Algorithm Auditing: Methods & Impact

• Algorithm auditing is the systematic process of evaluating algorithmic systems for functionality, bias, and compliance with ethical and legal standards.
• It employs both black-box and white-box methodologies, including controlled experiments and steering-vector audits, to analyze opaque algorithmic operations.
• Auditing practices integrate social science, quantitative metrics, and legal frameworks to provide actionable insights and foster transparency in automated systems.

Algorithm auditing is a family of evaluative practices for investigating the functionality, impacts, and governance of algorithmic systems. In contemporary governance and HCI literatures, it is described both as “the science and practice of evaluating, mitigating, and ensuring algorithms' safety, legality, and ethicality” and as “repeatedly querying an algorithm and observing its output in order to draw conclusions about the algorithm’s opaque inner workings and possible external impact” (Akula et al., 2021, Morales-Navarro et al., 2024). In compliance and assurance settings, it is also framed as a “criteria-based independent external evaluation” of an algorithmic system against a normative framework (Lam et al., 2024). A distinct machine-learning usage treats “auditing” as active learning with outcome-dependent query costs, where the auditing complexity is the number of costly negative labels (Sabato et al., 2013).

1. Definitions and scope

The literature does not converge on a single definition of algorithm auditing. One strand emphasizes functionality and impact: auditing is “a process of investigating the functionality and impact of decision-making algorithms,” where functionality audits examine how an algorithm works and impact audits analyze outputs for bias, misrepresentation, and distortions (Urman et al., 2023). Another strand treats “AI audit” and “algorithmic audit” interchangeably as a process through which an automated decision system or algorithmic product is evaluated against specific criteria, with findings and recommendations delivered to the auditee, the public, and/or regulators (Costanza-Chock et al., 2023). A third strand, oriented toward black-box systems, centers on external observation: auditors generate and control inputs, record outputs, and analyze patterns without requiring insider access or model internals (Morales-Navarro et al., 2024).

This conceptual breadth has been explicitly noted. The term “algorithmic audit” has been said to refer to “almost any kind of empirical study of algorithms,” ranging from discrimination-focused experiments to transparency and performance evaluations (Vecchione et al., 2021). The same expansion appears in reviews of online-platform audits, which define auditing as an empirical study of a public-facing algorithmic system that evaluates functionality and/or impact, diagnosing problematic behavior such as discrimination, distortion, misjudgment, and exploitation (Urman et al., 2024).

At the same time, assurance-oriented work narrows the concept. A criterion audit is defined as “A criteria-based independent external evaluation E of an algorithmic system S conducted by an auditor A to determine whether the given system S meets the requirements set by a normative framework” (Lam et al., 2024). In this formulation, audit criteria must be verifiable or observable conditions jointly sufficient to support an unambiguous opinion. This is structurally different from open-ended exploratory auditing, even when both examine the same system.

A further terminological divergence appears in statistical learning theory. There, “auditing” denotes a query model in which unlabeled data is free and the cost of a label depends on its value; in the extreme case studied, the algorithm only pays for negative labels (Sabato et al., 2013). This usage is historically important but methodologically separate from the governance, accountability, and sociotechnical senses that dominate current research on deployed AI systems.

2. Historical and disciplinary lineages

Algorithm auditing is deeply indebted to social science audit studies. That lineage treats audits as field experiments designed to detect discrimination in domains such as housing and employment, and it emerged from activist research tied to racial equity and participatory action (Vecchione et al., 2021). Early audit studies were conducted in collaboration with civic organizations seeking to assess race relations, often with the explicit aim of producing actionable evidence and meeting with audited entities after the fact. The participatory-action orientation treated research as something done “with participants, not on or for them” (Vecchione et al., 2021).

Over time, that lineage shifted toward more standardized and statistically rigorous correspondence studies. This increased scale and comparability, but it also introduced tensions between activism and academic detachment, between measurement and intervention, and between community collaboration and researcher control (Vecchione et al., 2021). Contemporary algorithm auditing inherits these tensions. Discrimination audits, performance audits, and reverse-engineering studies all borrow from the logic of controlled field experimentation, but they frequently operate in environments where the algorithmic mechanism, the surrounding interface, and the broader institutional process are all intertwined.

A second lineage comes from assurance and financial auditing. The analogy is explicit in work arguing that governments, businesses, and society need algorithm audits “similar to financial audits,” with systematic verification that algorithms are lawful, ethical, and secure (Akula et al., 2021). Criterion-audit frameworks make this analogy operational by importing audit opinions, materiality, evidence standards, risk-based planning, and public disclosure from financial assurance practice (Lam et al., 2024). The aim is not merely description but stakeholder “comfort” that an organization can govern its algorithms in ways that mitigate harms and uphold human values.

A third lineage is the research-to-regulation turn. Scholarship that began as independent experimental scrutiny of public-facing platforms now informs or is absorbed into legally mandated oversight under regimes such as the Digital Services Act and the Online Safety Act (Terzis et al., 2024). This suggests a transition from research-led experimentation to routinized compliance services, with attendant changes in methodology, institutional actors, and incentives.

3. Audit forms and access models

A central distinction is between internal and external auditing. Internal audits are self-assessments performed by the auditee or by contractors without robust safeguards against conflicts of interest, whereas external audits are performed by independent parties outside the audited entity (Lam et al., 2024). Field-scan work further distinguishes first-party, second-party, and third-party audits, with corresponding differences in access, disclosure, and conflict-of-interest risk (Costanza-Chock et al., 2023).

Access to the target system structures what can be audited. One framework specifies seven audit phases by degree of access: Process Access, Model Access, Input Access, Output Access, Parameter Control, Learning Objective, and White-box (Akula et al., 2021). These phases range from checklist-driven review with no direct model access to full access to architecture, learning process, parameters, training and verification data, and predictions. The same framework maps risk tiers to access modes: minimal risks support a “checklist-phase approach,” minimal to medium hazards without monitoring suggest “black-box,” moderate risks with some monitoring suggest “grey-box,” and medium-high dangers with complete supervision suggest “glass-box” (Akula et al., 2021).

Legal scholarship offers another typology. “Bobby” audits check a precise predicate against a black-box algorithm, often using real or benchmark data, and are more amenable to prosecution because they can produce intelligible input-output violations. “Sherlock” audits are looser and exploratory, typically crafting synthetic inputs and building surrogates to characterize behavior, often for whistleblowing rather than direct legal proof (Merrer et al., 2022). The distinction is not merely methodological: it bears directly on admissibility, evidential value, and exposure to prosecution.

Recent work has also widened the set of actors who audit. “Everyday algorithm auditing” refers to the ways ordinary users detect, understand, and interrogate problematic machine behaviors through routine interactions, often via collective testing, folk theories, and public discussion (Shen et al., 2021). User-engaged auditing in industry directly involves users or impacted stakeholders in surfacing harmful behaviors that internal teams may miss, especially representational harms and other “unknown unknowns” (Deng et al., 2022). “Sociotechnical audits” go further by auditing not only the algorithmic system but also users’ responses to altered algorithmic behavior, thereby measuring how outputs affect users and how users in turn shape system outcomes (Lam et al., 2023).

4. Criteria, evidence, and workflows

Audit criteria vary by purpose, but several recurring target areas appear across the literature. One influential “Trustworthy AI” decomposition specifies accountability and privacy, discrimination and bias, explainability and interpretability, and robustness and performance as critical areas required for auditing and assurance (Akula et al., 2021). Another systematic review organizes problematic behavior into discrimination, distortion, exploitation, and misjudgement (Bandy, 2021). These schemes are not identical, but they converge in treating auditing as broader than accuracy testing.

Within bias analysis, the literature distinguishes personal fairness from collective fairness and further distinguishes equality of opportunity from equality of outcome (Akula et al., 2021). It also emphasizes that fairness definitions may conflict and that “it is theoretically impossible to create an algorithm that meets all acceptable criteria” simultaneously (Akula et al., 2021). This is a central reason that audit reports often require explicit normative choices rather than merely technical scoring.

Assurance-oriented work insists that criteria be transparent, publicly accessible, and anchored to a normative framework. Suitability properties echo ISAE 3000: relevance, completeness, reliability, neutrality, and understandability (Lam et al., 2024). The output is then an audit opinion rather than an open-ended risk memo. Adapted from financial auditing, the opinion types are unqualified, qualified, adverse, and disclaimer (Lam et al., 2024).

Evidence is correspondingly heterogeneous. Common artifacts include a policy document declaring algorithm purpose, documentation of data and software artifacts, model-parameter metadata, access logs, API interfaces, predictions on synthetic and real data, stress tests, drift analyses, explanation validations, and attack simulations such as inversion or model extraction (Akula et al., 2021). Criterion-audit frameworks add documentation review, process walkthroughs, stakeholder interviews, re-performance, and working papers that record procedures, evidence, judgments, and conclusions (Lam et al., 2024).

Workflow blueprints range from pedagogical black-box procedures to full assurance engagements. One five-step scaffold for black-box auditing consists of developing a hypothesis, generating a systematic set of inputs, running tests, analyzing the data, and reporting results (Morales-Navarro et al., 2024). A criterion-audit lifecycle begins with pre-engagement independence checks and an engagement letter, then proceeds through scoping, criteria derivation, risk assessment and control evaluation, test-plan design, evidence collection, validation and verification, reporting and publication, and follow-up and remediation (Lam et al., 2024).

Recent technical work has expanded the metric repertoire. Behavioral audits for DSA-style platform compliance formalize source concentration with measures such as the Herfindahl–Hirschman Index, defined as $\mathrm{HHI} = \sum_{i=1}^{N} s_i^2$, and the Gini coefficient, defined as $$G = \frac{\sum_{i=1}^{n} \sum_{j=1}^{n} |x_i - x_j|}{2 n^2 \mu}$$ (Hernandes et al., 2024). White-box LLM sensitivity audits manipulate internal concept representations with $h'_l(x; \alpha) = h_l(x) + \alpha v_c$ and estimate directional sensitivity as $$S_c(x) \approx \frac{y'(x; \epsilon) - y'(x; -\epsilon)}{2\epsilon}$$ (Cyberey et al., 23 Jan 2026). This suggests that auditing increasingly spans documentation review, black-box experimentation, and mechanistic intervention.

5. Domains and empirical findings

Algorithm auditing is applied across both high-stakes decision systems and public-facing platforms. Sectors explicitly named in assurance-oriented work include autonomous vehicles, banking, medical care, housing, legal decisions, law enforcement, and health care (Akula et al., 2021). Reviews of public-facing audits show especially heavy concentration in search, recommendation, advertising, pricing, vision, and criminal justice (Bandy, 2021).

The online-platform literature is empirically concentrated. A systematic review of 128 platform-focused studies reports 62 audits of search systems, 39 of recommendation systems, 16 of ad delivery, and 9 of e-commerce. Google Search appears in 54 studies, YouTube in 22, Bing Search in 12, Facebook in 12, and Twitter in 10. The same review finds a strong skew toward the United States and English-language data: 73 studies include US data, and English appears in 94 of the 127 studies for which language is relevant (Urman et al., 2024). This concentration matters because it shapes which harms are made visible and which remain under-audited.

Large-scale black-box audits of Google’s News tab illustrate the methodological maturity of platform auditing. A cross-country study covering Brazil, the UK, and the US analyzed 221,863 search results and found that per-query concentration appeared low, with average vertical values of HHI $\approx 0.09$ and Gini $\approx 0.32$, but horizontal aggregation across queries and time revealed much stronger concentration, with overall unweighted Gini $= 0.822$ and HHI $= 0.005$, and rank-weighted Gini $= 0.919$ and HHI $= 0.011$ (Hernandes et al., 2024). The same audit reported a slight leftward bias in outputs, a preference for popular and often national outlets, and systematic recency effects in ranking (Hernandes et al., 2024).

Youth-centered auditing has become a distinct subfield. In one two-week workshop with 13 participants aged 14–15, all participants in the post-interview identified algorithmic biases and inferred dataset and model-design issues, and 12 discussed justice and harm, compared with 7 in the pre-interview (Morales-Navarro et al., 2024). A later teen-led audit of TikTok’s Effect House generated 1,200 tests across 25 occupations, 4 prompt phrasings, and 12 input images. Across all outputs, gender-balanced inputs yielded outputs that were 41% feminine-presenting, 55% masculine-presenting, and 4% ambiguous, while a change in age representation occurred in 46.75% of outputs (Morales-Navarro et al., 6 Aug 2025). Everyday youth auditing on TikTok filters shows a related but more informal style: seven high school participants explored 189 filters in 31 minutes, made 271 camera-angle or input changes, executed 213 facial variations, and used other people or artifacts 130 times (Vogelstein et al., 23 Feb 2026).

White-box auditing has likewise produced findings that differ materially from black-box baselines. In simulated high-stakes LLM decision tasks, a steering-vector audit reported that for Saul-7B in a judicial conviction task, black-box implicit perturbation showed +2.91% race bias, black-box explicit perturbation showed −14.70%, while white-box steering showed +19.66% with a dialect-derived vector and +4.62% with a Racial Identity vector (Cyberey et al., 23 Jan 2026). In credit scoring, Llama-3.1 showed −0.69% bias under black-box explicit gender perturbation but −5.11% under white-box steering (Cyberey et al., 23 Jan 2026). These results indicate that black-box evaluations can understate, or even reverse, apparent dependence on protected attributes.

6. Governance, law, and political economy

The institutionalization of algorithm auditing has foregrounded legal access, auditor independence, and regulatory design. The “right to audit” literature argues that independent social research should be explicitly allowed and not restrictable by platform Terms of Service, especially when auditors rely on scraping, sock-puppet accounts, or other adversarial methods to uncover discrimination and bias (Urman et al., 2023). That literature also catalogues structural asymmetries: legal threats, uncertain IRB and university support, unequal access to platform data, disparities between early-career and senior researchers, and a resulting Western-centrism in what gets audited (Urman et al., 2023).

Black-box auditing also raises evidentiary questions. Under the Bobby/Sherlock framework, Bobby audits are more legally usable because they test clear predicates on real outputs, whereas Sherlock audits often rely on crafted data and surrogate models whose evidential value is lower in practice (Merrer et al., 2022). Both forms, however, require a “proper right to audit,” granted by law or by the platform; otherwise the auditor may face prosecution regardless of the substantive finding (Merrer et al., 2022).

The audit ecosystem itself remains fragmented. A field scan identified 438 individuals and 189 organizations engaged in or directly relevant to algorithmic audits, surveyed 152 respondents, and found broad support for mandatory audits and disclosure alongside weak methodological standardization (Costanza-Chock et al., 2023). Among auditors, 77% assess algorithmic accuracy, fairness, and statistical soundness; 77% assess training-data quality; 74% assess real-world outcomes; 65% assess legal or regulatory adherence; and 59% assess security, privacy, and consent. Yet only 7% use standardized frameworks, 65% report lacking auditee commitment to fix problems within a set time, and 80% say recommended changes were not implemented (Costanza-Chock et al., 2023).

Regulation has not eliminated these concerns. Under the DSA and OSA, algorithm auditing is moving into a compliance industry shaped by assurance language, subcontracting, and traditional audit-firm practices (Terzis et al., 2024). DSA article 37 mandates an annual independent audit with a “reasonable level of assurance,” but the same framework leaves open significant questions about conflicts of interest, the role of non-audit services, the use of subcontractors, and the practical evaluation of “the societal and economic context in which the audited service is operated” (Terzis et al., 2024). Political-economy analyses warn that ambitious research-led audit methodologies may be diluted by standardization pressure, diverse service portfolios, and tight timelines (Terzis et al., 2024).

7. Open problems and future directions

Several unresolved issues recur across the literature. One is the absence of a universal template: “No one size fits all solution” exists, only trade-offs to be handled (Akula et al., 2021). Translating accountability, fairness, and transparency into engineering practice is “not simple,” and some papers explicitly note that quantitative thresholds, detailed standards mappings, incident-management procedures, and audit-report templates are not yet provided (Akula et al., 2021). This leaves substantial room for judgment, but also for inconsistency.

A second unresolved issue concerns scope. Audit studies can only capture a “thin slice” of complex sociotechnical systems, and many domains—especially government-run systems in immigration, policing, and related areas—are described as not even technically possible to audit from the outside without access (Vecchione et al., 2021, Urman et al., 2023). This suggests that black-box auditing, while powerful, cannot be the only mode of accountability.

A third issue is representational imbalance in the auditing literature itself. Reviews consistently document WEIRD skews, English-language dominance, limited intersectional analysis, and simplified operationalization of sensitive attributes (Urman et al., 2024). Recommendations therefore emphasize more multilingual and non-Western audits, stronger justification of category choices, more comparative cross-country work, and greater collaboration with civil society and affected communities (Urman et al., 2024).

Future directions are correspondingly plural. Policy-oriented work calls for a statutory right to audit, standardized disclosure of key findings, standardized harm incident reporting, and stronger involvement of stakeholders most likely to be harmed (Costanza-Chock et al., 2023). DSA-focused work calls for behavioral evidence, replication packages, and independent reruns, rather than point-in-time checkbox assessments (Solarova et al., 26 Jan 2026). Industry and HCI research calls for interfaces and workflows that support sustained user-engaged auditing, mixed-method aggregation of qualitative “why” evidence with quantitative signals, and accountability mechanisms “with teeth” (Deng et al., 2022). Participatory and youth-centered studies suggest that algorithm auditing is not only a compliance function or research method, but also a mode of critical AI literacy and distributed public scrutiny (Morales-Navarro et al., 2024, Morales-Navarro et al., 6 Aug 2025).

Taken together, these directions imply that algorithm auditing is evolving into an umbrella field that spans assurance, black-box experimentation, participatory inquiry, and mechanistic analysis. The field’s central challenge is not merely to expand audit volume, but to align audit form, access, evidence, and institutional power with the kinds of harms an audit is meant to surface.