Responsible AI Auditor
For auditors and compliance consultants: audit fundamentals, ISO/IEC 42001 and 27701 audits, AI system evidence, regulatory conformity and supply chain.
- Prerequisite
- RAIP or DPAI
- Questions
- 50
- Duration
- 150 min
- Passing score
- 72%
- Investment
- $100
- Exam language
- English, Portuguese, Spanish
- Validity
- Does not expire
The pass mark is fixed: you pass with 72% correct answers, with no curve and no comparison with other candidates.
- Changed your mind? Ask for a full refund within 14 days of purchase, if the voucher has not been used.
- Your voucher never expires. Take the certification exam when you are ready.
- If you do not pass, your next attempt is half price for 90 days.
- The credential never expires: no renewal, no paid continuing education and no annual fee. You pay for the exam once.
Who this is for
You are an internal auditor
Your audit plan now includes AI and personal data, and you need criteria and evidence standards for systems the usual IT audit programs do not cover.
You are an external auditor or assurance professional
You work on ISO/IEC 27701 or information security engagements and want to extend your practice to ISO/IEC 42001 and AI systems.
You do compliance consulting
You run gap assessments and readiness reviews for clients and want an auditor's discipline on evidence, sampling and reporting.
What you take with you
A permanent verification code
Anyone confirms your credential at dpcert.org/verify, without having to ask you for anything.
Approval that does not expire
A credential you earned does not lapse, asks for no annual renewal and charges no subscription.
LinkedIn and a public profile
Add it to your licenses and certifications section, or share the link to your profile.
A certificate with your score by domain
In PDF, showing how you performed in each area assessed.
What you need to know
Six domains, drawn at random from a bank written for this certification exam. Read each one and see where you stand.
Audit fundamentals for AI and data
8 questions · 16% of the exam
Applying audit standards to AI and data work: preserving independence, planning the engagement, deciding what counts as sufficient evidence and choosing a sampling approach you can defend.
Auditing against ISO/IEC 42001 and 27701
12 questions · 24% of the exam
Testing ISO/IEC 42001 and ISO/IEC 27701 controls, grading nonconformities as major or minor on objective evidence, and writing findings that management can act on.
Auditing AI systems
10 questions · 20% of the exam
Examining model documentation, data lineage, bias and performance evidence and monitoring logs, and judging whether they show the system works as claimed or only describe intentions.
Regulatory conformity
7 questions · 14% of the exam
Checking EU AI Act conformity assessment evidence and running GDPR and LGPD compliance audits, separating what the law requires from what the organization chose to do.
Third-party and supply chain assurance
5 questions · 10% of the exam
Obtaining assurance over AI vendors, model providers and processors: which reports to rely on, what to test directly and how responsibility is split along the chain.
Audit casework
8 questions · 16% of the exam
Scenario questions that follow an audit from planning to report: picking the right evidence, classifying findings and deciding what to escalate.
DPAI + AUDAI
Assurance Track
DPAI and AUDAI together: the data protection foundation and AI and data audit. DPAI also meets the AUDAI prerequisite. Both vouchers at once, and neither expires.
You save $30 compared with buying both separately.
14-day refund if neither voucher has been used.
Test your knowledge with the Open Assessment
The Open Assessment has twenty questions at the level of the certification exam, with the result on the spot and a score for each domain. It is the honest way to decide whether you are ready.
Test your knowledgeSee what the questions are like
Sample questions in the exam format: a work situation and a decision. The certification exam uses different questions.
An auditor must conclude whether the content filter of a customer-facing chatbot blocks requests for self-harm instructions, as the organization's AI policy requires. Which source of evidence is the most reliable on its own?
- AThe QA team's latest test report, signed by the head of QA, showing that all of its test prompts were blocked
- BA walkthrough in which the responsible engineer explains the filter and shows the policy settings screen
- CTest prompts that the auditor submits to the production system in a controlled session, observing the replies
- DA written representation from the product owner confirming that the filter has been active since launch
Show answer and explanation
Answer: C
Evidence the auditor obtains directly, by reperforming the control on the system actually in use, is generally more reliable than evidence produced or asserted by the auditee. The QA report is useful, but it was produced by the auditee, and its prompts and test environment would first have to be evaluated; it may not reflect production. A walkthrough shows how the filter is designed and configured, not that it blocks real requests. A written representation is an assertion by management and cannot replace evidence. The auditor's own test shows operation at one point in time, so for a whole period it is combined with other evidence, such as monitoring records.
A company has just received ISO/IEC 42001 certification. To save costs, its compliance manager proposes to the certification body that the next audit take place only at recertification. Under ISO/IEC 17021-1, what applies?
- AThis is acceptable if the company submits yearly self-assessments that the certification body reviews remotely
- BSurveillance audits are required at least once a calendar year, the first within 12 months of the certification decision
- CSurveillance is needed only when the company reports significant changes to its AI management system
- DOne surveillance audit at mid-cycle is enough if the stage 2 audit raised no nonconformities at all
Show answer and explanation
Answer: B
ISO/IEC 17021-1 sets a three-year certification cycle in which surveillance audits are conducted at least once a calendar year, except in recertification years, and the first surveillance audit after initial certification must take place no later than 12 months from the certification decision. Self-assessments can inform the certification body but do not replace surveillance audits. Significant changes may trigger an additional audit, but they do not replace the minimum frequency. A clean stage 2 audit does not reduce that frequency either.
Frameworks and concepts covered
The glossary terms linked to this certification, each with its definition.
- High-risk AI system
- Conformity assessment
- CE marking (AI)
- Fundamental rights impact assessment (FRIA)
- ISO/IEC 42001
- AI management system (AIMS)
- AI impact assessment
- Model card
- Datasheet for datasets
- Algorithmic bias
- Fairness metrics
- Model drift
- Data provenance
- Three lines model
- Data protection impact assessment (DPIA)
- Record of processing activities (ROPA)
Study from the source of the certification exam
Practise the topic with a free tool
No sign-up tools on subjects of this certification, to apply at work what the certification exam assesses.
- AI audit checklistFrom scope to work programme: tests per area, evidence by owner, priority and estimated effort.Open
- AI vendor due diligence questionnaireFifteen questions on data, security, transparency and the EU AI Act, with a recommendation and contract clauses.Open
- ISO/IEC 42001 gap analysis32 checks across clauses 4 to 10 and the Annex A themes, with readiness, gaps and a roadmap.Open
No course is required
The certification exam is the same for everyone, and how you prepare is your call: a course, a book, or the experience you already carry from the job.
- Changed your mind? Ask for a full refund within 14 days of purchase, if the voucher has not been used.
- Your voucher never expires. Take the certification exam when you are ready.
- If you do not pass, your next attempt is half price for 90 days.
- The credential never expires: no renewal, no paid continuing education and no annual fee. You pay for the exam once.
Mandatory prerequisite: this certification exam can only be purchased and taken by holders of the Responsible AI Practitioner (RAIP) or Data Protection & AI Professional (DPAI) credential.
Your access to the certification exam arrives by email as soon as the payment clears, and it does not expire. Payment is handled by Stripe.
Sample credential
Responsible AI Auditor
- Holder
- Emily Katherine Thompson
AUDAI-FNNG-ZJ29
Frequently asked questions about the certification exam
›Is the AUDAI an ISO 42001 Lead Auditor certificate?
No. The AUDAI covers auditing against ISO/IEC 42001 and ISO/IEC 27701, with control testing, nonconformities and reporting, but it is not a Lead Auditor certificate, it is not issued by ISO or an accredited body and it does not qualify anyone to issue ISO certificates to organisations. It proves you can audit AI and data processing with evidence and method.
›What does the AUDAI cover?
Six audit domains: audit fundamentals applied to AI and data, such as independence, evidence and sampling; auditing against ISO/IEC 42001 and ISO/IEC 27701; auditing AI systems, with model documentation, data lineage, bias and performance evidence and monitoring logs; regulatory conformity, including EU AI Act conformity assessment and GDPR and LGPD compliance audits; third-party and supply chain assurance; and audit casework.
›What is the prerequisite for the AUDAI?
Holding the RAIP or the DPAI credential. To audit AI and data, you first need to know what is being audited. The prerequisite is checked when you buy the exam on its own and when you open it. In the Assurance Track bundle (DPAI + AUDAI), you sit the DPAI first and the AUDAI opens once you pass. No third-party audit credential is required.
›What is the AUDAI exam like?
There are 50 questions in 150 minutes, and you pass with 72%. Most describe an audit situation, and the audit casework domain, with 8 questions, presents evidence, such as policies, logs and test results, and asks for a judgement: is the control effective, is there a nonconformity, what evidence is missing. The exam is online, in English, Portuguese or Spanish, and costs USD 100.
›Who is the AUDAI for?
For internal and external auditors, compliance consultants and second-line risk professionals who need to assess AI systems and data processing. It also suits people from IT or security audit who want to extend their scope to AI. If your job is to build the programme rather than audit it, the RAIL is usually the right choice.
›What is the certification exam like? Is it online?
Yes, it is an online multiple-choice exam, taken in your own browser, with no scheduling and no exam centre. Questions describe work situations and ask for a decision, rather than testing memorised definitions, and the RAIL and the AUDAI also have a case analysis domain. Every question has four options and exactly one correct answer. All exams have 50 questions; the duration and the passing score of each are on the certification page.
›How hard is the exam, and what is the passing score?
The passing score is 70% for the RAIF, RAIP, DPAI and RAI-X, and 72% for the RAIL and the AUDAI, which are higher-level. There is no curve and no comparison with other candidates, and every question has exactly one correct answer. On difficulty: we do not publish pass rates yet, because DPCert is new and we will only publish figures with a large enough sample. Questions ask for decisions in real situations, so studying from the syllabus makes a difference.
›Can I retake a paid exam? Do I have to wait?
You can retake it, and for paid certifications there is no waiting period and no limit on attempts. Each new attempt requires a new voucher, because each voucher is worth one attempt. Questions are drawn afresh each time you open an exam, so a retake does not repeat the previous paper. If you do not pass, you receive a coupon to buy the new attempt at the same certification for half the price, valid for 90 days. For a RAIF taken at no cost under the Black Friday flash promotion, the rule is different: a free retake within 7 days of the result.
›Does the voucher expire?
A voucher bought on the site does not expire. Vouchers issued to an organisation in bulk may carry a deadline set at issuance, and in that case the date is shown with the code. If you lost the email, the code is also in your account, under Certification exams, once your address is confirmed.
›What is the refund policy? Can I cancel my purchase?
Yes, within 14 days of purchase, as long as the voucher has not been used. Write to [email protected] from the same email used in the purchase, saying you want a refund. We return the full amount through the same payment method and cancel the voucher at the same time. A voucher already used is not refundable, even within the 14 days, because the attempt is consumed when the exam is opened. For a bundle, the refund covers the whole bundle and only applies if none of its vouchers has been used. After 14 days, the voucher is still yours and never expires, but it is no longer refundable.
›Does the DPCert credential expire? Do I need to renew it?
No and no. A DPCert credential does not expire: there is no expiry date, no periodic retesting, no continuing education quota (CPE/CPD), no renewal fee and no annual dues. You sit the exam once, and the credential stays valid unless revoked. Revocation is an administrative act with a recorded reason, not an automatic expiry. No renewal fees. No CPE quotas. Many certifications on the market charge periodic upkeep; this one does not.
Questions about the certification exam →All frequently asked questions →