of “95% of vulnerabilities patched” may conceal one unpatched critical flaw.
Use justified thresholds and track significant deficiencies separately. Measure actual effectiveness: whether an incident was escalated correctly, recovery worked, or a person could stop an incorrect AI action.
Findings and remediation
Distinguish a satisfied requirement, nonconformity, observation and lack of evidence. Give each open item an owner. Closure requires evidence and review; marking a task complete is not an effectiveness check.
Acceptance of permissible risk needs an authorised approver and review conditions. It cannot cancel a legal obligation.
Records and independent assessment
Keep criteria versions, evidence, conclusions and decisions under the retention schedule. Check certification scope, accreditation and assessor authority for the specific engagement. ISO/IEC 42001 concerns a management system within a defined scope; it is not automatic certification of AI Act compliance for every AI system.
Audit preparation · Monitoring and retention
Template reviewed on 6 September 2026. Detailed legal sources are in the linked guides. L1 — Align helps prepare evidence and responsibilities; adaptation and implementation scope is agreed in the proposal.