Internal Audit Checklist for AI Systems

The internal auditor asked for the AI file. She received a folder of inauguration photographs, a GeM invoice, and a vendor ISO certificate. She put them aside and asked for last Thursday's third grievance. Nobody could produce the packet. That visit was more useful than a week of maturity models. This checklist is what she used the second time, after she had language.

Internal audit is not CAG and should not pretend to be. It is the department's chance to find mute files, unowned tools and Saturday-night spends while the finding is still internal. Sample cases. Test controls. Write paras in nouns.

Checklist for IA and DPOs. 16 August 2026. Not an official standard. Not legal advice.

Before the visit

1. Obtain the AI register extract, including killed rows and unofficial declarations.
2. Obtain the departmental risk scheme and the money-class annex (tool-to-serial).
3. Pick the sample: three cases per high-attention workflow, one refusal, one override, one dark-export rehearsal if they claim one.
4. Ask the PIO for the disclosure pack. If it does not exist, that is already a para.
5. Do not accept a vendor presentation in lieu of a case number.

The checklist

Mark each line pass / fail / not applicable with evidence IDs. Adjectives are not evidence.

Line	Test	Evidence
Register	Every live agent has a row with owner, purpose, location, class, sunset	Register dated extract
Shadow tools	Amnesty happened; unofficial public models are a conduct issue	Invoice scan vs register
Packet	Four sentences exist for each sampled case	Export the department owns
Versions	Prompt/policy/model IDs on the packet match the store	Diff + production pointer
Logs	Eight fields; SIEM copy; Indian jurisdiction; 180-day floor	SIEM query + clock source
Integrity	Dark export works; tamper-evident, not a theatre chain	Rehearsal minutes
Refusal	Purpose, class, child, payment-adjacent hard-stop	Live failed-call in staging
DFPR	No agent submit/pay/place; no stored DDO credential	Tool allow-list + secret scan
Reversibility	Irreversible tools not on the agent account	SMS/pay/book test
Escalation	Roster of living posts; packet climbs; clocks	Leave-day ticket
Override	Codes + sentences on rejects; sample of fast accepts	System-of-record rows
RTI / grievance	Disclosure pack; dual-path links on the citizen UI	Screenshot + pack
Eval honesty	Slices you serve; no fake statutory bias certificate	Cell table + card
Training ban	Contract + technical isolation; no customer-data training	Clause + pcap / config

How to write the para

Name the workflow, the case, the missing object, and the risk in administrative English. 'The scholarship agent cannot produce a retrieval set for file 4418; a later officer cannot reconstruct the rejection' is a para. 'AI governance is evolving' is a press note. Recommend a dated fix, not a maturity journey.

Automatic fails go to the secretary this week. The rest can ride the quarterly Board folio. Do not let a money-gate fail wait for the folio.

Two first visits

Objections

The CIO says IA lacks technical skill. Answer: IA is testing ownership, packets and gates. They can take a NIC colleague. They do not need to grade attention heads.

The vendor offers to fill the checklist. Answer: no. They may produce evidence. They may not tick their own boxes.

Leadership wants a green dashboard for the minister. Answer: the checklist produces paras. Green without cases is the first visit she already had.

Legal wants every line marked not applicable because there is no AI Act. Answer: DFPR, RTI, CERT-In and ordinary regularity still apply. N/A is for tools you do not run, not for laws you wish away.

A four-week playbook

• Week 1: adopt this list as an IA programme note. Say it is departmental, not a CAG form.
• Week 2: run the before-the-visit requests. Kill the photograph folder as a response.
• Week 3: execute the sample. Write paras in nouns with dates.
• Week 4: put automatic fails to the secretary. Put the rest on the Board folio.

File note you can paste

Subject: First-visit internal audit programme for software agents.

Internal audit will sample live agent workflows against the attached checklist (register, packets, versions, logs, integrity, refusal, DFPR, reversibility, escalation, override, RTI/grievance, eval honesty, training ban). Evidence will be departmental objects, not vendor slides. This list is not a CAG or MeitY instrument.

Automatic fails — spend capability, missing packets, vendor-only logs, child or payment tools on a general agent — will be reported to the secretary without waiting for the quarterly pack. This note is not legal advice.

Sampling without becoming the data-science wing

IA does not need a GPU. It needs a case number, a packet, and the courage to say the packet is empty. Bring a NIC colleague if a SIEM query is required. Do not let that colleague become the only person who understands the visit. The para must be writable by the auditor in administrative English.

Rotate the sample. If the programme always offers 4418, they have a show file. Pick from the grievance list, from a random week, and from a leave-day. The leave-day sample is how you catch the retired consultant's mailbox.

Follow a finding to a date. 'Strengthen AI governance' is not a recommendation. 'Disable the SMS tool on workflow PT-REVISE by 30 September and show IA the failed call' is a recommendation. Revisit. If the date slips, the next para names the slip. That is how internal audit remains internal rather than becoming a waiting room for CAG.

Share the automatic-fail definition with the CIO before the first visit. Surprise is for evidence, not for the existence of the list. A CIO who knows that stored DDO credentials are an automatic fail may rotate them on Monday. That is a win, not a lost para.

• Never accept a vendor-filled checklist.
• Never grade model quality as if it were a regularity issue; grade the missing eval pack instead.
• Put the first-visit dates on the Board folio so the body sees that IA exists.

Informational checklist for Indian public institutions. Confirm your IA charter, CAG audit manual and sector circulars before you treat any line as mandatory law.

How this survives CAG, RTI or the Board

“Internal Audit Checklist for AI Systems” is not a workshop slide. A P6 Compliance/DPO will have to reconstruct a decision after the officer who clicked approve has been transferred. Write the artefact that lets a stranger replay the case: the log fields, the approval, the override, the register row.

Internal audit should not grade adjectives. Pull three cases, walk the four sentences, test a refusal, test a dark export, and ask who spent. This is the first-visit list. India AI Governance Guidelines (November 2025) are guidelines, not a statute. DPDP still allocates fiduciary duty. Delegation of Financial Powers still allocates who may spend. Do not hide those instruments behind the word governance.

If you cannot show who acted, on which purpose, with which data class, and who could have refused, you do not have accountability. You have a chatbot with a charter PDF.

• Name the owner of “internal audit AI checklist” inside the department, not the vendor.
• Keep CERT-In-relevant logs in India for the required period.
• Store overrides with a reason an auditor can read.
• Put the workflow on the AI register before it touches a citizen.

Close this loop before the next CAB

Put “Internal Audit Checklist for AI Systems” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P6 Compliance/DPO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “internal audit AI checklist” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next noting must contain

“Internal Audit Checklist for AI Systems” belongs in a file, not only in a search result. A P6 Compliance/DPO should be able to point at one artefact that proves “internal audit AI checklist”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

Internal audit should not grade adjectives. Pull three cases, walk the four sentences, test a refusal, test a dark export, and ask who spent. This is the first-visit list. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C6 Governance & Audit: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “internal audit AI checklist”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.