The iDharma Verification Methodology, version 1.1, published in the open. Five dimensions - governance, data provenance, bias and fairness, security and compliance - each rated Low, Medium or High on defined criteria, and every finding traced to a named clause.
VERIFICATION METHODOLOGY · VERSION 1.1 · PUBLISHED & OPEN
The standard every iDharma audit is measured against.
Five dimensions, one published rubric, and every finding traced to evidence you can check.
Five dimensions
Low · Medium · High
Weakest link
Evidence, not assertion
Version 1.1
Our promise
“A rating without evidence is an opinion.”
Every finding is written against evidence and a mapped clause - the same published rubric at every depth. The fee starts at $5,000, and nothing is charged until you approve it.
Request this auditThe case file
The methodology, in three chapters
Most AI assurance is assertion: a vendor’s word, a self-assessment, a policy nobody signed. It reads well until someone asks for the record behind it. A control that cannot be evidenced is not a control yet, and a report that assumes otherwise is only an opinion.
Our review is the independent read. We agree the scope with you first, collect the evidence, test the system where access allows, rate each dimension on the same published rubric, and hand you a report a board, a customer or a regulator can check line by line.
The method, split
Two lists. Both are published.
Every rating rests on evidence. What is assessed, and what counts, is fixed in advance.
- Governance - who owns it, and who is watching
- Data provenance - its source, and the right to use it
- Bias & fairness - tested recently, and monitored
- Security - manipulation, attack, and who has access
- Compliance - the laws and rules that apply to you
- Documents - policies, owners, the AI inventory
- Data records - where the training data came from
- Test results - bias, manipulation, safeguards
- Logs - a reliable record of what the system did
- Prior assessments - anything already on file
Know your role
The evidence is yours. The rating is ours.
The organisation audited
You agree the scope before anything is charged, and you supply the evidence - the policies, the data records, the logs and any prior assessments. What happens next stays yours: the report hands you a plan for what to fix first, and the order you fix it in remains your own decision and nobody else's.
The independent assessor
We run the published method and nothing else. We do not build, resell or operate the AI we assess, so nothing rides on the answer. We test where access allows, read documents where it does not, and say which of the two each finding rests on - whoever the reviewer is, and whenever it is run.
A missing record is a finding
Nobody decides to leave a control unevidenced. A policy is written and never signed, a bias test runs once and is never repeated, a log is kept and never read. Under this standard a control that cannot be evidenced is rated as a gap - it is not quietly assumed to be in place somewhere.
What most teams assume
“We have a policy, so governance is covered.”
What the standard says
A policy is a claim. The record is the evidence.
Absence of proof is a finding, not a formality.
- Who it is for
- Boards & audit committees
- Risk & compliance
- AI product teams
- Procurement & vendor risk
- Legal & counsel
Scoring & ratings
02
If none is High but any dimension is Medium, the system is Medium. Only when all five rate Low is the overall exposure Low.
03
Medium means controls exist but are partial or informal - not urgent, not clean. High means they are missing or inadequate.
04
The scale is the one the AI Risk Snapshot uses, so a snapshot and a full audit describe your system in the same terms.
The 60-second check
Three questions. Then you’ll know.
No email, no signup. A starting point, not a scoping call.
Opens in a panel. Close it any time - your answers are kept.
iDharma methodology
Your depth check
Published & versioned
Four moments, and one repeats.
The standard is published and versioned in the open, so clients and their stakeholders can see exactly what an audit measures.
-
Published
June 2026Version 1.0 went out at audit launch: the five assessment dimensions and the core framework mapping.
-
Formalised
1 July 2026Version 1.1 set down the Low, Medium and High rubric and the weakest-link rule, and widened the mapping.
-
Applied
Every engagementThe same published method and rubric run on every audit, so two comparable systems stay comparable.
-
Versioned
On material changeMaterial changes move the version. Superseded editions stay on record, and are available on request.
The trap
Teams read a clean report as a permanent pass. It is a point-in-time review - based on the evidence provided and the scope agreed - and AI systems keep changing after the date on it.
Requirement & coverage
What the standard asks, what we ship
12 things every audit checks, and the artefact that answers each one. Paired, so every claim on this page can be checked against the requirement beside it.
- System ownership A written policy, a named owner, someone accountable
- Who owns each system and who answers when it goes wrong - read from your policy, then checked against practice.
- Oversight in practice Someone is actually watching what the AI does
- Who reviews the system's behaviour, how often, and what they do when it drifts - named, rather than assumed.
- The AI inventory An up-to-date list of every AI system in use
- Your inventory tested against what is actually running, with anything missing from it recorded as a gap.
- Change review Changes go through some kind of review
- Whether changes to the system pass a review before release, evidenced by the record of one that did.
- Data rights Where the training data came from, and the right to use it
- The source of the data that trained and feeds the system, and the basis on which you are entitled to use it.
- Data quality Blind spots and built-in bias the AI would inherit
- Whether the data is good enough for the job, and what it carries that the model will reproduce downstream.
- Bias testing Tested for treating some groups worse - and how recently
- The tests that exist, what they measured, when they last ran, and whether the result would still hold today.
- Fairness monitoring Actively watched, not assumed to be fine
- Whether anyone would notice the system beginning to treat a group differently, and how quickly they would.
- Manipulation Whether it can be tricked into misbehaving
- Hands-on attempts to manipulate the system where access allows, and whether its safeguards hold under pressure.
- Access & data protection Who can reach it, and how the data underneath is kept
- Who holds access to the system and its data, and whether the protections around both are real or only written.
- The system record A reliable, tamper-proof record of what it has done
- Whether a trustworthy log exists of what the system decided and when - the record the other findings lean on.
- Compliance mapping The laws and rules that apply to your business
- Each finding mapped to the clause it answers - the EU AI Act, HIPAA, SOC 2 and the rest - with the gaps named.
The engagement
From scope to report, in five steps
Scoped with you up front, evidence-led throughout.
-
Scope
Systems, dimensions and depth agreed with you. Nothing is charged before you approve.
-
Evidence
Documentation, data records, model descriptions, logs and any prior assessments.
-
Testing
Hands-on where access allows: bias, manipulation, and whether safeguards hold.
-
Review
Rated Low, Medium or High and cross-checked against the mapped standards.
-
Report
A rating per dimension, findings with evidence, and what to fix first - dated.
Struck in your favour
Why teams choose iDharma to hold them to a standard
Genuinely independent
We build, resell and operate no AI systems of our own, and take no fee tied to what we find.
Evidence, not assertion
Every rating traces to a document, a test result or a log. A verbal assurance alone is not proof.
Applied consistently
One published method and one rubric on every engagement, so the standard never moves with a reviewer.
Method disclosed
Hands-on where access allows, documents where it does not - and each finding says which it rests on.
Four marks, struck on every report.
Deliverables
What you get
Concrete artefacts, each with a name and a format - you know what lands before you buy.
AI audit report
The full read in one document: a Low, Medium or High rating on each of the five dimensions, an overall exposure set by the weakest of them, every finding with its severity, the evidence behind it and the clause it maps to, and a plan for what to fix first - ready to put in front of your leadership team.
Findings register
Every finding with its severity, the evidence behind it and the standard clause it maps to, in a workbook your team can work through.
Dimension scorecard
Low, Medium or High across all five dimensions, plus the overall exposure - the same picture your board sees at a single glance.
Compliance mapping
How your system lines up against the frameworks that apply to you, clause by clause, and exactly where the gaps sit against each one.
Scope record
Which systems, dimensions and depth were agreed before anything was charged, and what sat outside them - the written edge of the read.
Prioritized roadmap
What to fix first, sequenced by exposure, so remediation effort goes where the risk actually sits rather than where it is easiest.
Method statement
For every finding, whether it was tested hands-on or read from documentation - stated, so a reader knows what each rating rests on.
Format & fee
Real numbers, upfront.
- Scope
- Agreed with you before any fee
- Input
- Documents, data records, logs
- Re-read
- Point-in-time by design - re-run when the system or its rules change
The published method fixes the scope, so each depth has a set fee - nothing charged until you approve it.
Request your audit
iDharma methodology · Quick Scan
$5,000 to start
- Up to three AI systems or tools
- Top-priority risk and gap findings
- A prioritized action list
- 14 business days of follow-up
Show your hand
Four things every finding has to show
A rating nobody can check is an opinion. Each of these sits on the page beside the finding, or the finding does not ship.
The evidence,
concrete
A document, a test result or a log behind every rating. A verbal assurance can open a question here; on its own it is never allowed to close one.
The clause,
named
Each finding tied to the provision of the framework it answers, so a board, a customer or a regulator can see exactly what it was measured against.
The method,
stated
Whether each finding came from hands-on testing or from documentation, written beside it - so no reader has to guess what a rating rests on.
The rating,
defined
Low, Medium or High on published criteria, and an overall exposure set by the weakest dimension. The scale does not move from one audit to the next.
Four cards, dealt with every finding.
What does the methodology assess?
Five dimensions on every audit: governance, data provenance, bias and fairness, security, and compliance with the laws and rules that apply to you. Each is rated Low, Medium or High on defined criteria.
How is overall exposure rated?
By the weakest link. If any single dimension is High, overall exposure is High; otherwise, if any is Medium, it is Medium; otherwise it is Low. A system is only as trustworthy as its weakest dimension.
What if we cannot evidence a control?
It is rated as a gap, not assumed compliant. Every rating traces to something concrete - a document, a test result, a log - and a verbal assurance on its own is not evidence. Absence of proof is a finding.
Is an iDharma audit a certification?
No. It is an independent, standards-based assessment - not a certification, accreditation or legal advice, and it confers no regulatory approval. It informs your decisions; it does not guarantee a system is safe or compliant.
How long does an audit take?
It depends on the depth: a Quick Scan runs ~1 week, a Compliance Audit ~2–3 weeks and a Risk Audit ~4 weeks. One methodology at three depths, with the scope agreed before anything is charged.
Get started
See the standard applied to your AI
Tell us which systems you run, and we come back with a scoping call within one business day.
What we need from you
Nothing you do not already have. Most of this is a folder someone can assemble in an afternoon, and we name every document first, in writing, before you commit.
- Which AI systems you run, and who owns each one
- Any policies, inventories and change records
- Where the training data came from, if you know
- Logs, test results and any prior assessments
- Which laws and frameworks you answer to
What happens next
- You send the five items we need.
- You get a scoping call within one business day.
- Nothing is charged until you approve the scope.
Sources & standing
What this standard is, and is not
Where the method on this page comes from, and what an audit against it is worth - stated, not assumed.
What it is drawn from
- iDharma Verification Methodology v1.1
- The framework catalogue - 31 instruments
- First published
- June 2026
- Current edition
- 1 July 2026
What it means
- An independent assessment against this published standard - not a certification, accreditation or legal advice, and not a contract, warranty or guarantee.
- It informs your decisions. It does not certify that any system is safe or compliant.
Scope & limitation
- A point-in-time review, based on the evidence provided and the scope agreed.
- An audit reduces and surfaces risk - it does not eliminate it.
- Sample reports are illustrative, built for fictional companies.
Something on this page out of date?
Tell usFrom Insights
Before you commission one
How to Prepare for an AI Audit: The Readiness Checklist
Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.
Read the notes
METHODOLOGY NOTES
What Is an AI Audit? Scope, Standards, and What You Get
An independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.
STANDARDS EXPLAINED
What an AI Governance Framework Actually Contains
Five working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.
STANDARDS EXPLAINED
ISO/IEC 42001, SOC 2 and NIST AI RMF: Which One Your Buyer Is Actually Asking For
One certifies an organisation, one is an opinion about controls over a window, one is a method with nothing to issue. What each covers — and what none of them answers.
