AI-Accelerated AIMS Audit and Assurance

Updated 2026-07-24 based on S-2026-07-24-weekly-briefing — records that the proposal’s local workspace and wiki writes were left pending a device-bridge reconnection at commit time; routed to Open questions / blockers.

Status: active Started: 2026-07-19 Last touched: 2026-07-24

Why this project exists

Apply AI tools and agents, in a controlled way, to accelerate and improve AIMS (ISO/IEC 42001) audits and assurance reviews and PECB auditor activities — preserving required outputs, evidence and audit trail — per Paul’s 2026-07-19 brief [S-2026-07-19-ai-aims-audit-acceleration].

Current state

• Approach-and-methods proposal delivered 2026-07-19 as Word + Markdown + process diagram in _ClaudeWorkspace\04 Ai and Data services\ (AI-Accelerated-AIMS-Audit-Assurance-Approach-2026-07-19.docx/.md, aims_ai_audit_flow.png), with a work-breakdown record (AI_AIMS_Audit_Acceleration_Work_Breakdown_2026-07-19.md) [S-2026-07-19-ai-aims-audit-acceleration].
• Recommended architecture: eight engagement agents (A1 Plan Drafter, A2 Working-Docs Generator, A3 Document Reviewer, A4 Evidence Analyst, A5 Nonconformity Drafter, A6 Report Assembler, A7 Follow-up Assistant, A8 Audit-Hours Logger) inside a governance layer (AI-use policy, AI-Use Register, prompt version control, confidentiality boundary), grounded by a standards knowledge layer and formatted by IGA Toolkit v1 templates; every hand-off has a human review gate [S-2026-07-19-ai-aims-audit-acceleration].
• Build roadmap: Wave A Aug 2026 (governance artefacts, clause-to-evidence map, A3); Wave B Sep–Oct 2026 (A1/A2/A5/A6/A8; full-chain validation in the exam-prep Week 8–9 mock audit); Wave C Nov 2026+ post-pilot (A4/A7, parallel-running write-up, ISO 42006-aligned methodology “AI-assisted methods” section) [S-2026-07-19-ai-aims-audit-acceleration]. Note (2026-08-16): the exam-prep pathway start is delayed to 13 Sep 2026, so its Week 8–9 mock audit — Wave B’s full-chain validation point — re-baselines to ≈ Nov 2026 [inference]; wave dates may need revisiting [S-2026-08-16-pathway-start-delay].
• Nothing built yet — proposal stage only; work breakdown items 1–9 all Not started/Blocked.

Decisions made

• 2026-07-19 — Approach: extend the IGA Toolkit build pattern (versioned Claude/Cowork agent briefs, per-brief QA gates, one shared spec) rather than adopt a third-party audit platform; platforms (Vanta, Drata, 6clicks) treated as the subject of audits, not the auditor’s tooling [S-2026-07-19-ai-aims-audit-acceleration].
• 2026-07-19 — Controlled-use operating model fixed at six guardrails: human accountability (prohibited-use list); FRC-style AI-use documentation (AI-Use Register); confidentiality boundary (enterprise environment only); impartiality (no self-review, no reliance on auditee-platform conclusions); hallucination controls (mandatory Evidence Reference, parallel running); own-tooling AIMS discipline [S-2026-07-19-ai-aims-audit-acceleration].
• 2026-07-19 — Every AI-assisted workflow mapped to PECB’s nine countable audit activities so engagement delivery and the 300-hour Lead Auditor evidence share one log (A8) [S-2026-07-19-ai-aims-audit-acceleration].

Open questions / blockers

1. PECB/CB position on AI-assisted audit-hours evidence — none found July 2026; monitor [S-2026-07-19-ai-aims-audit-acceleration].
2. GDPR handling of client audit evidence in AI tooling — no auditor-specific guidance found; per-engagement analysis required [S-2026-07-19-ai-aims-audit-acceleration].
3. Verify secondary-sourced claims (IAF MD 4:2023 ICT wording; ISO 19011:2026 changes) against paywalled primary documents [S-2026-07-19-ai-aims-audit-acceleration].
4. Wave A build not scheduled into a session yet; depends on transition-plan Month 1 capacity alongside IGA Toolkit Wave 1.
5. 2026-07-24 (weekly briefing) — delivery-hygiene loop: the proposal’s local workspace files and wiki updates were left pending a desktop/device-bridge reconnection at commit; confirm the files and this project page were written to disk once reconnected so the in-chat deliverables are not the only copy [S-2026-07-24-weekly-briefing].

Connected wiki pages

• relevant-to → Service Line — Independent Governance Assurance — the agents draft into IGA templates; the service line’s delivery method [S-2026-07-19-ai-aims-audit-acceleration].
• relates-to → PECB ISO 42001 Lead Auditor Certification — mock-audit infrastructure for exam Phase 3; A8 feeds the audit-hours log [S-2026-07-19-ai-aims-audit-acceleration].
• relates-to → AI and Data Assurance Pathway — the governance artefacts exercise pathway items (Tool Registry, Prompt Change Control SOP, AI Logging & Evidence Specification) [S-2026-07-19-ai-aims-audit-acceleration].
• relates-to → Practice Build — Phase 1 and Phase 2 Tools — reuses the IGA Toolkit build pattern and QA gate. [inference]
• relates-to → ISO 42001 — the audit criteria the agents support [S-2026-07-19-ai-aims-audit-acceleration].
• derived-from → S-2026-07-19-ai-aims-audit-acceleration — the proposal source.
• derived-from → S-2026-07-24-weekly-briefing — flagged the pending local/wiki writes as an open delivery-hygiene loop.

History

• 2026-07-19 — Project created: proposal, diagram and work-breakdown record delivered; no agents built yet.

Sources / notes

• S-2026-07-19-ai-aims-audit-acceleration
• Work-breakdown record: _ClaudeWorkspace\04 Ai and Data services\AI_AIMS_Audit_Acceleration_Work_Breakdown_2026-07-19.md — standing instructions for any AI vendor agent continuing this work.