ISO 42001 Lead Auditor case studies

ISO 42001 Lead Auditor · Put your knowledge to work in context.

The PECB Certified ISO/IEC 42001 Lead Auditor credential is awarded by PECB to professionals who pass the ISO/IEC 42001 Lead Auditor exam and then satisfy the experience requirements attached to the credential they apply for. It attests the ability to audit an artificial intelligence management system (AIMS) against ISO/IEC 42001 by applying widely recognised audit principles, procedures and techniques, in line with ISO/IEC 17021-1 requirements and ISO 19011 guidelines. The ISO 42001 Lead Auditor case studies are 5 cases and about 4,032 words.

The Auditor Who Used to Consult: Impartiality and a Scope That Has Outgrown the Certificate

NordCert certified Aurora Analytics GmbH to ISO/IEC 42001 fourteen months ago. The certificate scope reads: "Design, development and provision of machine-learning credit-scoring systems for financial institutions." Since the last surveillance visit Aurora has (a) launched a generative-AI assistant that screens job applicants for its own HR department, (b) opened a 40-person development site in Lisbon, (c) logged four AI incidents, two involving biased credit-scoring outputs, and (d) grown from 210 to 340 staff.

786 words, about 4 min 2

Stage 1 at a Hospital: Readiness, a Stale Management Review, and a Vendor's Certificate

You are lead auditor for the stage 1 audit of MediCore Regional Hospital's initial ISO/IEC 42001 certification. Scope: "Use of a vendor-supplied AI triage and prioritisation tool in the emergency department." Document review shows: an AI risk assessment with 11 risks; a statement of applicability listing 24 of the Annex A controls as applicable, with short justifications; an internal audit performed by the IT service manager covering clauses 4, 5, 6 and 8 only; a management review dated eleven months ago with no agenda item on the status of AI risk treatment actions; no AI system impact assessment for the triage tool; an AI policy approved by the CIO; and the software vendor's own valid ISO/IEC 42001 certificate.

814 words, about 4 min 3

Two Out of Five: Classifying a Blanket Exclusion from Impact Assessment

You are conducting the stage 2 audit of a retail bank's AIMS. Five AI systems fall within the scope.

795 words, about 4 min 4

Closing Two Minor Nonconformities: Retraining, a Late Management Review, and the Certification Decision

At the closing meeting of an ISO/IEC 42001 surveillance audit, you issue two minor nonconformities: (1) an operator changed the confidence threshold of a fraud model without following the change-approval step; (2) the last management review did not address the status of actions from the previous review or changes in AI-related risk. Ten days later the client submits corrective action evidence.

798 words, about 4 min 5

Accepted Risk That Was Never Treated: Reading the Risk File Against Reality

Paylane, a payments provider certified to ISO/IEC 42001 for two years, runs the "Sofia" fraud-scoring model, retrained monthly since a January architecture change. During surveillance you find: the AI risk assessment, scheduled for annual review, still describes the pre-January architecture; the risk treatment plan lists six actions with target dates between March and June, all now overdue; July top-management minutes record acceptance of residual risk for three of those risks; the AI system impact assessment for Sofia dates from the original design and has not been repeated; and one treatment action depends on a data-processing agreement with a new vendor that is still unsigned, although the vendor has supplied training data since April.

839 words, about 4 min