SECAI Core · phase 9 of 15
AI auditor
A role that provides independent assurance and verification that approvals, monitoring, and incident handling adhere to policy
The Explain card
- Plain English
- An AI auditor provides independent assurance that approvals, monitoring and incident handling for AI systems actually follow policy. They verify; they do not build.
- Example
- During a quarterly review, the AI auditor samples ten model deployments and checks that each has a signed risk assessment, that monitoring alerts were triaged within the required time, and that last month's prompt-injection incident was logged and escalated according to procedure.
- Why it matters
- Controls that nobody checks quietly decay. An auditor gives defenders and leadership an honest picture of what is really happening, not what the policy assumes.
- Hook
- Trust, but verify, and write the findings down.
Where it sits in the deck
Phase 9: Roles, Teams, and Organisational Accountability
Governance frameworks are executed by people — introduce the human roles and organisational structures responsible for building, operating, and auditing AI systems.
