How to audit AI: a practitioner's method, from scope to report