You Built Your ISO System with AI. Who Audits It?

AI has changed how ISO management systems get built. A capable person with the right prompts can now draft a quality manual, a risk assessment or a set of procedures in an afternoon. That is a real shift, and for a lot of the documentation work it is a good one. But it leaves a gap that catches people out at certification time, and it sits in one specific clause: 9.2, internal audit.

What clause 9.2 asks for

Every ISO management system standard, ISO 9001, ISO 27001, ISO 45001, ISO 14001 and ISO 42001, requires you to run internal audits at planned intervals. The point is not to produce another document. It is to check, independently, that the system you have written down is actually being followed and is actually working. The standard is specific about who can do this: the audit process must be objective and impartial, and auditors cannot audit their own work. Competence matters just as much. An internal auditor has to understand both the standard and your business well enough to tell the difference between a system that looks compliant on paper and one that holds up in practice.

Why AI cannot be your internal auditor

This is where an AI-built system runs into a wall. The tool that helped you write the procedures has, in effect, done the work. It cannot then turn around and provide an independent, impartial audit of that same work, because that is the definition of auditing your own output. Independence aside, an internal audit is an exercise in judgement: interviewing people, following a process from end to end, testing whether a control does what it claims, and deciding whether a gap is a minor observation or a non-conformity that will stop your certification. A language model can draft an audit checklist. It cannot sit in your office, watch how the work really happens and form a defensible opinion about it. Certification bodies know this. At your Stage 2 or surveillance audit they will look for evidence of a genuine internal audit, conducted by someone competent and independent, with findings that were actually acted on.

What a real internal audit catches that a template does not

The value of a good internal audit is in the gap between what is written and what is done. AI and templates are excellent at the first part and blind to the second. An experienced auditor finds the process everyone quietly stopped following, the risk that was documented but never treated, the record that should exist and does not. Those are exactly the findings a certification body will raise if you do not find them first. Finding them yourself, early, is the whole point of clause 9.2.

So what should you do?

You have three practical options. Train someone in-house who is independent of the areas they audit, which works if you are large enough to have that separation. Outsource the internal audit to an external ISO auditor, which most small and mid-sized businesses find cheaper and cleaner than building the capability internally. Or take a hybrid path: have your team run the routine audits and bring in an independent auditor for the areas they cannot objectively assess, or to mentor them until they can. There is no single right answer, but doing nothing, or assuming the AI that built the system can also audit it, is the option that fails at certification.

Building your system with AI or in-house is fine, and often smart. Just plan for the one part it cannot do. Streamline provides independent ISO internal audits across Australia, and we also mentor teams to run their own. If you have built a system and want it audited properly before the certification body sees it, get in touch.