AI-Accelerated AIMS Audit & Assurance — Approach and Methods
Tag: S-2026-07-19-ai-aims-audit-acceleration Type: own-writing Author(s): Paul Miles (Red Strata), drafted with Claude (Cowork session) Date of source: 2026-07-19 Date ingested: 2026-07-19 Authority weight: medium — own commissioned synthesis grounded in two sourced web-research sweeps plus Paul’s existing service-line material; external claims carry URLs but several rest on secondary sources (marked in the document) Raw file: S-2026-07-19-ai-aims-audit-acceleration.md
What it claims
A proposal for applying AI tools and agents, in a controlled way, to accelerate AIMS (ISO/IEC 42001) audits and assurance reviews and PECB auditor activities. It claims the profession has moved to permission-with-conditions on auditors using AI (FRC AI-in-Audit guidance Jun 2025 and GenAI/agentic guidance Mar 2026; IAF MD 4:2023 ICT definition reported to include AI; UKAS technical bulletin Jun 2025; PECB Insights Jun 2026), with consistent conditions: human accountability, AI use documented in the audit file, confidentiality/impartiality protected, outputs validated. It maps AI assistance onto the ISO 19011 lifecycle × PECB’s nine countable audit activities (an original synthesis — no published mapping was found), recommends extending the IGA Toolkit build pattern into an eight-agent workspace (A1 Plan Drafter … A8 Audit-Hours Logger) on a three-layer architecture rather than buying a platform, and defines a six-control operating model. It notes ISO/IEC 42006:2025 is silent on certification bodies’ own AI use, so ISO/IEC 17021-1 cl. 5.2/8.4 and the PECB Code of Ethics are the binding constraints. Deliverables: proposal (.docx/.md), process diagram (PNG), work-breakdown record, in 04 Ai and Data services.
Notable quotes
“The human auditor is always accountable” — FRC, March 2026 guidance news release (quoted in §3 of the document). “Where AI must not be used: audit conclusions and conformity opinions, risk-rating sign-off, certification decisions, closing-meeting judgement” (§1).
What’s speculative vs. asserted
- Asserted with primary/first-party sources: FRC guidance content; UKAS bulletin; PECB nine-activity list (verbatim from pecb.com); PECB Insights articles; certification-body Stage 1/2 mechanics; vendor platform claims (vendor pages).
- Reported via secondary sources, flagged for verification: IAF MD 4:2023 ICT-includes-AI wording (via CQI/IRCA); ISO 19011:2026 changes (via CertBetter). Primary documents paywalled.
- Speculative/original: the ISO 19011 × PECB activity × AI method map (§4) is the document’s own synthesis; acceleration magnitudes are deliberately unquantified pending pilot measurement.
Topics this feeds
- AI-Accelerated AIMS Audit and Assurance — the project page created from this source.
- PECB ISO 42001 Lead Auditor Certification — audit-hours logging and mock-audit tooling implications.
- Service Line — Independent Governance Assurance — delivery-method extension of the IGA toolkit.
Open questions raised
- Will PECB or certification bodies issue any restriction on AI-assisted work counting toward audit-hours evidence? (None found as of July 2026.)
- GDPR treatment of client audit evidence in AI tooling — no auditor-specific guidance found; per-engagement processor/controller analysis needed.
- Verify IAF MD 4:2023 and ISO 19011:2026 claims against the primary (paywalled) documents.