AI Vendor Due Diligence and Audit Evidence Training Course – Manama, 28 Mar – 1 Apr 2027

AI Vendor Due Diligence and Audit Evidence is a 1-week training course for compliance officers and AI assurance staff who must vet bought-in AI products and prove to auditors that controls work, ending with an AI assurance evidence file. Most AI now enters organisations through suppliers so assurance depends on questions asked before signature. Jupiter Prime Training treats AI Vendor Due Diligence and Audit Evidence as a working compliance routine.

Why AI Vendor Due Diligence and Audit Evidence Matters Now

Three pressures shape the subject. Software suppliers switch on AI features inside existing licences; internal auditors and external reviewers ask for evidence rather than policy statements; and boards want one view of customer-facing AI. Compliance functions that keep an inventory, test what suppliers claim and file evidence as they go answer audits calmly. The course draws on ISO/IEC 42001, the AI management system standard, and the NIST AI Risk Management Framework (NIST AI RMF) for control objectives and testing expectations.

Who Gains Most from AI Vendor Due Diligence and Audit Evidence

• Officers who maintain the register of AI systems and their owners
• Assurance staff who test models for bias, privacy and accuracy claims
• Third-party risk specialists who run supplier questionnaires and contract reviews
• Internal audit liaisons who prepare evidence requests and walkthroughs
• Privacy specialists who assess personal data flows into AI services

A second-line compliance unit gains most when its AI lead, a third-party risk specialist and a privacy specialist attend together.

AI Vendor Due Diligence and Audit Evidence Capabilities

Participants replace trust in supplier brochures with tested claims and filed proof.

• Build an AI system register with owner, supplier and risk tier — compliance heads
• Design supplier questionnaires and contract clauses for training data and model changes — procurement leads
• Test bias, privacy and accuracy claims with sample-based checks — assurance managers
• Map each policy control to the evidence that proves it operates — internal auditors
• Specify monitoring triggers for model drift and supplier changes — system owners
• Communicate assurance status and open findings in a board dashboard — audit committees

Key AI Vendor Due Diligence and Audit Evidence Terms

• AI system register — a maintained list of AI systems in use, with owner, purpose, supplier and risk tier.
• Supplier due diligence — structured checks on a vendor's AI practices before contract and at renewal.
• Model card — a supplier document describing a model's intended use, training data, limits and test results.
• Control-to-evidence map — a table linking each control to the record that shows it operated.
• Disparate impact test — a comparison of outcome rates across groups to detect unfair treatment by a model.
• Evidence index — a catalogue of stored proofs, with dates, owners and locations, ready for audit requests.

AI Vendor Due Diligence and Audit Evidence Day by Day

Day 1: The AI Compliance Landscape and Inventory

• Embedded AI in Supplier Software — Hidden Exposure in Existing Licences
• AI System Register Design — Owners, Purposes and Risk Tiers
• Discovery Methods for Unregistered Tools — Procurement and Network Signals
• Control Objectives From ISO/IEC 42001 — Scope of the Compliance Role
• Risk Tiering Under NIST AI RMF — Depth of Assurance per System

Day 2: Supplier Due Diligence

• AI Supplier Questionnaire Design — Training Data, Updates and Subcontractors
• Model Card and Test Report Review — Spotting Gaps in Supplier Claims
• Contract Clauses for AI Services — Change Notice, Audit Rights and Exit
• Data Processing Terms for AI Features — Personal Data Boundaries
• Supplier Risk Rating Matrix — Onboarding, Conditions or Rejection

Day 3: Testing Bias, Privacy and Accuracy

• Sample-Based Accuracy Checks — Verifying Supplier Performance Claims
• Disparate Impact Testing — Fair Treatment Across Customer Groups
• Privacy Impact Screening for AI Services — Data Minimisation Choices
• Explainability Checks for Adverse Decisions — Customer Complaint Readiness
• Test Record Templates — Repeatable Results for Later Audits

Day 4: Evidence, Monitoring and Board Reporting

• Control-to-Evidence Mapping — Proof That Each Control Operates
• Evidence Index and Retention Rules — Fast Response to Audit Requests
• Drift and Supplier Change Monitoring — Triggers for Retesting
• Findings Log and Remediation Tracking — Ownership of Open Issues
• Board Assurance Dashboard — Status, Exceptions and Trends

Day 5: Practising the AI Assurance Evidence File

• Supplier Review Applied to a Bank's Credit Scoring Vendor — Conditions Set
• Bias and Privacy Tests Applied to a Recruitment Screening Tool — Findings
• Mock Audit Walkthrough — Answering Evidence Requests Under Time Pressure
• Board Summary Drafting — Residual Exposure and Remediation Dates
• AI Assurance Evidence File Assembly — Register, Tests, Evidence and Reports

Applying AI Vendor Due Diligence and Audit Evidence After the Course

• Send the AI supplier questionnaire to the three vendors whose products touch customer decisions and rate their answers.
• Build a control-to-evidence map for one high-tier AI system and fill its evidence index before the next audit cycle.

AI Vendor Due Diligence and Audit Evidence Questions (FAQ)

What is AI vendor due diligence and audit evidence, and why does it matter now?

It is the practice of vetting AI suppliers and keeping proof that AI controls work. It matters now because most AI arrives inside supplier software, and auditors expect records rather than policy statements.

Which roles gain most from AI vendor due diligence and audit evidence?

Compliance officers and AI assurance staff gain most. Third-party risk, privacy and internal audit liaison specialists also benefit, because they question suppliers, assess data flows and answer evidence requests.

How does AI vendor due diligence and audit evidence differ from an AI governance course?

It focuses on testing and proof rather than setting direction. A governance course designs policies, committees and accountability, while this one vets suppliers, tests their claims and builds the records auditors examine.

What do you bring back from AI vendor due diligence and audit evidence training?

You bring back an evidence file for your own organisation. It holds the AI system register, supplier ratings, test records, a control-to-evidence map, the evidence index and a board summary.

AI Vendor Due Diligence and Audit Evidence: The Way Forward

The AI assurance evidence file first informs which suppliers keep their contracts on current terms and which need added conditions. Compliance heads use it to brief the audit committee. After the first audit cycle, revisit the supplier questionnaire: the questions auditors asked most often reveal where earlier due diligence was thin.