What it means
AI audit scope defines the systems, life-cycle stages, data, decisions, vendors, locations, and stakeholders included in an engagement, while audit criteria define the requirements used to judge them.
Why it matters
A clear scope and criteria set keeps the engagement tied to material risk and prevents teams from changing the standard after evidence has been collected.
Practical focus
- Define the system boundary, accountable owner, approved purpose, material risks, and decision authority for AI Audit Scope and Criteria
- Approve the system boundary, objectives, exclusions, applicable policies, risk thresholds, regulatory obligations, and evidence owners before fieldwork begins.
- Collect and protect this evidence: the approved audit charter, system inventory, architecture boundary, criteria crosswalk, stakeholder approvals, and documented scope changes.
- Exercise this failure scenario as a planned test: a high-risk model component or third-party service falls outside the stated boundary, or findings are disputed because no agreed criterion exists.
Common mistakes
- Using the label AI Audit Scope and Criteria without defining the exact systems, data, people, decisions, and time period in scope
- Treating a policy statement or tool demonstration as proof that AI Audit Scope and Criteria operates consistently in production
- Failing to retain the approved audit charter, system inventory, architecture boundary, criteria crosswalk, stakeholder approvals, and documented scope changes in a form that lets an independent reviewer reconstruct decisions and changes
- Testing only the normal path and never rehearsing what happens when a high-risk model component or third-party service falls outside the stated boundary, or findings are disputed because no agreed criterion exists.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: