The ISO 42001 Internal Auditor certification is a person-level credential for anyone who plans, carries out and reports internal audits of an AI management system (AIMS). At the Global AI Certification Council (GAICC), you answer 60 multiple-choice questions in 90 minutes without notes and need 70 percent to pass. You need 32 contact hours of Internal Auditor training before you sit. It stays valid for three years, and each renewal needs 32 hours of logged continuing professional development (CPD).
Three things share the name and are easy to confuse. The GAICC credential covers first-party audits, meaning audits of the organization you work for. It is not a general internal audit designation, and it does not certify your employer. Audits of other organizations belong to the Lead Auditor level, and how the Lead Auditor credential is examined is covered on its own page.
What the Internal Auditor credential covers
The GAICC Internal Auditor credential certifies that you can plan, perform, document and report internal audits of an AIMS against ISO/IEC 42001, using the method in ISO 19011. GAICC’s Handbook aims it at internal auditors and assurance staff. Its content outline widens the audience to compliance officers, AI governance practitioners and quality, data or risk managers.
ISO/IEC 42001 itself asks for competence, and it names no auditor credential. Clause 7.2 has the organization decide what competence its people need and keep evidence of it. The standard’s own definition of audit, in clause 3.18, adds a practical point. An internal audit can be run by the organization itself or by an outside party working on its behalf. A credential is one way to show an employer or a client that you can do that work.
The credential fits best in three situations.
- Your organization runs an AIMS and needs in-house auditors.
- You already audit to ISO 9001 or ISO/IEC 27001, and AI systems such as chatbots, scoring models or vendor AI services are now entering the scope of the audits you run each year.
- You advise one organization at a time on audit readiness and want a credential that names the AI standard.
It fits less well if your work is auditing suppliers or other companies, which is Lead Auditor ground. It also fits less well if your goal is building the AIMS, since that is implementer work.
The credential stays with you as a named person. Your employer gets no ISO/IEC 42001 certificate from your pass. A company is certified only after a certification body audits its AIMS.
Not a general internal audit designation
The Certified Internal Auditor (CIA) is a separate designation issued by the Institute of Internal Auditors (IIA). That designation covers the internal audit function as a whole. The GAICC Internal Auditor is narrower. It tests whether you can audit one management system against ISO/IEC 42001. Holding one tells an employer nothing about the other.
Internal Auditor or Lead Auditor?
The Internal Auditor is the right credential when the AIMS you audit belongs to your own employer. If your audits will reach suppliers or other organizations, take the Lead Auditor instead. The table sets the two GAICC credentials side by side, drawing on their Handbooks and content outlines.
| Field | GAICC Internal Auditor | GAICC Lead Auditor |
| Who you audit | Your own organization (first party) | Suppliers and other organizations; its Handbook names second-party audits and initial third-party audits at Stage 1 and Stage 2 |
| Level in the Handbook | Practitioner, internal auditing | Practitioner, auditing |
| Standards the Handbook lists | ISO/IEC 42001, ISO 19011 | ISO/IEC 42001, ISO 19011, ISO/IEC 17021-1 |
| Item mix | 46 single-answer items and 14 select-all items | 45 single-answer items and 15 select-all items |
| Heaviest domain | Conducting the internal audit, 35 percent | Audit of implementation and operational control, 40 percent |
| Training before the exam | 32 hours of Internal Auditor training | 32 hours of Lead Auditor training |
| Experience the content outline lists | Diploma plus two years, or a degree plus one year, including one complete internal audit cycle | Diploma plus three years, or a degree plus one year, measured in months |
| Exam on its own | US$249 (member rate US$149) | US$249 (member rate US$149) |
| Renewal | 32 CPD hours every three years | 32 CPD hours every three years |
At GAICC the two courses carry the same 32 training hours. The real differences are scope, team leadership and the experience rule. Internal Auditor domains follow the audit itself, from planning to corrective action, while the Lead Auditor domains follow the parts of the AIMS under audit. The Lead Auditor adds audit-team leadership, program management and Stage 1 and Stage 2 audits of other organizations.
If you are still deciding between auditing and building an AIMS, comparing the implementer and auditor credentials sets out that choice.
Eligibility and the audit-cycle rule
Only one entry rule appears in the Candidate Handbook: a minimum of 32 contact hours of structured Internal Auditor training, Modules 1 to 16. The hours must come from a provider GAICC authorizes or from an equivalent recognized institution, and GAICC’s self-paced courses count. The Handbook also recommends Foundation-level knowledge of ISO/IEC 42001.
The content outline goes further on experience. It lists two years of cumulative professional experience for diploma holders and one year for degree holders. It also asks that your experience include at least one complete internal audit cycle, from planning through fieldwork and reporting to follow-up. The cycle can come from an AIMS or from another ISO management system. Because the Handbook leaves these experience lines out, ask GAICC which version it enforces before you submit.
| Requirement | Where it is written | What to have ready |
| 32 contact hours of Internal Auditor training | Handbook section 2 | Training-completion certificates |
| Foundation-level knowledge | Handbook section 2 (recommended) | Nothing formal; what the Foundation exam covers shows the level |
| Professional experience by education | Content outline section 4 | Roles and dates |
| One complete internal audit cycle | Content outline section 4 | The audit plan, report and follow-up record you took part in |
Foundation holders get a shortcut. The content outline says they automatically meet the prerequisite knowledge requirement once they finish the Internal Auditor training modules. It also puts application review at five calendar days when the training documents are complete, and longer when an application is picked for verification.
With eligibility settled, the work moves to the exam and to the audit practice it tests.
The Internal Auditor exam at a glance
Section 3 of the Internal Auditor Candidate Handbook, first issued in June 2026, fixes every exam rule in this table.
| Field | GAICC ISO/IEC 42001 Internal Auditor |
| Items | 60 multiple-choice: 46 with one correct option out of four, and 14 select-all items with five options and no partial credit |
| Time | 90 minutes |
| Pass mark | 70 percent, treated as provisional; a modified Angoff standard-setting study confirms it exam by exam |
| Notes and materials | None; the exam is closed book |
| Where you sit | At home with an AI-assisted online proctor, or in an approved test center |
| Language | English; GAICC can arrange others on request |
| Before you book | 32 contact hours of Internal Auditor training |
| Attempts | One per registration; each resit costs a discounted fee |
| Result | Shown when you finish, with a note on each domain |
| Validity and renewal | Three years; 32 CPD hours per cycle |
| Fee for the exam alone | US$249 for non-members, US$149 for members |
GAICC’s Internal Auditor course with the exam included is priced at US$875, or US$698 when 12 months of membership are included. It bundles the 32 hours with simulator practice and a single sitting.
The Internal Auditor content outline splits the exam into four weighted domains.
| Domain | Weight | Tasks the content outline lists | Clauses behind them (GAICC mapping) |
| I. Governance, planning and preparation of the internal audit | 25% | Set scope, objectives and criteria; review context and governance; build a risk-based program; choose methods, sampling and team; prepare checklists; plan the opening meeting | 4, 5, 9.2 |
| II. Conducting the internal audit and evaluating implementation | 35% | Follow the plan; review risk and impact assessments; check operational control, data handling and life cycle controls, competence and documented information; collect evidence; classify findings; hold the closing meeting | 6.1, 7.1 to 7.5, 8 |
| III. Performance evaluation, corrective action and continual improvement | 25% | Audit monitoring, the internal audit program itself, management review and corrective action; trace findings to fixes; spot improvement opportunities | 9.1, 9.2, 9.3, 10.1, 10.2 |
| IV. Ethics, objectivity and professional conduct | 15% | Stay impartial; protect confidential AI data; report findings fairly; escalate ethical concerns | ISO 19011 principles; GAICC Code of Ethics |
Items sit at three levels. Some test understanding of clauses and audit terms. Others test applying audit techniques to evidence. The hardest ask you to judge an ambiguous case and justify a finding.
A clause 9.2 audit from the auditor’s seat
An internal auditor checks two things under clause 9.2. One is whether the AIMS meets the organization’s own requirements and the standard. The other is whether it is effectively implemented and maintained. The auditor works to a plan inside the organization’s internal audit program and follows the guidance in ISO 19011.
ISO 19011:2026 is the audit method guideline ISO revised in 2026, written for auditing any management system. Its fourth edition appeared in May 2026 and replaced the 2018 edition. Its foreword lists wider guidance on remote auditing, which suits AI systems that run in the cloud or behind an API. Three of its principles shape most AIMS audit decisions.
- Independence: stay independent of the activity you audit wherever practicable, and free of bias and conflict of interest in every case.
- Evidence-based approach: base conclusions on verifiable evidence, usually drawn from samples.
- Risk-based approach: spend the most audit time where AI risk and impact are highest.
The audit itself follows the sequence GAICC’s content outline sets out in its task lists.
- Agree the scope, objectives and criteria. Criteria include the ISO/IEC 42001 clauses, the Annex A controls that the organization’s Statement of Applicability includes and its own AIMS documents.
- Review the context before fieldwork: the interested parties, the governance structure, the AI policy and the risk and impact registers.
- Plan the methods and the sample. Choose interviews, document review and observation, and size the sample to the risk of the process.
- Prepare a checklist mapped to clauses, with AI-specific questions and evidence forms.
- Hold the opening meeting to confirm scope, timing and how issues will be escalated.
- Collect and verify evidence. Interview AI system owners, observe the work, sample logs and cross-check results across sources.
- Classify each finding as a nonconformity, an observation or an opportunity for improvement, and link it to a clause or control.
- Hold the closing meeting, agree the findings and set corrective action dates.
- Report the results to management, then verify that corrective actions closed the gaps.
For the tests themselves, see the clause-by-clause tests auditors apply, with evidence to sample for each clause and control. The organization’s side of the same work, from audit frequency to who may audit, is in how an organization builds its internal audit program.
A study plan for the closed-book exam
Build your study on the domain weights and on one real audit cycle. Since no notes are allowed in the room, clause numbers, records and audit steps all have to come from memory, so practice retrieval more than reading.
Split your time in proportion to the weights. For each 10 hours of study after the course, about 3.5 go to Domain II, 2.5 each to Domains I and III, and 1.5 to Domain IV. That split, and the table built on it, are GAICC suggestions for illustration.
| Hours you can give after training | How to spend them | Recall practice |
| About 20 | 7 on conducting the audit, 5 on planning, 5 on corrective action and improvement, 3 on ethics and conduct | Write the nine audit steps from memory twice a week |
| About 40 | 14, 10, 10 and 6 hours across the same four domains, plus one full mock audit of a single AI process | Add a clause-to-evidence list for clauses 4 to 10 |
| About 60 | 21, 15, 15 and 9 hours, plus two mock audits and a written report for each | Grade 10 sample findings a week without notes |
A mock audit teaches more than rereading. Pick one AI system at work, or a case from the course, and walk it through all nine steps. Write the findings with the clause or control each one rests on. Then check your work against the standard, since scenario options can hinge on precise wording.
Under the Handbook, exam content is confidential, and copying, recording or passing it on counts as misconduct. The penalty can be an invalidated result and withdrawal of the credential. Use the simulator in the course, and treat any site selling “real questions” as a risk to the credential itself.
Once you submit the paper, the result appears on screen and the post-exam steps begin.
After the exam: result, certificate and renewal
As soon as you finish, the screen shows your overall score, a pass or fail decision and a performance note for each domain. GAICC may confirm a provisional result after a routine integrity review. Successful candidates then receive a certificate and a digital badge, and both are shareable on LinkedIn and resumes, according to the content outline.
If you fail, wait at least 30 days before trying again. You may resit twice in any 12 months, each one priced at a discounted rate, and after that you register again. Let the domain feedback decide what you restudy first. If you think a result or certification decision is wrong, the Handbook lets you appeal through GAICC’s appeals and complaints process. People who took no part in the original decision handle each appeal. Anyone may also raise a complaint through the same route, so a manager or client with a concern about a certified auditor has a channel too.
| Renewal field | Rule |
| How long it lasts | Three years from the day you are certified |
| Hours per cycle | 32 |
| Professional learning | 11 hours: training, webinars or workshops on internal auditing, ISO/IEC 42001, AI ethics or risk-based auditing |
| Practical application | 11 hours: taking part in AIMS internal audits, verifying corrective actions, audit reporting or mentoring new internal auditors |
| Contribution and knowledge sharing | 5 hours: presentations, internal workshops or governance initiatives |
| Elective | 5 hours: other development that strengthens auditing skill |
| If you miss the date | Three months of grace, then the exam again, under the Handbook; the content outline instead allows reinstatement within 12 months, so renew before expiry |
| Fee | GAICC publishes it each year; the Handbook prints no amount |
The content outline breaks renewal into four tasks.
- File the renewal application in GAICC’s Certification Portal ahead of expiry.
- Attach verifiable evidence for at least 32 CPD hours from the cycle.
- Pay the fee in the fee schedule current at the time.
- Confirm again that you accept GAICC’s Code of Professional Conduct and its ethical audit principles.
Some renewals are picked for a CPD audit, so keep attendance records, mentoring logs or employer letters that confirm your audit work.
Running your first internal audit as a certified auditor
Your first internal audit after certification should be small, scoped and fully documented. One AI system, or one process such as model change control, is enough to prove the method and build a record.
Start with the program owner. Ask for the audit program, the criteria for this audit and the results of earlier audits, which show where problems have clustered. Check your independence next. If you designed or operate any part of the scope, hand that part to a colleague or an external auditor.
During fieldwork, follow the evidence trail from risk to control to record. A typical trail starts at an entry in the risk register. It then runs to the Annex A control listed in the Statement of Applicability, and ends at the record that shows the control working. Write each finding with the requirement, the evidence and the gap. How to grade and word a finding covers nonconformities, observations and opportunities for improvement in detail.
Your audit feeds two later steps. Results go to top management for the clause 9.3 management review, and nonconformities go into clause 10.2 corrective action.
Keeping the audit file for CPD and later applications
Keep the plan, checklist, evidence log, report and follow-up record in one file. That file supports two things at once. It backs your claim to the 11 Practice hours at renewal, and it documents audit months if you later apply for the Lead Auditor. Note the dates, your role, the scope and who signed off the report, because GAICC’s CPD audits ask for verifiable evidence. Remove confidential AI data before the file leaves the organization, in line with Domain IV of the content outline.
Upgrading to Lead Auditor
No GAICC document publishes a credit or bridge from the Internal Auditor to the Lead Auditor. Moving up means the whole Lead Auditor route: its own 32-hour training requirement and its own exam.
| Step | Lead Auditor rule | What your Internal Auditor work gives you |
| Training | 32 hours of Lead Auditor course time | Familiar ground on audit method; whether any modules transfer is not stated |
| Exam | 60 items, 90 minutes, no notes, 70 percent to pass | Practice with scenario items and finding classification |
| Experience | The content outline lists three years with a diploma or one year with a degree, measured in months | Internal audit months count when they involve direct audit or evaluation work |
| Fee | US$249 exam only, or the package | No discount for Internal Auditor holders is published |
GAICC does publish two other shortcuts. Foundation holders meet the Lead Auditor’s prerequisite knowledge requirement, and Lead Auditor holders meet the Senior Lead Auditor’s. Ask GAICC whether your Internal Auditor training hours count before you buy a second course. For the price of the step, see the full cost of the Lead Auditor step.
The timing depends on what you want to audit next. Stay with the Internal Auditor while your audits remain inside your employer. Move to the Lead Auditor when supplier audits or certification-body work come into view, since those audits judge organizations you do not work for.
Frequently Asked Questions
Can an outside consultant act as our internal auditor?
Yes. Clause 3.18 of ISO/IEC 42001 says an internal audit can be conducted by the organization itself or by an external party on its behalf. The outside auditor still has to be competent and independent of the work audited. One limit applies. ISO/IEC 42006, the rulebook for AIMS certification bodies, bars the certification body that certifies you from running your internal audit, even under another name.
Is GAICC’s own course required before the exam?
No. The Handbook accepts 32 contact hours of Internal Auditor training from any provider GAICC authorizes or an equivalent recognized institution. You then pay the US$249 exam fee, or US$149 as a current member. Keep your training certificates, since the content outline ties the five-day review to complete training documents.
Does the Internal Auditor certificate expire?
Yes, three years after you are certified. You renew by filing evidence of 32 CPD hours, paying the renewal fee and reaffirming the Code of Ethics before expiry. After expiry the Handbook allows three months of grace, while the content outline allows reinstatement within 12 months. Once the window that applies has closed, you must sit the exam again and remove the credential and GAICC’s marks from your profile.
Does the credential cover ISO/IEC 27001 internal audits too?
No. The exam is built on ISO/IEC 42001 and ISO 19011, although the content outline says items can reference other ISO standards, ISO/IEC 27001 among them. Organizations can combine the two audits, which a note to clause 3.18 allows. Each set of criteria still needs its own coverage in the plan, and your credential speaks only to the AIMS part.
What if the exam software breaks down mid-session?
Write to support@gaicc.org straight away with a short account of the fault. The content outline promises a no-cost, no-penalty retest once GAICC verifies the technical problem. Run the system check from your joining instructions before exam day to cut the risk.
Can I go back to a question after moving on?
Only before you submit that section. The content outline describes a flag-for-review function, but it also says question order is randomized and a submitted section cannot be revisited. The platform also hands in your answers by itself when the timer reaches zero, so leave a few minutes to clear flagged items.
Is the GAICC Internal Auditor credential accredited?
The content outline states that GAICC develops and runs its certifications in alignment with ISO/IEC 17024, the standard for personnel certification bodies. Alignment and accreditation differ. Accreditation means an accreditation body has assessed the issuer and lists the scheme, so ask any issuer to name that body and check its register.
