ISO 42001 Foundation study materials
ISO 42001 Foundation study resources

Green Dashboard, Missing Competence

ISO 42001 Foundation · Put your knowledge to work in context.

All case studies

Green Dashboard, Missing Competence

Vantage Retail is preparing for its first ISO/IEC 42001 certification audit. Its dashboard shows all KPIs green: model uptime 99.9%, complaint response within SLA, and no open high risks. The internal audit found three issues: 18 data labelers have no competence records; a new emotion-detection feature in the customer-service chatbot has no AI system impact assessment; and the last management review covered financial performance, cybersecurity, and customer satisfaction but not AI risks, incidents, or audit results. The AIMS manager wants to keep the audit findings informal so the certification body does not see them. The certification audit is in three weeks.

1. Assess Vantage's certification readiness. What should be disclosed and remediated?

Read the worked answer

Vantage is not ready to present a clean certification case. The three findings go to core AIMS requirements: competence, impact assessment, and management review inputs. Green operational KPIs do not compensate for missing management-system evidence.

The findings should be recorded formally, not kept informal. Certification bodies expect to see nonconformities identified and handled; hiding them suggests the AIMS cannot self-correct. The AIMS manager should:

  • Open corrective actions for each finding with owners and dates.
  • Record the labeler competence gap, assess its effect on data quality, and provide training and assessment.
  • Complete an impact assessment for the emotion-detection feature before it continues in use, or restrict the feature.
  • Convene a management review with the required AI-specific inputs.

Three weeks may allow remediation, but the audit should reflect what is actually done. If the impact assessment is incomplete, the feature should be paused. Honest disclosure with evidence of correction is stronger than a clean-looking dashboard that collapses under sampling.

2. What should the management review cover before the certification audit?

Read the worked answer

The management review should cover the AIMS's performance and improvement, not only business results. Appropriate inputs include:

  • Status of actions from previous reviews.
  • Changes in context, scope, and interested-party requirements.
  • AI risks, impact-assessment results, and treatment progress.
  • AI incidents, complaints, and regulatory developments.
  • Monitoring and measurement results, including model performance and drift.
  • Internal audit results and nonconformities.
  • Supplier performance and third-party AI dependencies.
  • Competence and resource gaps, including the labeler issue.
  • Effectiveness of controls and any need for change.

Outputs should include decisions on improvement, resources, and risk treatment. The review should be minuted with attendees and actions. A review that discusses cybersecurity but not AI risk leaves the AIMS without top-management oversight. Vantage should hold a focused review before the audit and document the emotion-detection decision explicitly.

3. How should the labeler competence issue be handled without overreacting or underreacting?

Read the worked answer

It should be handled proportionately but formally. The labelers are not a peripheral group: their judgements shape training and evaluation data, so competence directly affects model quality and fairness.

A proportionate response:

  • Define the competencies required for the labeling tasks, including guidelines, edge cases, and bias awareness.
  • Assess current labelers against those requirements.
  • Provide targeted training and a documented assessment.
  • Supervise or recheck work until competence is demonstrated.
  • Review a sample of recent labels for quality impact.
  • Record the gap, actions, and effectiveness check as a nonconformity and corrective action.

Overreacting would mean halting all labeling without evidence of harm; underreacting would mean treating training records as paperwork. The audit question is whether Vantage can show that people affecting AI data are competent. If the gap is closed with evidence before the certification audit, it becomes a demonstration of improvement rather than a hidden weakness.