---
name: "aims-audit"
description: "/compliance-os:aims-audit [scope] — ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before certification stage 1, before annual internal audit cycles, or when onboarding a new AI system into an existing AIMS."
---

# /compliance-os:aims-audit — AIMS ISO 42001 Forcing Questions

**Command:** `/compliance-os:aims-audit <scope>`

The ISO 42001 AIMS specialist pressure-tests any AI Management System work. Six questions before any certification commitment, internal audit cycle, or new-system onboarding.

## When to Run

- Before stage 1 ISO 42001 certification audit
- Before annual internal audit cycle (Clause 9.2)
- When onboarding a new AI system into existing AIMS scope
- When AI risk register hasn't been refreshed in > 6 months
- After material model change (re-evaluate risks per Clause 6.1.2)
- When audit findings hint at AIMS / ISMS / QMS duplication

## The Six AIMS Questions

### 1. Does the AIMS scope statement name every AI system?
**Scope omission = certification finding.**
- Including: embedded models, third-party AI services, "experimental" production systems
- Run `aims_gap_analyzer.py` to verify Clause 4.3 evidence
- "AI features added by SaaS vendors we use" = in scope if they affect the company's services

### 2. Does the AI policy commit to lawful use AND beneficial purpose AND human oversight AND continual improvement?
**Missing any of the four = critical nonconformity at stage 1.**
- AI policy is NOT info-sec policy — it has separate substantive content
- Reference ISO 42001 Annex A.2.2 + Clause 5.2
- Marketing-copy "AI ethics" doesn't pass

### 3. What's the risk register coverage, and which Annex A controls treat each risk?
**Risk identification without control mapping = Clause 6.1.3 fails.**
- Run `ai_risk_register_builder.py` per ISO 23894 methodology
- Every high/critical risk must link to ≥ 1 Annex A control
- "Residual verdict: additional_treatment_required" must be closed before stage 1

### 4. Has the AI risk assessment been re-run since the last material model change?
**Concept drift is not a one-time event.**
- Article 9 EU AI Act + ISO 42001 Clause 6.1.2 both require iterative risk assessment
- Material change = retraining on new data, fine-tuning, architecture change, deployment context change
- If "we did it 18 months ago and haven't touched it," the AIMS is broken

### 5. What's the Clause 9.2 internal audit plan, and is auditor independence respected?
**Without 9.2 plan, the AIMS is incomplete.**
- Run `aims_audit_scheduler.py` with scope + auditors + prior findings
- Audit every clause + applicable Annex A control over rolling 3-year cycle
- Same auditor cannot audit own work
- Cross-check with cs-quality-regulatory if integrated with 13485 audit programme

### 6. Has the AIMS been integrated with existing ISMS / QMS, or built in parallel?
**Parallel systems = 5x ongoing maintenance cost.**
- 60% of Clauses 4-10 evidence reuses ISO 27001 / 13485 with AI scope appended
- CAPA loop should be ONE loop with AI-tagged nonconformities, not separate
- Reference `cross_framework_mapping_ai.md` for the reuse map
- Cross-check with cs-ciso-advisor on ISO 27001 alignment

## Workflow

```bash
# 1. AIMS gap analysis
python ${CLAUDE_PLUGIN_ROOT}/vendor/ra-qm-team/iso42001-specialist/scripts/aims_gap_analyzer.py evidence.json

# 2. AI risk register
python ${CLAUDE_PLUGIN_ROOT}/vendor/ra-qm-team/iso42001-specialist/scripts/ai_risk_register_builder.py risks.json

# 3. Internal audit plan
python ${CLAUDE_PLUGIN_ROOT}/vendor/ra-qm-team/iso42001-specialist/scripts/aims_audit_scheduler.py audit_scope.json

# 4. Cross-framework reuse map (via compliance-os)
python ../../skills/compliance-os/scripts/cross_framework_mapper.py program.json
```

## Output Format

```markdown
# AIMS Audit: <scope>
**Date:** YYYY-MM-DD

## The Decision Being Made
[gap-closure | risk-treatment | audit-scope | new-system-onboarding]

## Gap Analysis (Clauses 4-10)
- Weighted coverage: X%
- Critical gaps: N
- Major gaps: M
- Certification readiness: ready | stage_2_candidate | not_ready

## AI Risk Register
- Total risks: N
- By severity: critical=X, high=Y, medium=Z, low=W
- Requires additional treatment: K
- Top risk requiring action: <description>

## Clause 9.2 Audit Plan
- 12-month coverage: clauses=X, controls=Y
- Auditor independence: clean | issues
- Prior-year follow-up: scheduled in Q1

## Cross-Framework Reuse
- ISO 27001 evidence reused: % of AIMS Clauses 4-10
- 13485 evidence reused: % (if applicable)
- Net-new for AIMS: % (mostly Annex A)

## Verdict
🟢 STAGE-1-READY | 🟡 CLOSE-CRITICALS-FIRST | 🔴 NOT-READY

## Top 3 Actions
[3 concrete next steps with owner + date]
```

## Routing

- `/compliance-os:compliance-readiness` — for multi-framework view
- `/compliance-os:ai-act-readiness` — if EU AI Act also applies
- `/c-level-agents:caio-review` — for executive AI strategy decisions
- `/c-level-agents:ciso-review` — for ISO 27001 cross-framework alignment
- `/c-level-agents:decide` — to log the verdict
- `/c-level-agents:freeze 30` — on certification commitments

## Related

- Agent: [`cs-aims-iso42001`](../../agents/cs-aims-iso42001.md)
- Skill: [`iso42001-specialist`](${CLAUDE_PLUGIN_ROOT}/vendor/ra-qm-team/iso42001-specialist/SKILL.md)
- Adjacent: `../../skills/compliance-os/`, `../ai-act-readiness/`, `../compliance-readiness/`

---

**Version:** 1.0.0

---

Attribution added by YourAIKit. It is not part of the upstream file.

- Source: https://github.com/alirezarezvani/claude-skills/tree/main/compliance-os/skills/aims-audit
- Credit: Alireza Rezvani, claude-skills
- Upstream copy: alirezarezvani/claude-skills at commit 6d2f02ea077eead1bee5411a31bcc6db5a11a70c, compliance-os/skills/aims-audit/SKILL.md
- Copyright: Copyright (c) 2025 Alireza Rezvani
- License: MIT. Full text: https://youraikit.com/licenses/alirezarezvani-claude-skills-root/LICENSE
- The full upstream license text (LICENSE) follows.

License (LICENSE):

```text
MIT License

Copyright (c) 2025 Alireza Rezvani

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
```