Workshop

Scope an AI audit: build your scoping memo and RCM

Najwan Hudaihed

The AI Auditor

AI audits go wrong at scoping. Leave with working papers you can defend.

You have been asked to audit an AI system. Nobody can tell you exactly where it starts and ends, how risky it is, or who owns it, and the methodology you use for everything else does not quite fit. Start testing from there and you end up testing the wrong things, or everything at once.

This workshop fixes the problem at the source. In three hours, you will take a realistic AI use case from first conversation to defensible scope: deciding what is in and out, scoring the risk with a weighted matrix, confirming who is accountable, and choosing the criteria you will test against.

You will not just watch. You will build two working papers live, a scoping memo and a draft risk and control matrix (RCM), using templates you can reuse on your next engagement.

Built for IT auditors, internal auditors and risk professionals who are being asked to cover AI and want a method they can explain to an audit committee. Includes a certificate stating the hours for self-reported CPE.

What you’ll learn

Go from being told to "look at the AI" to leading an AI audit with a defensible scope, risk rating and RCM.

  • Map the AI system's components, data flows and third parties

  • Decide what is in and out of scope, and record why

  • Place the system in your organisation's AI universe

  • Apply a weighted risk-scoring matrix to a realistic use case

  • Confirm the EU AI Act risk tier and whether you are the deployer or the provider

  • Turn the score into a priority you can defend to an audit committee

  • Translate scored risks into RCM rows with controls and test approaches

  • Work through two rows together, then draft five of your own

  • Leave with a template to finish and reuse on your next engagement

Workshop agenda

  • Opening

    The outcomes and how the session works

  • Case walkthrough

    Services group whose recruitment AI screens more than 200,000 applicants a year

  • Block 1

    Scoping exercise. Map the system, draw the boundary and place it in the AI universe.

  • Block 2

    Build the risk-scoring matrix together. Score the system, then confirm its EU AI Act tier and whether you are the deployer or the provider.

  • Block 3

    Start the RCM. Work through two rows together, then draft five risks in your group.

  • Close

    What you finish afterwards, and next steps

Learn directly from Najwan

Najwan Hudaihed

Najwan Hudaihed

Contact

AI audit, taught by an auditor, for auditors.

KPMG
Vodafone
Cadent
Aviva
See all products from Najwan

Who this workshop is for

  • IT auditors, internal auditors and risk professionals who have been asked to "look at AI"

  • Audit managers who need a defensible way to scope AI work in the audit plan

  • Second-line risk and compliance professionals responsible for AI oversight

What's included

Najwan Hudaihed

Live sessions

Learn directly from Najwan Hudaihed in a real-time, interactive format.

Lifetime access

Go back to course content and recordings whenever you need to.

Community of peers

Stay accountable and share insights with like-minded professionals.

Certificate of completion

Share your new skills with your employer or on LinkedIn.

Maven Guarantee

Your purchase is backed by the Maven Guarantee.

Frequently asked questions

Maven for Teams

Reimbursement

Get your company to pay

Everything L&D needs: email template, receipts, and certificate of completion.

Get reimbursed

Team discount

Learn with your teammates

Save 20%+ when 2 or more teammates enroll in the same cohort.

Save 20%+ with a team

Private cohort

Run a cohort for your org

A dedicated cohort with a custom schedule and curriculum, tailored to your team.

Book a private cohort

$299

USD

Dec 2
·

10am–1pm EST

Enroll