Audit Planning
Establish objectives, approach and resourcing before fieldwork begins.
GAAI AI Standards Framework™
GAAI-500
AI Audit Standard
GAAI-500 establishes a structured framework for evaluating organizational AI practices against applicable GAAI requirements.
Core areas
What the Standard Covers
GAAI-500 defines how AI practices, controls and evidence are examined so that audits are consistent and repeatable.
Scope Definition
Define what is — and is not — included in the audit.
Risk Assessment
Identify the AI-related risks the audit must address.
Control Assessment
Evaluate whether controls are designed appropriately.
Evidence Collection
Gather sufficient, relevant and reliable evidence.
Testing
Test whether controls operate as intended in practice.
Findings
Document findings clearly, with supporting evidence.
Corrective Actions
Agree actions to address findings and set expectations for closure.
Audit Reporting
Report outcomes in a consistent, defensible format.
Reassessment
Re-examine practice as remediation completes and AI use changes.
Auditor Independence
Maintain independence and manage conflicts of interest.
Audit process
A Consistent, Evidence-Based Process
The same sequence applies whatever the organization or the scope, so results can be compared and defended.
PLANEstablish audit objectives, approach and resourcing.
DEFINE SCOPEAgree the systems, processes and requirements in scope.
ASSESS RISK & CONTROLSIdentify relevant risks and evaluate control design.
COLLECT EVIDENCEGather sufficient, relevant and reliable evidence.
TESTTest whether controls operate as intended.
DOCUMENT FINDINGSRecord findings against applicable requirements.
REPORTReport outcomes in a consistent, defensible format.
CORRECTIVE ACTIONAgree remediation and expectations for closure.
REASSESSRe-examine as remediation completes and AI use evolves.
Intended audience
Who This Standard Is For
AI auditors
Governance professionals
Risk professionals
Compliance professionals
Qualified assessors
Related
Related Credential and Standards
Certification
GAAI Certified AI Auditor™
For audit professionals examining organizational AI practice.
Explore AI Auditor Certification
Standard
GAAI-400
The organizational standard that GAAI-500 audits are conducted against.
View standard
Verification
Audit & Verification
How audit outcomes feed organizational verification levels.
See how it works
Governance
Policies
Auditor independence, conflicts of interest and verification decisions.
Read policies
Audit AI Practice With Confidence
A consistent standard for planning, testing, documenting and reporting AI audits.