How-to
A practical method to examine the AI your company uses: what it does, what could go wrong, and the evidence that it works as intended.
Updated 5 min read
The short answer
To learn how to audit AI, list every AI system in use, define its purpose and risks, then check its data, test accuracy and bias, review controls and logs, write down findings, and re-test on a schedule.
Key points
Step by step
Follow them in order. Each step produces evidence for the next.
List every tool, model and agent your teams use, including ones bought inside other software.
For each system, write what it should do, who it affects and what a failure would cost.
Review where inputs come from, who can change them and whether they are complete and current.
Run known cases through the system and compare outputs across groups and scenarios.
Confirm who approves outputs, how errors are caught and that actions are recorded.
Record each gap with its evidence, severity and an owner who will fix it.
Set a date to repeat the checks, and again after any major change to the system.
Opinion
Audit
IBM describes an AI audit as a structured, evidence-based examination of how AI systems are designed, trained and deployed.
So it is not a one-off opinion. It is a repeatable check with proof behind every conclusion.
NIST AI RMF
Voluntary guide to trustworthy AI design and use.
IIA framework
Guidance for assessing AI risks, governance and controls.
Your own checklist
Built from the two, sized to your scope.
You do not need to invent a method. The National Institute of Standards and Technology publishes the AI Risk Management Framework for voluntary use, to build trustworthiness into how AI is designed, used and evaluated.
The Institute of Internal Auditors offers its own AI auditing framework, with principles-based guidance on AI risks, governance and controls. Use either as a checklist for your scope.
Gather evidence
AI pulls records and logs for review.
Flag exceptions
It highlights items that break a rule.
Auditor decides
A person judges and signs off.
AI is also a tool for auditors. Gen AI use by chief audit executives jumped from 15% to 40% in one year, per an Institute of Internal Auditors survey run from October to November 2024.
A later IIA and AuditBoard survey found 83% expect more AI use in the coming year. Teams that automate audit process steps like sampling and evidence gathering free time for judgment.
To audit AI agent behavior, treat it as a worker with a job description. Check what it can access, what actions it can take and where a person must approve.
The same logic applies to bots. When you audit rpa, confirm each bot has an owner, a log and a stop switch.
Ethics
Fairness, explainability and privacy.
Regulation
Duties that match the system's risk level.
Brand
Voice and claims stay accurate.
An ai ethics audit asks whether outputs are fair, explainable and respectful of privacy. Rules matter too: the Federal Trade Commission has said that using AI to trick, mislead or defraud people breaks the law.
An eu ai act audit checks that a system meets the law's duties for its risk level.
A narrower ai brand audit checks whether AI-written content keeps your voice and claims accurate. Legal questions belong with qualified counsel.
Nexum builds AI systems and automation, and does not perform certified audits or give legal advice. If you need an independent opinion, use a qualified auditor. Our AI audit guide explains what a review covers.
For the building side, see our guide to AI audit and compliance, which shows how controls and records are designed into a system from the start.
Our data
We asked ChatGPT, Gemini and Perplexity 10 buyer questions about AI audit and compliance. They named 85 companies, and 69% appeared in only one of the three.
| Criterion | ChatGPT | Gemini | Perplexity |
|---|---|---|---|
| Companies named | 41 | 39 | 45 |
| Sites cited most | holisticai.com and deloitte.com (5 of 10) | xcelacore.com (4 of 10) | aicompliancevendors.com (4 of 10) |
Nexum measurement, October 22, 2026, via DataForSEO: 10 buyer questions to each AI, US English, 30 answers in total. 14 companies appeared in all three. Google showed an AI Overview for 10 of the 10 questions.
FAQ
Final step
You leave knowing which processes to automate first and what each one costs you today, whether we work together or not.
You can keep paying for manual work, or find out this week exactly what it costs you.
What happens on the call
Before
You answer 3 quick questions when you book, so we come prepared.
On the call
We find the manual work that costs you most and put a number on it, live.
Decide
An honest read on whether we're the right fit. If we're not, you'll hear it on the call.
Once you book, we look at your site and tools before the call, so the 30 minutes go to your numbers, not introductions.
Prefer to write first? Email us directly: contact@nexumautomations.com
