aims-audit
$
npx mdskill add alirezarezvani/claude-skills/aims-auditConducts ISO/IEC 42001 AIMS internal-audit 6-question interrogation
- Validates AI system scope and policy compliance before certification
- Checks AIMS scope, AI policy, risk register, and audit history
- Evaluates alignment with ISO 42001 clauses and audit requirements
- Provides actionable findings for audit readiness and compliance
SKILL.md
.github/skills/aims-auditView on GitHub ↗
--- name: "aims-audit" description: "/cs:aims-audit <scope> — ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before certification stage 1, before annual internal audit cycles, or when onboarding a new AI system into an existing AIMS." --- # /cs:aims-audit — AIMS ISO 42001 Forcing Questions **Command:** `/cs:aims-audit <scope>` The ISO 42001 AIMS specialist pressure-tests any AI Management System work. Six questions before any certification commitment, internal audit cycle, or new-system onboarding. ## When to Run - Before stage 1 ISO 42001 certification audit - Before annual internal audit cycle (Clause 9.2) - When onboarding a new AI system into existing AIMS scope - When AI risk register hasn't been refreshed in > 6 months - After material model change (re-evaluate risks per Clause 6.1.2) - When audit findings hint at AIMS / ISMS / QMS duplication ## The Six AIMS Questions ### 1. Does the AIMS scope statement name every AI system? **Scope omission = certification finding.** - Including: embedded models, third-party AI services, "experimental" production systems - Run `aims_gap_analyzer.py` to verify Clause 4.3 evidence - "AI features added by SaaS vendors we use" = in scope if they affect the company's services ### 2. Does the AI policy commit to lawful use AND beneficial purpose AND human oversight AND continual improvement? **Missing any of the four = critical nonconformity at stage 1.** - AI policy is NOT info-sec policy — it has separate substantive content - Reference ISO 42001 Annex A.2.2 + Clause 5.2 - Marketing-copy "AI ethics" doesn't pass ### 3. What's the risk register coverage, and which Annex A controls treat each risk? **Risk identification without control mapping = Clause 6.1.3 fails.** - Run `ai_risk_register_builder.py` per ISO 23894 methodology - Every high/critical risk must link to ≥ 1 Annex A control - "Residual verdict: additional_treatment_required" must be closed before stage 1 ### 4. Has the AI risk assessment been re-run since the last material model change? **Concept drift is not a one-time event.** - Article 9 EU AI Act + ISO 42001 Clause 6.1.2 both require iterative risk assessment - Material change = retraining on new data, fine-tuning, architecture change, deployment context change - If "we did it 18 months ago and haven't touched it," the AIMS is broken ### 5. What's the Clause 9.2 internal audit plan, and is auditor independence respected? **Without 9.2 plan, the AIMS is incomplete.** - Run `aims_audit_scheduler.py` with scope + auditors + prior findings - Audit every clause + applicable Annex A control over rolling 3-year cycle - Same auditor cannot audit own work - Cross-check with cs-quality-regulatory if integrated with 13485 audit programme ### 6. Has the AIMS been integrated with existing ISMS / QMS, or built in parallel? **Parallel systems = 5x ongoing maintenance cost.** - 60% of Clauses 4-10 evidence reuses ISO 27001 / 13485 with AI scope appended - CAPA loop should be ONE loop with AI-tagged nonconformities, not separate - Reference `cross_framework_mapping_ai.md` for the reuse map - Cross-check with cs-ciso-advisor on ISO 27001 alignment ## Workflow ```bash # 1. AIMS gap analysis python ra-qm-team/skills/iso42001-specialist/scripts/aims_gap_analyzer.py evidence.json # 2. AI risk register python ra-qm-team/skills/iso42001-specialist/scripts/ai_risk_register_builder.py risks.json # 3. Internal audit plan python ra-qm-team/skills/iso42001-specialist/scripts/aims_audit_scheduler.py audit_scope.json # 4. Cross-framework reuse map (via compliance-os) python ../../skills/compliance-os/scripts/cross_framework_mapper.py program.json ``` ## Output Format ```markdown # AIMS Audit: <scope> **Date:** YYYY-MM-DD ## The Decision Being Made [gap-closure | risk-treatment | audit-scope | new-system-onboarding] ## Gap Analysis (Clauses 4-10) - Weighted coverage: X% - Critical gaps: N - Major gaps: M - Certification readiness: ready | stage_2_candidate | not_ready ## AI Risk Register - Total risks: N - By severity: critical=X, high=Y, medium=Z, low=W - Requires additional treatment: K - Top risk requiring action: <description> ## Clause 9.2 Audit Plan - 12-month coverage: clauses=X, controls=Y - Auditor independence: clean | issues - Prior-year follow-up: scheduled in Q1 ## Cross-Framework Reuse - ISO 27001 evidence reused: % of AIMS Clauses 4-10 - 13485 evidence reused: % (if applicable) - Net-new for AIMS: % (mostly Annex A) ## Verdict 🟢 STAGE-1-READY | 🟡 CLOSE-CRITICALS-FIRST | 🔴 NOT-READY ## Top 3 Actions [3 concrete next steps with owner + date] ``` ## Routing - `/cs:compliance-readiness` — for multi-framework view - `/cs:ai-act-readiness` — if EU AI Act also applies - `/cs:caio-review` — for executive AI strategy decisions - `/cs:ciso-review` — for ISO 27001 cross-framework alignment - `/cs:decide` — to log the verdict - `/cs:freeze 30` — on certification commitments ## Related - Agent: [`cs-aims-iso42001`](../../agents/cs-aims-iso42001.md) - Skill: [`iso42001-specialist`](../../../ra-qm-team/skills/iso42001-specialist/SKILL.md) - Adjacent: `../../skills/compliance-os/`, `../ai-act-readiness/`, `../compliance-readiness/` --- **Version:** 1.0.0
More from alirezarezvani/claude-skills
- a11y-auditAccessibility audit skill for scanning, fixing, and verifying WCAG 2.2 Level A and AA compliance across React, Next.js, Vue, Angular, Svelte, and plain HTML codebases. Use when auditing accessibility, fixing a11y violations, checking color contrast, generating compliance reports, or integrating accessibility checks into CI/CD pipelines.
- ab-test-setupWhen the user wants to plan, design, or implement an A/B test or experiment. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," "hypothesis," "conversion experiment," "statistical significance," or "test this." For tracking implementation, see analytics-tracking.
- ad-creativeWhen the user needs to generate, iterate, or scale ad creative for paid advertising. Use when they say 'write ad copy,' 'generate headlines,' 'create ad variations,' 'bulk creative,' 'iterate on ads,' 'ad copy validation,' 'RSA headlines,' 'Meta ad copy,' 'LinkedIn ad,' or 'creative testing.' This is pure creative production — distinct from paid-ads (campaign strategy). Use ad-creative when you need the copy, not the campaign plan.
- adversarial-reviewerAdversarial code review that breaks the self-review monoculture. Use when you want a genuinely critical review of recent changes, before merging a PR, or when you suspect Claude is being too agreeable about code quality. Forces perspective shifts through hostile reviewer personas that catch blind spots the author's mental model shares with the reviewer.
- aeoAnswer Engine Optimization (AEO) skill — optimize content to be cited by AI language models (ChatGPT, Perplexity, Claude, Gemini, Mistral) as authoritative sources. Distinct from SEO — AEO optimizes for citation in LLM-generated responses, not search rankings. Use when planning content for AI-first search audiences, auditing existing content for E-E-A-T signals, tracking which pages get cited by which LLMs, or building a citation-friendly content strategy. Triggers — 'AEO audit', 'optimize for ChatGPT', 'get cited by Perplexity', 'LLM citation strategy', 'answer engine optimization', 'content for AI search', 'E-E-A-T audit'. Output is a markdown audit report (default) or JSON for pipeline integration. Stdlib-only Python tools.
- agent-designerUse when the user asks to design a multi-agent system, pick an orchestration pattern (supervisor/swarm/pipeline), generate tool schemas for agents, or evaluate agent execution logs for cost, latency, and failure bottlenecks. Examples: 'design an agent architecture for research automation', 'generate Anthropic tool schemas from these tool descriptions', 'analyze these agent run logs for bottlenecks'. NOT for Claude Code workflow files (use workflow-builder) or single-agent prompt design (use agent-workflow-designer).
- agent-protocolInter-agent communication protocol for C-suite agent teams. Defines invocation syntax, loop prevention, isolation rules, and response formats. Use when C-suite agents need to query each other, coordinate cross-functional analysis, or run board meetings with multiple agent roles.
- agent-workflow-designerDesign production-grade multi-agent workflows with clear pattern choice (sequential, parallel, hierarchical), handoff contracts, failure handling, and cost/context controls. Use when architecting a multi-step agent pipeline, choosing between single-agent vs multi-agent approaches, or refactoring an LLM workflow that suffers from context bloat or unreliable handoffs.
- agenthubMulti-agent collaboration plugin that spawns N parallel subagents competing on the same task via git worktree isolation. Agents work independently, results are evaluated by metric or LLM judge, and the best branch is merged. Use when: user wants multiple approaches tried in parallel — code optimization, content variation, research exploration, or any task that benefits from parallel competition. Requires: a git repo.
- agile-product-ownerAgile product ownership for backlog management and sprint execution. Covers user story writing, acceptance criteria, sprint planning, and velocity tracking. Use when writing user stories, creating acceptance criteria, planning sprints, estimating story points, breaking down epics, or prioritizing the backlog.