How to Audit the Use of Artificial Intelligence in an Organization: 4 Audit Fronts and the Cycle Roadmap
By Pedro Sonda, dooop
To audit AI use, organize the audit into four fronts: unauthorized use (which AI is being used outside approved tools and rules), compliance with policy (are usage and data rules being followed), systems in operation (controls for each system, such as human review and access, are functioning), and overall governance (roles, inventory, risk classification, and indicators exist and are used). Each cycle follows six steps: scope, criteria, evidence collection, analysis, reporting, and follow-up. High-risk uses are audited more frequently.
Updated October 2026.
Why Audit
| Data | Source |
|---|---|
| Only 34% of organizations conduct regular audits of unauthorized AI use; one in five reported data breaches linked to shadow AI | IBM, 2025 |
| 57% of employees hide AI use, and nearly half admit to using AI in ways that violate company rules | KPMG and University of Melbourne, 2025 |
| The ISO/IEC 42001, AI management system standard, includes performance evaluation and internal audit of the management system | ISO |
| The NIST AI RMF includes the measurement function aimed at assessing and monitoring AI risks over time | NIST |
Interpretation: A significant portion of actual AI use is invisible, and a relevant share violates rules. Without auditing, the company cannot know if governance is effective.
dooop Framework: The 4 Fronts
| Front | Question | Typical Evidence |
|---|---|---|
| 1. Unauthorized Use | Which AI is being used outside the rules? | Anonymous surveys; network and subscription expense reports; conversations with teams |
| 2. Policy Compliance | Are usage and data rules being followed? | Sample deliverables; verification of data entered into tools; training records |
| 3. Systems in Operation | Are controls for each system working? | Human review records; access controls; performance tests; logged incidents |
| 4. Overall Governance | Does the structure exist and is it used? | Updated inventory; risk classifications; AI forum minutes; indicators; policy review |
dooop Framework: The 6-Step Cycle
| Step | What to Do |
|---|---|
| 1. Scope | Choose fronts, areas, and systems to audit, prioritizing those with higher risk |
| 2. Criteria | Define audit criteria: policy, risk classification, defined controls, contracts |
| 3. Evidence | Collect documents, records, samples, and interviews |
| 4. Analysis | Compare evidence against criteria; classify findings by severity |
| 5. Report | Findings, causes, risks, and recommendations, with responsible parties and deadlines |
| 6. Follow-up | Verify if actions were completed on time |
Frequency by Risk Level
| Use Level | Suggested Frequency |
|---|---|
| High | Semiannual, with control testing |
| Moderate | Annual |
| Low | By sampling, within compliance audit |
| Unauthorized Use (front 1) | At least annually, company-wide |
Most Common Findings
| Finding | Typical Recommendation |
|---|---|
| Tools in use outside the catalog | Evaluate and approve or offer alternatives; see How to Govern Generative AI Tools Used by Employees |
| Outdated inventory | Quarterly update routine with areas |
| Human review planned but not recorded | Simple review record; periodic sampling |
| Systems without an owner | Assign responsible party or deactivate; see How to Create Clear Responsibilities for AI Systems |
| Policy unknown to employees | Short training and communication by managers |
A Cultural Rule
Auditing unauthorized use works best when the stated goal is to bring usage within the rules, not to punish. If declaring use leads to punishment, usage continues but more hidden.
What to Do Now
- Define the scope of the first cycle: front 1 for the entire company and front 3 for high-risk systems.
- Write the criteria based on policy and risk classification.
- Include findings in governance indicators; see How to Create AI Governance Metrics.
To structure AI audits and the governance they verify, explore dooop's AI Governance front.
Frequently Asked Questions
Who should audit AI use? Ideally, internal audit or someone independent from system operators. In companies without internal audit, the governance responsible can conduct with external support, maintaining separation from system owners.
Is AI audit the same as IT audit? There is overlap in access and security, but AI audit also verifies usage, human review, biases, decisions, and compliance with AI policy.
Do we need ISO/IEC 42001 certification? It is not mandatory. It may make sense for companies that need to demonstrate governance to clients or partners. The standard is also useful as a reference even without certification.
Also Read
About dooop
dooop is a consultancy based in Caxias do Sul (RS) that prepares leaders and organizations to transform artificial intelligence into business capability through strategy, governance, and training.