[Story]: Internal audit and management review cycle

## Summary
Run an internal audit and management review cycle against the documented AI management system, closing findings to demonstrate certification readiness.

## Intent / Source of truth
ISO management-system standards require a functioning internal-audit and management-review cycle as evidence the system is actually operating, not just documented. Part of [Epic] ISO/IEC 42001 certification path.

## Scope
- [ ] Internal audit against the g2s2 documentation and g2s1 gap closures
- [ ] Management review meeting with documented outcomes
- [ ] Findings tracked to closure

## Out of scope
- The external certification body's own audit

## Verification
Internal audit report with all findings closed or explicitly risk-accepted with sign-off; management review minutes on record.

## Risk assessment
Skipping a genuine internal audit in favor of a rubber-stamp review would be caught by an external certifier and delay certification; treat this with the same rigor as the SOC 2 evidence pipeline.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.

Start by reviewing the g2s2 documentation and g2s1 gap closures named in the scope, then establish the internal-audit evidence and management-review inputs. Record the internal audit report, management review minutes, and findings disposition; done means every finding is closed or explicitly risk-accepted with sign-off.

Vom Indexierungsmodell aus dem Issue-Text verfasst.