AI governance · Audit and assurance
AI Governance Audit, Review & Vendor Due Diligence: independent proof your AI is under control
An independent AI governance audit for boards, customers, auditors and regulators: the register tested against what runs, controls tested as they operate, EU AI Act duties mapped to dates and owners, the AIMS audited clause by clause against ISO/IEC 42001, and AI vendors examined before anyone signs. Every verdict carries evidence, and every fix arrives costed. Vendor due diligence from £5,500 + VAT, reviews from £15,000 + VAT.
The audit at a glance
Definition
What is an AI governance audit?
An AI governance audit is an independent, evidence based test of whether an organisation controls its AI: whether the register covers what runs, whether the controls operate as written, whether EU AI Act duties are mapped to owners and dates, and whether the evidence would satisfy the people who ask for it. Vendor due diligence applies the same discipline to the AI products an organisation buys.
Assessment and audit answer different questions. An assessment such as the AI Governance QuickScan discovers what exists and builds the baseline. An audit tests a function that already claims to work, and writes verdicts someone else can rely on: a board, an audit committee, a certification body, a customer or a regulator. ISO/IEC 42001 makes the internal audit mandatory through clause 9.2, and the EU AI Act obligations only count when evidence sits behind them.
Independence is the point. Where Intelance built the function under examination, through the AI Governance Office or otherwise, the audit goes to another firm and we say so plainly. Buying AI rather than governing it? The same evidence discipline runs through supplier AI and cyber portfolios, and our guide to governance against assurance explains the difference in full.
Evidence over interviews
Registers, logs, approvals and contracts read at source.
Controls tested live
Approvals traced end to end in the systems that run them.
Verdicts that hold
Written for boards, certification bodies and regulators.
Fixes with prices
Every finding costed and sequenced rather than observed.
The examination
Six things the audit tests
Each card says what gets tested and what lands in the report. Nothing is taken on trust, including the things that look finished.
The register against reality
Whether the AI register matches what runs, including the shadow AI that never reached it.
OutputA coverage verdict with every gap named.The controls in operation
Approvals, human oversight, logging and incident routes, tested as they operate rather than as they were written.
OutputControl test results backed by evidence.The duties and the dates
EU AI Act obligations, including the Article 4 literacy duty, mapped against what you run and when each date lands.
OutputA duty map with owners and deadlines.The AIMS against ISO/IEC 42001
A clause by clause internal audit of the AI management system before the certification body arrives.
OutputAn internal audit report certification audits accept.The vendor behind the product
An AI vendor examined before signature: what the product does with your data, the claims, the terms and the security behind them.
OutputA written due diligence verdict per vendor.The view the board receives
Findings written for the accountable audience, with every fix costed and sequenced rather than listed as observations.
OutputA board ready readout with a priced fix plan.How it works
What happens in an audit engagement
Five stages from scope to readout. A vendor due diligence runs in one to two weeks. The full review typically runs two to four.
Scope from the register
The audit scope agreed from your register, policies and the question being asked: the whole function, the AIMS, or one vendor.
Gather the evidence
Registers, approvals, logs, contracts and vendor documentation pulled and read at source rather than summarised in interviews.
Test the controls
Approvals traced end to end, oversight and logging checked in the systems, vendor claims verified against evidence. This is the stage that separates an audit from a conversation.
Validate with your team
Findings validated with the people who run the function before anything is written, so the report lands as recognition rather than surprise.
The readout
The report walked through with the accountable audience: verdicts, evidence, and every fix costed and sequenced. Yours to act on, with anyone.
Audits date quickly: models change, vendors update terms and new use cases arrive. AI Risk-as-a-Service keeps the register, reviews and controls current month by month from £8,000 + VAT, so the next audit confirms rather than surprises.
Published fees
The scopes and what they cost
Every engagement has a published floor and a defined output. They stand alone or combine into the assurance programme.
AI governance review
The whole function audited: register coverage, controls in operation, EU AI Act duties and board reporting, with evidence behind every verdict.Best whenThe board or a major customer has asked whether the AI governance works. FeeFrom £15,000 + VAT2 to 4 weeks 02
ISO/IEC 42001 internal audit
A clause by clause internal audit of the AIMS, written to the standard certification bodies expect from clause 9.2.Best whenCertification or surveillance is booked and the internal audit has not been done. FeeFrom £6,500 + VAT1 to 2 weeks 03
AI vendor due diligence
One AI vendor or product examined before signature or renewal: data handling, model claims, terms and security, verified rather than accepted.Best whenProcurement is about to sign an AI product and nobody has read what it does with your data. FeeFrom £5,500 + VAT / vendor1 to 2 weeks 04
AI assurance programme
The review, the vendor due diligence and a board pack, run as one engagement with one evidence file.Best whenAn investor, regulator or major customer needs the full picture with proof behind it. FeeFrom £25,000 + VAT4 to 8 weeks
The alternatives
How the audit compares with the alternatives
Three ways organisations answer the question. The difference is whether anyone outside the room believes the answer.
An internal self-assessment written by the team that runs the function
Nobody outside the team
The gaps stay invisible until someone else finds them
Weeks of internal effort, no standing
The AI product’s own compliance page, security summary and sales answers
Nobody who has read a vendor contract
The terms changed with an update nobody read
Free, with nothing independently verified
An independent audit with controls tested and claims verified, from £5,500 + VAT
Boards, audit committees, certification bodies, customers and regulators
Where we built the function, the audit goes to another firm
1 to 4 weeks, from £5,500 + VAT, fixed in writing
Scope
What is covered and what is not
You get
A coverage verdict on the register against what runs, with every gap named.
Control test results with the evidence shown, traced in the systems that run them.
A duty map for the EU AI Act with owners and deadlines, and a clause 9.2 report where the AIMS is in scope.
A due diligence verdict per vendor, written before signature rather than after the incident.
A board ready readout with every fix costed and sequenced, yours to act on with anyone.
This is not
A certification. We audit and prepare. Accredited certification bodies certify. The report is written to what they accept.
A rubber stamp. Verdicts follow the evidence, and findings are reported even where they are unwelcome.
A self-review. Where Intelance built the function under examination, the audit goes to another firm and we say so.
A discovery exercise. Where no register or policies exist yet, start with the QuickScan and audit later.
Where to start
Typical starting positions
Four situations we are usually called into. If none of them fit, speak to us and we will point you at the right first step.
Why Intelance
The standards we hold ourselves to
If we built it, we do not audit it
Where Intelance stood up the function under examination, the audit goes to another firm and we say so. Independence is the product, so it is never compromised for a fee.
Evidence behind every verdict
Registers, logs, approvals and contracts read at source, controls traced in the systems that run them. Interviews add colour, and never substitute for proof.
Written for the audience that asked
Board packs read like board packs, clause 9.2 reports read like internal audits, and vendor verdicts fit a procurement decision.
Fixes arrive costed
Every finding carries a priced, sequenced fix: contractual, technical or procedural. Observations without prices are not findings.
What the fees start at
From £5,500 + VAT per vendor and from £15,000 + VAT for the review, fixed in writing before work starts.
Who delivers this
Audits are led by a senior partner and delivered by senior auditors who run AI governance functions and internal audits for clients every month, with established associates across AI, cyber and data governance where depth is needed.
AI governance guides
All insights
Ready to talk?
Tell us who is asking the question
Thirty minutes with a senior auditor: who asked for proof, what the register looks like and what deadline is driving it. If an audit is premature and a QuickScan is the right first step, we will say so in the call.
FAQs
Questions about the audit
What is an AI governance audit?
An independent, evidence based test of whether an organisation controls its AI: whether the register covers what runs, whether the controls operate as written, whether EU AI Act duties are mapped to owners and dates, and whether the evidence would satisfy a board, certification body, customer or regulator.
What is the difference between an AI governance audit and the QuickScan?
The QuickScan discovers what exists and builds the baseline: use cases found, risks tiered, gaps named. The audit tests a function that already claims to work and writes verdicts someone else can rely on. Organisations without a register start with the QuickScan and audit later.
Does ISO/IEC 42001 require an internal audit?
Yes. Clause 9.2 requires internal audits of the AI management system at planned intervals, and certification bodies expect to see the report and the findings closed. The Intelance internal audit runs clause by clause from £6,500 + VAT and is written to what certification audits accept.
What does AI vendor due diligence examine?
The product and the company behind it, before signature: what the product does with your data and prompts, whether model and compliance claims hold against evidence, what the terms permit including training use and changes by update, and the security posture behind the marketing. The verdict is written for a procurement decision, from £5,500 + VAT per vendor.
What does an AI governance audit cost in the UK?
With Intelance, AI vendor due diligence runs from £5,500 + VAT per vendor, the ISO/IEC 42001 internal audit from £6,500 + VAT, the full AI governance review from £15,000 + VAT, and the AI assurance programme from £25,000 + VAT. Every fee is a published floor, fixed in writing before work starts.
Is the audit independent if Intelance built our AI governance?
No, and we treat that as disqualifying. Where Intelance stood up the function under examination, the audit goes to another firm and we say so plainly. The same rule runs across the whole practice: if we built it, we do not audit it.
Who receives the audit report?
Whoever asked the question: the board, the audit committee, a certification body, a customer or an investor. The report is written for that audience, the fixes are costed and sequenced, and the findings are yours to act on with any provider.
How long does an AI governance audit take?
Vendor due diligence runs one to two weeks per vendor, the ISO/IEC 42001 internal audit one to two weeks, and the full AI governance review two to four weeks depending on register size. The assurance programme typically runs four to eight weeks.