Who Can Run Your Bias Audit? The Independent Auditor Requirement Under Local Law 144

Summary: Local Law 144 requires the annual bias audit to be conducted by an independent auditor, and DCWP maintains no approved or accredited list. Auditor selection is therefore entirely the employer's responsibility and entirely the employer's exposure. An audit that is methodologically sound but conducted by a party failing the independence test does not satisfy the law.

What independence means under the rule

The auditor must be a person or group that has not been involved in using, developing, or distributing the AEDT, and that has no employment or financial relationship with the employer or the vendor that would compromise independence.

Three separate disqualifiers sit inside that sentence, and they catch different parties.

Involvement in the tool. Anyone who built, sold, implemented, or operates the tool is out. This is the clearest test and the one most employers apply.

Employment relationship. Internal teams are generally out. A data science group inside the employer that audits the employer's own hiring tool has an employment relationship with the employer by definition.

Financial relationship compromising independence. This is the one that catches the common arrangement, and it is worth dwelling on.

The vendor-arranged audit problem

The most frequent compliance pattern is also the most exposed. A vendor commissions a bias audit of its own tool, publishes a summary, and offers it to customers as evidence of compliance.

Two problems.

First, the legal obligation to conduct a bias audit sits with the employer or employment agency, not the vendor. Local Law 144 imposes no direct obligations on vendors at all. A vendor audit may inform your compliance, but it does not discharge your duty.

Second, an auditor paid by the vendor whose tool is being audited has a financial relationship with the distributor of that tool. Whether that compromises independence is a judgement, but it is precisely the judgement a reviewer under the new enforcement posture is equipped to make. The December 2025 Comptroller audit specifically criticised DCWP for superficial bias audit review, and DCWP has committed to more rigorous evaluation. The safe assumption is that arrangements previously unexamined will now be examined.

The Comptroller's own review is instructive here. Of 32 disclosures DCWP had reviewed and found largely compliant, the Comptroller identified at least 17 potential non-compliance issues. Whatever the specific defects, the lesson is that disclosures which passed a cursory review will not necessarily pass a careful one.

Practical selection criteria

Since there is no approved list, you are constructing your own standard. These are the criteria worth documenting.

1. No commercial relationship with the tool vendor, current or within a defined lookback period. Ask directly and get it in writing.
2. No consulting relationship with your organisation that creates dependence on the audit outcome. An auditor who also sells you the remediation has a structural conflict worth at least disclosing.
3. Demonstrable methodological competence, specifically with selection rate and impact ratio calculation, and with the data structures your tool produces.
4. Willingness to publish a summary you can post. Some auditors deliver findings under terms that restrict disclosure, which conflicts directly with the public posting obligation.
5. A written independence attestation. This is the artefact that makes your selection defensible after the fact.

Documenting the selection

Under a proactive enforcement regime, the ability to show reasoning matters as much as the result. Keep a short record covering who you considered, what independence checks you ran, what the auditor attested to, and why you selected them.

This is not a legal requirement. It is what turns a contestable judgement call into a documented good-faith process, which changes the character of an enforcement conversation.

What the audit itself must cover

The independence question is separate from methodology, but the two are commonly conflated in vendor marketing. The audit must calculate selection or scoring rates and impact ratios across the categories required by the rule, and the summary must be published in a form that lets a reader see those figures.

The EEOC's four-fifths rule is the conventional reference point for interpreting impact ratios, though Local Law 144 does not itself set a pass threshold. An audit that reports ratios below four-fifths is not automatically a violation of Local Law 144. Failing to conduct the audit, publish it, or notice candidates is.

That distinction matters commercially. Employers sometimes avoid auditing because they fear the result. The law penalises the absence of the audit, not the finding.

Frequently asked questions

Can our internal data science team run the bias audit? Almost certainly not. An internal team has an employment relationship with the employer, and if they were involved in implementing or tuning the tool they are also disqualified on involvement grounds.

Can we use the vendor's published bias audit? It does not discharge your obligation. The duty to conduct, publish, and notice sits with you. A vendor audit may be a useful input, particularly where you lack access to the underlying model, but you should understand who paid for it and whether that arrangement survives scrutiny.

Does DCWP certify or approve auditors? No. There is no approved list, no accreditation, and no registration. Selection is entirely the employer's responsibility.

What if the audit finds adverse impact? Local Law 144 requires the audit and its publication. It does not prohibit using a tool that shows disparities. Federal law is a separate matter: Title VII, the ADEA, and the ADA allow claims based on outcomes, so an adverse finding is a signal to act rather than a Local Law 144 violation in itself.

How recent must the audit be? No more than one year before the tool is used. The clock runs from the audit date, not the calendar year, which means the renewal date differs by tool.