AUDITING ARTIFICAL INTELLIGENCE

Abstract

The rapid proliferation of artificial intelligence (AI) systems across critical sectors has introduced significant security, privacy, and ethical challenges. Traditional information security audit frameworks remain insufficient to address the unique risks associated with AI technologies, particularly in areas such as data integrity, model robustness, and algorithmic transparency. This study proposes a comprehensive and risk-based AI audit methodology that integrates governance, data security, model security, and application security dimensions into a unified control framework. The proposed methodology is structured around key control domains, including documentation, compliance, access control, application security, and model security, supported by representative control considerations. The proposed methodology supports systematic evaluation of AI audit controls through a structured assurance-oriented framework. Additionally, a risk prioritization approach is introduced to classify controls into different criticality levels, enabling organizations to focus on high-impact vulnerabilities such as data poisoning, model inversion, prompt injection, and sensitive data leakage. The methodology is designed as a step-by-step audit process, including scope definition, control mapping, evidence collection, evaluation, and reporting. This structured approach ensures both technical and organizational aspects of AI systems are systematically assessed. The study contributes to the literature by providing a practical, measurable, and adaptable framework that aligns with regulatory requirements such as data protection laws and ethical AI principles. Overall, the proposed AI audit framework enhances the auditability, transparency, and security of AI systems, offering organizations a robust tool to manage emerging AI-related risks effectively.