An independently audited AI management system, ready for certification
ValueMentor’s independent internal audit confirmed the client’s Artificial Intelligence Management System (AIMS) was ready for the ISO/IEC 42001:2023 certification audit.
A regulated fintech firm uses embedded AI to automate due diligence and RFP/DDQ responses for asset managers and institutional investors. Its clients and regulators needed proof that this AI is governed, not just a promise. An AIMS audited against ISO/IEC 42001 now gives them that proof.
01. Overview
The client entered its ISO/IEC 42001 certification audit with an AIMS that had already been tested by an independent internal auditor.
The client is a regulated fintech firm in the United Arab Emirates. It builds AI-powered due-diligence and data-workflow software for asset managers, institutional investors and consultants. AI is embedded in specific workflows. Its AI assistant drafts RFP and DDQ responses, extracts data, answers questions on documents and supports ongoing monitoring.
These outputs feed investment and manager-selection decisions. An error, a weak control or an unexplained answer can reach the client’s customers directly. The firm needed a governance system it could show to customers and regulators, and a way to prove that system worked before an external certification body assessed it.
ValueMentor acted as the independent internal auditor of the AIMS under Clause 9.2 of ISO/IEC 42001:2023.
Engagement at a glance
| Item | Detail |
|---|---|
| Client | A regulated fintech firm, United Arab Emirates |
| Sector | Financial technology serving asset managers, institutional investors and consultants |
| AI in scope | Embedded AI assistant for due diligence, RFP/DDQ responses, data extraction, document querying and monitoring |
| Standard | ISO/IEC 42001:2023, Artificial Intelligence Management System |
| Programme | Scoping, specialist pre-assessment and independent internal audit ahead of certification |
| ValueMentor role | Independent internal auditor (Clause 9.2) |
| Outcome | AIMS assessed as ready for the certification audit |
02. The challenge
Institutional investors will not rely on AI-generated due-diligence output unless the provider can prove how that AI is controlled.
| Challenge | What it meant in practice |
|---|---|
| AI output drives investment decisions | A wrong figure in an extracted dataset or a DDQ answer could mislead a manager-selection or allocation decision. Accuracy and human review had to be designed in, not assumed. |
| Customers ask for evidence, not statements | Asset managers and institutional investors now send AI questions in their own vendor due diligence. Policy documents alone did not answer them. |
| Sensitive client documents in AI workflows | The assistant reads confidential fund documents and data rooms. Data quality, confidentiality and traceability of sources had to be controlled at each stage. |
| AI risks are new to the risk register | Bias, transparency, explainability and data quality were not covered by existing information security controls. They needed their own assessment and treatment. |
| Growth across products and markets | Each new product or market risked a new, one-off approach to AI governance. The firm needed one set of processes, roles and controls that scales. |
| No proof before the certification audit | Without an independent check, the firm could not know whether its AIMS would hold up in front of a certification body. |
Client objectives
- Define a clear AIMS scope, objectives and interfaces that match how AI is actually used across the platform.
- Show customers and regulators that AI risks such as bias, transparency and data quality are identified and managed.
- Set repeatable processes, roles, controls and KPIs that scale across products and markets.
- Confirm, through an independent audit, that the AIMS is ready for the ISO/IEC 42001 certification audit.
03. The solution
Guiding principle: test the AIMS the way a certification body will, before the certification body does.
01. Scope the AIMS with the people who run the AI
ValueMentor worked with cross-functional teams, including product, engineering, data, risk, compliance and legal, to confirm the AIMS objectives, scope and interfaces. The scope was tied to the real AI use cases: due diligence, RFP/DDQ responses, data extraction, document querying and monitoring.
This mattered because a scope written only on paper fails at audit. Interfaces with third-party AI model providers, data sources and existing management systems had to be clear, so every control had an owner and a boundary.
02. Specialist pre-assessment by AI-experienced auditors
Auditors with AI and machine-learning experience reviewed the AIMS against Clauses 4 to 10 and the Annex A controls in the Statement of Applicability. They looked at the AI risk assessment, AI system impact assessment, data quality controls, human oversight and lifecycle records.
General IT auditors can confirm that a policy exists. AI-experienced auditors can test whether a control for bias, drift or output accuracy actually works. That difference is what a certification body will probe.
03. Independent internal audit of the AIMS
ValueMentor performed the internal audit required by Clause 9.2 as an independent party. The audit tested whether the AIMS conformed to the standard and to the client’s own requirements, and whether it was implemented and maintained in practice. Findings were reported to management as input to the management review.
Independence matters here. Clause 9.2 requires auditors to be objective and impartial, and an auditor who did not build the system gives the certification body and customers more confidence in the result.
04. Improvements closed before the certification audit
The pre-assessment and internal audit identified opportunities for improvement. The client addressed them before the certification audit. The resulting AIMS sets clear policies, roles, controls and KPIs to govern AI risk across the full lifecycle, from design and data sourcing to deployment, monitoring and retirement.
Closing gaps before the external audit lowers the risk of nonconformities at Stage 1 or Stage 2, and the delay and cost they bring.
04. The results
The client can now evidence responsible AI with an AIMS that has been independently audited against ISO/IEC 42001:2023.
| Objective | Outcome | Outcome |
|---|---|---|
| Clear AIMS scope, objectives and interfaces | Scope confirmed with cross-functional teams and tied to the live AI use cases | ✓ |
| Evidence that AI risks are managed | AI risks, including bias, transparency and data quality, assessed and treated with named owners | ✓ |
| Repeatable processes that scale | Policies, roles, controls and KPIs set across the AI lifecycle, reusable for new products and markets | ✓ |
| Independent proof of readiness | Independent internal audit completed; improvements addressed; AIMS assessed as ready for the certification audit | ✓ |
The firm can now answer customer AI due-diligence questions with audit evidence, not only policy statements. It enters the certification process with the internal audit and management review records that a certification body expects to sample.
05. Key takeaways
- Scope from real use cases. The AIMS held up because its scope matched how the AI assistant is actually used, not an abstract inventory.
- Use auditors who understand AI. Testing bias, drift and output accuracy needs AI knowledge, not only IT audit skills.
- Keep the internal audit independent. An auditor who did not build the AIMS gives customers and the certification body a result they can trust.
- Treat AI risk separately from security risk. Bias, transparency and data quality need their own assessment, owners and KPIs.
- Fix gaps before the certification body finds them. Closing improvements early protects the certification timeline and cost.
06. Next steps
Can you prove your AI is governed?
ValueMentor helps organisations build, audit and certify AI management systems against ISO/IEC 42001.
- ISO/IEC 42001 gap assessment and certification readiness
- Independent internal audit of the AIMS
- AI risk and AI system impact assessments
- AI security testing for LLM and agentic AI applications
