Module 1 - AI governance and risk
A - AI models, considerations and requirements
- Types of AI
- Machine learning / AI models
- Algorithms
- AI lifecycle
- Business considerations
B - AI governance and program management
- AI strategies
- Roles and responsibilities in the AI environment
- Policies and procedures for AI
- AI training and awareness programs
- Metrics for measuring the success of AI programs
C - AI risk management
- Identification of AI-related risks
- Assessment of AI risks
- Monitoring and management of AI risks
D - Data protection and data governance programs
- Data governance
- Data protection aspects
E - Best practices, ethics, standards and regulations for AI
- Relevant standards, frameworks and regulations for AI
- Ethical considerations when using AI
Module 2 - Operation of AI systems
A - Data management for AI
- Data collection
- Data classification
- Data confidentiality
- Data quality
- Data balancing
- Data scarcity
- Data security
B - Development and life cycle of AI solutions
- Development processes, methods and life cycle
- Privacy and security by design
C - Change management for AI
- Change management in the context of AI
D - Monitoring of AI solutions
- Responsibility and control of human supervision ("AI agency")
E - Test procedures for AI systems
- Classic software testing techniques for AI
- AI-specific test procedures
F - AI threats and vulnerabilities
- Types of AI-related threats
- Controls against AI threats
G - AI Incident Response Management
- Preparation
- Identification and reporting
- Assessment
- Response
- Follow-up
Module 3 - Audit methods, techniques and tools for AI audits
A - AI audit planning and design
- Identification of AI assets
- Types of AI controls
- Use cases for AI audits
- Internal training on the use of AI
B - Testing and sampling methods
- Design of an AI audit
- Test methods for AI audits
- AI sampling
- Checking AI results
- Example procedure of an AI audit
C - Evidence collection techniques
- Data collection
- Walkthroughs and interviews
- Tools for AI data collection
D - Data quality and data analytics in the audit
- Assessment of data quality
- Data analysis
- Data reporting
E - AI audit reports and results
- Creation of reports
- Audit follow-up
- Quality assurance and follow-up
SECONDARY CLASSIFICATIONS - TASKS
Assess impact, opportunities and risks when integrating AI solutions into the audit process.
- Use AI solutions to improve audit processes (planning, execution, reporting)
- Evaluate AI solutions to advise the organization on impacts, opportunities and risks.
- Assess the impact of AI solutions on system interactions, environment and people.
- Evaluate the role and impact of AI decision-making systems on organization and stakeholders.
- Evaluate organization's AI policies and procedures including legal/regulatory compliance.
- Evaluate monitoring and reporting of metrics (e.g. KPIs, KRIs) specific to AI.
- Check whether responsibilities for AI-related risks, controls, procedures, decisions and standards are defined
- Evaluate the organization's data governance program specifically for AI
- Evaluate the organization's privacy program specifically for AI
- Evaluate problem and incident management programs specific to AI
- Evaluate change management program specifically for AI.
- Evaluate configuration management program specifically for AI.
- Evaluate threat and vulnerability management programs specifically for AI.
- Evaluate identity and access management program specifically for AI.
- Evaluate vendor and supply chain management programs for AI solutions.
- Evaluate design and effectiveness of controls specific to AI.
- Evaluate data input requirements for AI models (appropriateness, bias, privacy).
- Review system/business requirements for AI solutions to ensure alignment with enterprise architecture.
- Evaluate AI solution lifecycle (design, development, deployment, monitoring, decommissioning) and inputs/outputs for compliance and risk.
- Evaluate algorithms and models to ensure AI solutions meet business objectives, policies and procedures.
- Analyze the impact of AI on the workforce and advise stakeholders on training, education and other measures.
- Verify that awareness programs align with the organization's AI-related policies and procedures.
