Scoping an AI audit: decision, boundary and authority

“Audit our AI” defines no examinable work. The mandate starts with the decision the organisation must take: commit to a supplier, authorise a version, accept a risk, restrict a use or refuse release. That decision determines the depth required and the authority that will receive the conclusion.

A useful question can be disproved. “Does the candidate version meet the approved conditions for this use and this population?” can lead to yes, no or unable to conclude. “Is our system reliable?” merges several criteria and invites a general opinion that cannot be challenged.

The audited unit is not the model’s commercial name. It includes the use, data, transformations, components, versions, parameters, tools, human and automated controls, interfaces and dependencies that contribute to a decision or action.

The declared diagram is only a starting hypothesis. Configurations, logs, technical contracts and observed behaviour confirm the boundary. Any gap between the announced architecture and the operating architecture becomes an audit fact, not a silent diagram correction.

Included

Entities, third parties, uses, populations, periods, environments and interfaces

Frozen

Model, data, parameter, rule and control versions examined

Excluded

Unavailable components or periods, with the expected effect on the conclusion

Owner

Authority that accepts the mandate, receives reservations and decides

A rigorous audit does not request “all access”. For each procedure, it states the item, trace, environment or interview required, its sensitivity and how the result will be retained. Minimum access means the least access that still allows the procedure to run and the expected conclusion to be supported.

When access is refused, unavailable or technically impossible, the auditor does not replace observation with a favourable assumption. The restriction is qualified, alternative evidence is sought, and the conclusion is narrowed when that alternative does not carry the same strength.

The mandate names the sponsor, system owner, scope owners and the authority able to decide. It also records prior work, commercial relationships or conflicts that could affect the examination. A conclusion addressed to someone without the power to correct, restrict or accept risk may be administratively neat but remains operationally inert.

Before work begins, someone outside the scoping discussion must be able to answer five questions: which decision will be taken, about which system and version, against which criteria, with which access, and by which authority. Any missing answer will reappear later as ambiguity in sampling, severity or closure.