AI Audit & Assurance Professional (AAAP)

When audit methodology has not caught up with AI, organisations get assurance reports that confirm process compliance while substantive governance failures go undetected. Bias testing may be documented as a policy requirement but never actually performed on production models. Drift detection may exist in a risk register but have no monitoring infrastructure behind it. Incident response procedures may reference AI systems but contain no AI-specific triage criteria. The audit function checks the documentation and finds it complete. The governance gap remains invisible.

This is not a failure of intent. It is a failure of methodology. Auditors trained on process-based frameworks evaluate what they know how to evaluate: policies, procedures, sign-offs, and documentation. AI-specific risks require auditors who can evaluate whether the controls themselves are effective against the failure modes they are supposed to prevent. That means understanding what bias testing actually involves, what drift detection actually measures, and what adversarial resilience actually requires.

It also means navigating a regulatory landscape that is new to everyone. AI-specific obligations under the EU AI Act and sector-specific regulations in financial services, healthcare, and critical infrastructure require auditors to verify compliance against requirements that did not exist two years ago. The mapping from regulatory obligation to audit evidence is being built in real time. The AAAP certification exists because RESAIA believes assurance professionals need audit methodology that matches the complexity of the systems they are assessing and the regulatory environment those systems now operate in.