A published, evidence-based methodology for independently assessing whether the AI you run is accurate, fair, secure, and compliant — mapped to the frameworks that matter, so every finding is traceable to evidence, not opinion.
Five dimensions across your AI — governance, data, fairness, security, and compliance.
NIST AI RMF, ISO/IEC 42001, EU AI Act, SOC 2, HIPAA, and India DPDP — explained below.
The iDharma team — independent of the systems being reviewed.
A prioritized report, ready to present to your leadership team, with severity ratings and a fix-first plan.
Independent. Objective. Focused on what matters.
Every audit rates your AI on the same five dimensions — the ones that decide whether a system is trustworthy in production.
How an audit is conducted →
Who's accountable, and whether anyone is actually overseeing what the AI does
Is there a written policy for who owns this AI and who's accountable when it goes wrong? We check who's actually watching it, whether there's an up-to-date list of every AI system in use, and whether changes go through any kind of review.
Where the AI's training data actually came from
Where the data that trained and feeds this AI actually came from — whether you have the right to use it, whether it's good quality, and whether it carries built-in bias or blind spots the AI would inherit.
Whether it treats people differently based on things it shouldn't
Whether the AI's decisions have actually been tested for treating some groups of people worse than others, how recently, and whether that's actively monitored — not just assumed to be fine.
Whether it can be tricked, attacked, or manipulated
Whether it can be tricked or manipulated into misbehaving, who has access to it, how the underlying data is protected, and whether there's a reliable, tamper-proof record of what it's done over time.
Whether it meets the laws and rules that apply to you
Whether the system actually meets the laws and rules that apply to your business — like the EU AI Act, the U.S. health-data law (HIPAA), India's data-protection law (DPDP), the SOC 2 security standard, and whatever else applies to your industry — and where it falls short.
Each rating is tied to specific provisions of the frameworks below, so a board, a customer, or a regulator can see exactly what it is measured against.
Binding law and supervisory expectation. Where one of these applies to your system, the audit is scoped against its named articles — not against a summary of them.
Data-protection law travels with the training data and the inference logs. These are the regimes that decide what your AI may hold, on what basis, and for how long.
The standards nobody forces on you and every procurement team asks about. Alignment here is what turns an audit into an answer for a buyer.
A productized process — scoped with you up front, evidence-led throughout, and never charged before you approve the scope.
We agree the systems, dimensions, and depth with you before anything is charged — you approve the scope first.
We collect the documentation, a record of where the training data came from, technical descriptions of the AI model, logs, and any prior assessments the system already has.
We test the system directly where we can get access — checking for bias, attempts to trick or manipulate it, and whether the safeguards that are supposed to be in place actually work.
Findings are rated on our Low/Medium/High scale and cross-checked against the mapped standards, so nothing rests on a single reviewer's opinion.
You receive a prioritized report, ready to present to leadership — a rating per dimension, findings backed by evidence, and a plan for what to fix first.
Independent. Evidence-led. Built for trust.
Every rating traces to something concrete — a document, a test result, a log. A verbal assurance on its own is not evidence.
Where a control can't be evidenced, it's rated as a gap — not quietly assumed compliant. Absence of proof is a finding.
Testing is hands-on where access allows and documentation-based where it doesn't — and the report states which was used for each finding.
Our guiding principles
Each dimension gets one of three exposure ratings, on defined criteria. The scale is the same one your AI Risk Snapshot uses.
The same methodology runs at three depths — Quick Scan, Compliance, and Risk.
See what each tier covers →| Dimension | Rating |
|---|---|
| Governance | Medium |
| Data provenance | High |
| Bias & fairness | Low |
Illustrative sample
What to fix first — sequenced by exposure, so remediation effort goes where the risk actually is.
How your system lines up against the frameworks that apply to you, and where the gaps sit.
Each finding carries its severity, the evidence behind it, and the standard clause it maps to.
Low / Medium / High across all five dimensions, plus the overall exposure — the same picture your board sees at a glance.
Every audit is run by the iDharma team. We don't build or sell the AI we assess — that independence from the system under review is exactly what makes the report something a board or a regulator can actually trust.
The same published methodology and rubric apply to every engagement, so two audits of comparable systems are comparable — the standard doesn't move with the reviewer.
An iDharma audit is an independent, standards-based assessment — it is not a certification, accreditation, or legal advice, and it does not confer regulatory approval.
This methodology is maintained by the iDharma team and published openly, so clients and their stakeholders can see exactly what an audit measures. Material changes bump the version, and the history is on the record below.
Superseded editions are kept on record and available on request.
An iDharma audit runs this methodology against the systems you actually operate.
A clear, prioritized read you can act on and defend.
This page describes iDharma's verification methodology (current edition v1.1) and how our audits are structured. It is provided for transparency and is not a contract, warranty, or guarantee. An audit is an independent assessment against this published standard — it informs your decisions but is not a certification or a guarantee that any system is safe or compliant, and findings are specific to each engagement's scope. Nothing here is legal advice.
No payment until you approve the scope
Brijesh Patel, our founder, personally replies within one business day. Nothing is charged until you approve the scope.
We’ve emailed you a secure, password-free link to your client portal. Sign in to your portal →
For audit firms and practitioners: co-deliver AI audits on our methodology and audit trail.
Thank you — your auditor partner application is with our team. We review every application and will be in touch by email.