Start with a risk, audit topic, framework or practical question. GAIH connects audit risks, control objectives, criteria, evidence, testing, red flags, related disciplines and official source references in one guided information portal.
The portal is organised around auditor questions rather than the type of content stored in the system.
This pilot is an information and planning reference. Suggested audit questions and control objectives are derived from the scope, testing and framework content in the source taxonomy and should be tailored to the organisation, approved methodology, jurisdiction and engagement criteria.
Use this section to understand what can be audited, how to prioritise it, what assurance already exists, and which audit lens best fits the question.
Different audit disciplines answer different assurance questions. Use this map to avoid selecting a familiar audit label when another lens is more appropriate.
Each topic includes scope, control objectives, audit questions, evidence, testing methods, red flags and related frameworks.
Use this page for practical methodology, evidence quality, testing methods, finding development and contextual learning.
Evidence should be sufficient, reliable, relevant, traceable, current, complete enough for the purpose and corroborated where important.
| Area | Weak evidence | Stronger evidence |
|---|
What the evidence shows or what was observed.
What should have happened based on policy, standard, regulation, contract or approved requirement.
The underlying reason the condition occurred or persisted.
The actual or potential impact on objectives, stakeholders, compliance, operations or resources.
A response that addresses the root cause and risk rather than only the visible symptom.
Independent confirmation that implementation evidence addresses the original issue and the control operates as intended.
Each theme highlights warning signals and links directly to audit disciplines that may provide relevant assurance.
These are starting points for discussion, not prescribed annual audit plans. Risk assessment and local obligations should drive final selection.
Clarify governance, protect people and critical services, preserve logs and records, identify affected systems or processes, and establish facts without compromising investigations.
Confirm control failures, assess exposure and dependencies, validate management actions, reconcile key records and determine whether an urgent audit or advisory review is needed.
Address root causes, strengthen control design, test implementation, monitor recurrence and provide independent assurance over sustained remediation.
Consolidated reference for the AI governance landscape auditors are being asked to verify: the EU AI Act, NIST AI RMF, ISO/IEC 42001, regulated model-risk expectations, generative-AI guidance and AI-enabled fraud.
Each item maps a regulatory, standard or risk theme to the GAIH audit disciplines most likely to carry the assurance work. References are indicative — verify the current edition, jurisdiction scope and applicability before adopting any as engagement criteria.
Board-level AI risk appetite, defined roles for AI owners/validators/auditors, policies covering development, procurement and use.
Complete inventory of AI systems, classification of use cases, documented impact assessments refreshed on material change.
Development documentation, independent validation, effective challenge records, limitations disclosure and change control.
Post-deployment performance monitoring, logging, incident reporting, transparency to affected persons and correction channels.
Frameworks can inform objectives, control expectations, audit questions and evidence requirements. They do not automatically establish legal compliance, certification or a formal assurance conclusion.
Control-level cross-walks between the frameworks most frequently used as audit criteria. Mappings are indicative cross-references, not official equivalences — verify each control identifier against the latest version before reliance.
Each row maps one control objective across frameworks. Framework references are shorthand (e.g.
A.8.8
,
PR.DS-02
,
CIS 7
,
CC7.2
,
Req 10.2
). Where a framework has no direct equivalent, the row says so rather than inventing a mapping.
| Control objective | ISO 27001:2022 | NIST CSF 2.0 | CIS v8 | SOC 2 | PCI DSS |
|---|
Cross-walk content is compiled as an audit-reference aid. Always confirm current editions, jurisdiction scope and formal applicability before adopting any reference as engagement criteria.
A focused feed of source-linked developments relevant to audit, assurance, cyber, AI, compliance, financial crime, sustainability, resilience and standards. The feed is refreshed by GitHub Actions and stored as a static JSON file for GitHub Pages.
News items are signals for professional review—not automatic audit criteria. Open the original source, confirm applicability and effective dates, then decide whether the development changes the audit universe, risk assessment, engagement criteria or evidence expectations.
The updater prioritises official feeds and skips a source if it is temporarily unavailable. Failed sources do not prevent the remaining feed from publishing.
For a public GitHub repository, scheduled workflows run on the default branch. GitHub may disable scheduled workflows after prolonged repository inactivity, so check the Actions tab if the feed stops refreshing.
The source taxonomy prioritises official standards, regulators, professional bodies and recognised framework publishers. Always verify the latest applicable version before formal reliance.
This Global Audit Intelligence Hub is a general reference and learning artefact intended to support audit planning, assurance mapping and governance discussion. It is not an audit opinion, legal advice, certification or compliance determination. Users should verify jurisdiction-specific rules, sector requirements and the latest version of each named standard before formal reliance.