Fairness in artificial intelligence has moved from a technical topic to a governance responsibility. Regulators and investors now expect boards to identify who owns algorithmic risk, to understand how high‑impact models make decisions, and to show that monitoring is continuous.
Internal audit is not expected to rebuild models. Its job is to confirm that management has defined fairness, measures it, and can stop a model when it drifts. These three controls—definition, measurement, “stoppability”—map directly to the NIST AI RMF Govern-Map-Measure-Manage functions and are auditable without data science skills.
Why Fairness Is Now a Board‑Level Expectation
- The EU AI Act lists hiring and credit‑scoring systems as high‑risk under Annex III, requiring risk management, data governance, and human oversight under Article 14, as well as accuracy, robustness, and cybersecurity under Article 15. Deployers must also complete a fundamental rights impact assessment under Article 27. In the United States, the FTC, DOJ, CFPB, and EEOC confirmed in their April 2023 joint statement that existing civil rights and consumer protection laws apply fully to AI, with no AI exemption.
- NIST AI RMF and ISO/IEC 42001 are becoming the control baselines internal auditors can test against because they provide testable practices for governance, risk assessment, measurement, and management rather than principles alone.
- Investors want evidence of board-level oversight, not a general statement that IT reviews the models.
- Liability is direct. The EU AI Act allows fines up to €35 million ($40.5 million) or 7 percent of worldwide revenue, and U.S. regulators are pursuing bans, disgorgement, and multi-year monitoring for unfair or deceptive AI.
Boards are being asked to demonstrate that they understand the risks behind the algorithms they approve. Internal audit’s role is to verify whether that oversight is happening in practice.
How Bias Enters Without Intent
Bias rarely comes from bad actors. More often it comes from the way models learn.
- Historical reflection. Models copy past human decisions. Amazon’s hiring model learned to penalize the word “women’s” because it trained on male‑dominated resumes.
- Representative scarcity. Small sample sizes for minority groups create higher error rates for them even when overall accuracy looks strong.
- Proxy reconstruction. Removing gender or race does not help if the model rebuilds them from zip code, school, or device type.
- Feedback loops. If one group is scrutinized more, the model learns to keep doing it.
These patterns are predictable, which makes them auditable. They also explain why fairness failures are rarely malicious. They are structural, which means they can be tested, evidenced, and monitored through controls such as bias detection, proxy analysis, and drift monitoring.
Where Organizations Underestimate Their Risk
- Teams report accuracy but rarely show accuracy by demographic group.
- Validation is treated as a one‑time event. In production, fairness can degrade even when accuracy stays flat.
- Vendors are trusted based on a SOC 2 and an ethics statement. No one performs an independent disparate‑impact test.
- Business units deploy low‑code models outside the central inventory.
The biggest risk is assuming someone else has already checked fairness.
What Internal Audit Can Realistically Test
Governance
- A documented fairness definition for each use case
- A model inventory with risk tiering and a named business owner
- Board or committee minutes showing a defined review cadence
Data
This evidence trail focuses on whether data was collected lawfully, used appropriately, and processed in a way that supports fair model behaviour.
- Data lineage and consent documentation, including whether data was collected under opt‑in or opt‑out mechanisms
- Purpose‑limitation records showing that data is used only for the purpose for which it was originally collected
- Pre‑processing logs showing how data was balanced or cleaned
- Proxy analysis identifying correlations with protected attributes
Outputs
- Validation results broken down by demographic group
- A production monitoring dashboard with drift alerts
- A kill‑switch procedure with a walkthrough date and a named decision‑maker
This is all within the existing skill set of internal audit.
The Four KPIs that Belong in Internal Audit Workpapers
These four fairness KPIs are the minimum evidence set regulators expect. They measure whether the model treats demographic groups consistently over time, and they provide clear escalation thresholds.
The EU AI Act does not set numeric fairness thresholds. For high‑risk systems it requires a risk management system, data governance to examine biases in training, validation, and testing data, accuracy and robustness testing, human oversight, and continuous post‑market monitoring under Articles 9, 10, 14, 15, and 72.
Deployers must also complete a fundamental rights impact assessment where applicable and maintain logs to support monitoring. Because the EU AI Act is silent on numeric thresholds, internal audit uses borrowed thresholds as practical screens: disparate impact ratio from US EEOC guidance, equal opportunity difference from fairness research, and statistical parity difference and bias drift from NIST‑aligned practice. These form a defensible baseline only when each threshold is documented as proportionate to the specific risk, context, and affected rights, with justification, limitations, and sign‑off recorded in the model risk policy by legal, privacy, and the business owner.
How These KPIs Work in Practice
Disparate Impact Ratio
Example: A hiring model selects 50% of the majority group but only 30% of a protected group. DIR = 0.30 ÷ 0.50 = 0.60. Because this is below 0.80, it signals potential adverse impact.
Statistical Parity Difference
Example: A credit model approves 70% of Group A and 58% of Group B. SPD = 0.70 – 0.58 = 0.12. A difference above ±0.10 indicates meaningful outcome imbalance.
Equal Opportunity Difference
Example: A medical triage model has a true‑positive rate of 92% for one group and 84% for another. EOD = 8%. A gap above 5% indicates unequal access to correct positive decisions.
Bias Drift Index
Example: A fraud model’s fairness score drops from 0.95 at baseline to 0.83 in the last 30 days. BDI = 12.6% deviation. Anything above 10% signals fairness degradation over time.
How to know which KPI applies
Disparate Impact Ratio → Selection rates (who gets selected)
Use DIR when the scenario is about who gets selected, shortlisted, or approved. If the question is whether groups are being selected at similar rates, this is a DIR case.
Statistical Parity Difference → Outcome probabilities
Use SPD when the scenario is about the probability of receiving a positive outcome. If the question is whether groups receive positive outcomes at similar probabilities, this is an SPD case.
Equal Opportunity Difference → True positive rates (who gets correctly selected)
Use EOD when the scenario is about correct positive decisions. If the question is whether the model is equally accurate for groups when they should receive a positive outcome, this is an EOD case.
Bias Drift Index → Fairness over time
Use BDI when the scenario is about fairness changing month‑to‑month. If the question is whether fairness has degraded compared to the baseline, this is a BDI case
A Four-Step Field Program
- Risk assess. Pull the model registry and scope only high‑consequence decisions such as credit approvals, hiring and promotion decisions, medical triage or diagnosis, law‑enforcement or public‑safety models, insurance underwriting, utility or energy‑service decisions, and education or benefits‑eligibility determinations. Validate completeness by scanning procurement, cloud AI services, and low-code platforms for shadow models.
- Metric audit. Confirm the fairness definition selected for the use case and document the fairness–accuracy trade‑off the business accepted, including any impact on false positives, false negatives, or operational efficiency. Inspect the signed trade-off memo.
- Vendor review. Request transparency disclosures such as model cards, data sheets, and evaluation reports, and independently run a disparate impact check on sample outputs to validate the vendor’s claims. If data cannot be shared, require a third-party bias audit attestation and contractual right-to-audit clause.
- Live monitoring. Test a fairness alert end‑to‑end and observe a kill‑switch exercise to confirm the model can be paused, rolled back, or overridden when fairness thresholds are breached. Record time-to-pause and who authorized.
Five questions CAEs should take to the audit committee
- Which committee owns algorithmic risk and what metrics do they see each quarter? Are DIR, SPD, EOD, BDI in the pack?
- What is our documented fairness tolerance for hiring and credit models?
- How do we detect bias drift in production and who gets alerted?
- Have we independently tested our top vendor models for disparate impact? Do contracts give us that right?
- When did we last execute a model kill‑switch successfully? What was the elapsed time?
These questions shift the conversation from technical accuracy to governance accountability.
The Evidence Function
Internal audit does not need to become a data science function. It needs to become the evidence function. Our role is to confirm that fairness is defined, measured, monitored, and stoppable through controls such as fairness definition, metric testing, live monitoring, and kill switch readiness.
When these controls exist and are evidenced, internal audit can give the board confidence that algorithmic decisions are governed, explainable, and accountable. Document the evidence trail in workpapers, not conclusions alone, so the board can rely on it under the IIA Global Internal Audit Standards effective January 2025, including Principle 11 on documentation and Principle 14 on communicating results and conclusions. 
Nirpendra Ajmera (Nick) is a Chief Audit Executive focused on modernising audit, controls, and AI‑related risk oversight. He can be reached at nickajm@gmail.com