Insight · Technology Assurance

AI Governance Audit — HRA field checklist

2026-09-06. Version 1.0. Written for CFOs, audit committees, and AI safety officers of Indian companies deploying AI in finance, operations, or customer-facing decisions. Every question maps to a specific regulatory or standards clause — no vague governance language.

Why this exists

Every Indian regulator now wants to know how you control AI systems. The RBI FREE-AI committee (2025), SEBI's AI/ML disclosure circulars, MeitY's AI governance guidelines, ISO/IEC 42001, NIST AI RMF, and the EU AI Act (extraterritorially applicable to Indian exporters) all overlap but each phrases the same question differently.

This checklist consolidates them into 40 questions grouped into 8 domains. HRA uses it as the working document during our AI Governance Audit engagements. Any company can self-assess against it before buying an audit; that saves everyone time.

The rule for reading it: if you cannot answer a question with a specific document, screenshot, or code reference, that's the finding.

Domain 1: Governance foundation (5 questions)

1. Is there a written AI policy signed by the board / CEO, dated within the last 12 months? (ISO 42001 clause 5.2; RBI FREE-AI Sutra 1)
2. Is there a named AI Governance Officer or equivalent role, with published responsibilities? (ISO 42001 clause 5.3)
3. Does the AI policy define which systems are in scope for AI governance, using a threshold (e.g., systems that make or materially influence a decision without human authority to override in real time)? (NIST AI RMF Govern 1.3; EU AI Act Art. 6)
4. Is there a periodic AI risk assessment (annual minimum), documented, with named owners for each residual risk? (NIST AI RMF Map 1)
5. Are AI decisions logged to an immutable or tamper-evident log? (RBI FREE-AI Sutra 7; CERT-In Direction (iv))

Domain 2: Data governance (5 questions)

1. Is the training data lineage documented for every production AI system? (ISO 42001 clause 7.4)
2. For personal data used in training, is the DPDP Act consent basis documented? (DPDP Act 2023 s.6; SDF s.10 for models deployed by an SDF)
3. Is bias assessment done on the training set before deployment, with methodology and results documented? (NIST AI RMF Manage 2.3; EU AI Act Art. 10)
4. Is data drift monitored post-deployment with alert thresholds? (NIST AI RMF Measure 2.5)
5. Are third-party data sources contractually indemnified for licence and consent? (ISO 42001 clause 8.4)

Domain 3: Model risk (5 questions)

1. Is model performance evaluated against a held-out test set that reflects production distribution? (NIST AI RMF Measure 2.3)
2. Are model performance metrics (accuracy, precision, recall, F1, calibration) reported to the audit committee at least annually? (ISO 42001 clause 9.1)
3. Is there a model card for each production system documenting training data, evaluation results, and intended use? (NIST AI RMF Govern 4.1)
4. Are red-team results documented for models that touch financial reporting, credit decisions, or customer-facing legal advice? (RBI FREE-AI Sutra 4; EU AI Act Art. 15)
5. Is there a documented model retirement policy, with retirement triggers? (ISO 42001 clause 8.7)

Domain 4: Human authority (5 questions) — this is where most Indian companies fail

1. For each AI system, is there a documented human-in-the-loop or human-on-the-loop pattern with explicit authority to override? (NIST AI RMF Manage 4.1)
2. Is the override rate monitored? (NIST AI RMF Measure 2.11)
3. Does the audit committee receive a report on high-consequence AI decisions overridden by humans? (ISO 42001 clause 5.1)
4. Is there a documented kill-switch procedure with named owners and escalation path? (HRA-specific: this is the control we run in production, section 5 of our whitepaper)
5. Is the kill switch tested at least annually? (HRA-specific)

Domain 5: Explainability + provenance (5 questions)

1. For every AI-generated output that materially influences a business decision, can you trace it back to the specific data, rules, and model version that produced it? (ISO 42001 clause 8.6; NIST AI RMF Manage 2.3)
2. Are provenance records preserved for the applicable regulatory retention period? (CERT-In Direction (iv): 180-day rolling ICT logs; DPDP-specific retention where applicable)
3. For generative AI, is there a citation guard — does every generated line carry a reference to source material or rules? (HRA reference implementation; RBI FREE-AI Sutra 6)
4. Is there an anti-hallucination gate at ingest and at output? (HRA reference implementation)
5. Are explanations offered to affected individuals when the AI makes an adverse decision? (DPDP Act 2023 s.11(1)(b) right to correction; consumer regulations)

Domain 6: Security + resilience (5 questions)

1. Is the AI system's access management aligned with the ITGC framework the company otherwise uses? (RBI IT Governance MD 2023 Ch. VI)
2. Are model artifacts (weights, prompts, tools) stored with the same protection level as source code? (ISO 42001 clause 8.5)
3. Is prompt injection tested for LLM-based systems? (EU AI Act Art. 15; OWASP LLM Top 10)
4. Is model / training pipeline supply chain integrity verified (checksums, SBOM)? (NIST AI RMF Manage 5)
5. Is there a cyber incident response playbook that covers AI-specific incidents (model poisoning, data leakage via prompts, jailbreak)? (CERT-In Direction (ii): 6-hour reporting)

Domain 7: Vendor + third-party (5 questions)

1. For each AI vendor, is there a due-diligence file covering their governance, security, and privacy posture? (ISO 42001 clause 8.4; RBI IT Governance MD para on third-party risk)
2. Are contracts with AI vendors data-processing-agreement DPDP-compliant? (DPDP Act 2023 s.4 and 5)
3. For cloud-hosted LLM APIs, is data residency documented and consistent with the client's DPDP obligations? (DPDP Rules 2025)
4. Are SLA + incident notification terms in AI vendor contracts consistent with CERT-In's 6-hour requirement? (CERT-In Direction (ii))
5. Is there an exit plan for each critical AI vendor (portability, off-boarding, data return / destruction)? (RBI IT Governance MD para 34)

Domain 8: Regulatory + operational reporting (5 questions)

1. Is the regulator (RBI / SEBI / IRDAI / MeitY) reporting cycle for the entity's AI use identified and tracked? (entity-specific)
2. Are AI-related material events reported in the annual report, per SEBI LODR 30 disclosure? (SEBI LODR 30)
3. Is there a documented policy for handling regulator queries on AI systems? (governance-general)
4. Is the entity's own audit committee AI-literate — does at least one member hold a recognised AI governance credential or has attended external AI-governance training? (ISO 42001 clause 7.2; industry practice)
5. Is there a periodic self-assessment against this or an equivalent checklist? (ISO 42001 clause 9.3)

Scoring

1. 0-15 questions with clear evidence: critical gaps. Book an audit.
2. 16-30 questions: meaningful gaps in specific domains. Targeted engagement.
3. 31-40 questions: mature program. Independent audit still valuable for insurance, regulator readiness, and continuous improvement.