AI auditing is becoming a standard expectation for regulated financial services firms. The FCA has signalled that its supervision of AI use in financial services will include assessment of how firms govern and audit their AI systems. Internal audit functions are developing AI-specific methodologies. This article provides a practical guide to auditing an AI system in a regulated financial services context. What an AI Audit Covers An AI audit is a structured assessment of whether an AI system is operating as designed, within its governance parameters, and in compliance with applicable regulatory requirements. It covers five domains: governance documentation, data quality and lineage, model performance, fairness and bias, and human oversight mechanisms. Governance Documentation Review The first component is a review of governance documentation. Is there a system design document that describes the AI's purpose, inputs, logic and outputs? Has accountability been formally assigned? Is the documentation current and version-controlled? Does it reflect the actual deployed system or an earlier version? If the documentation for an AI system cannot tell you what it does, who is accountable for it, and how it is monitored, the governance is inadequate regardless of how well the system is performing. Data Quality Assessment The data quality assessment examines whether the data inputs to the AI system meet the quality standards assumed in its design. Key areas include completeness of required fields, consistency of data formats across sources, accuracy testing against known reference data, and currency — assessing whether the data refresh frequency is adequate for the AI use case. Model Performance Assessment Model performance assessment examines whether the AI system is performing at the level specified in its governance documentation. This requires comparing current performance metrics against the baseline established at deployment, examining the distribution of outputs for signs of drift or degradation, and reviewing exception and escalation rates against expected norms. Human Oversight Review The human oversight review assesses whether the defined oversight mechanisms are operating as designed. Are the defined escalation criteria being applied? Are human reviewers reviewing the AI outputs they are supposed to review? Is the review documented? Human oversight is frequently the weakest element of deployed AI governance and is a priority focus area for AI audits in regulated firms.
Frequently Asked Questions
What are the five domains of an AI system audit?
Governance documentation (is there adequate documentation of purpose, accountability and controls), data quality and lineage (does input data meet the quality standards assumed in design), model performance (is the AI performing at the level specified), fairness and bias (does the AI produce equitable outcomes), and human oversight mechanisms (are defined oversight controls operating as designed).
What documentation gaps are most commonly found in AI audits?
Missing or outdated system design documents, nominal accountability assignments without evidence of genuine oversight, and monitoring frameworks that are documented but not operated in practice.
How should AI fairness be assessed in an audit?
By testing whether AI outputs differ systematically for customer groups with similar characteristics but different demographic profiles, reviewing the firm's own fairness testing documentation, and assessing whether the remediation process for identified fairness issues has been used.
What does human oversight failure look like in an AI audit?
Escalation criteria defined but not consistently applied, review processes documented but bypassed under time pressure, override rates that are suspiciously low (suggesting reviewers are not genuinely engaging with AI outputs), and feedback mechanisms that exist in design but not in practice.
Ready to act on this?
Start with the AI Workforce Blueprint™ — a fixed-price 2-3 week engagement that maps your specific opportunity and produces a board-ready roadmap.
Book a Blueprint Call →