Stage 1 at a Hospital: Readiness, a Stale Management Review, and a Vendor's Certificate

Stage 1 evaluates the documented AIMS, the organisation's understanding of its own scope and risks, and whether internal audit and management review have actually been performed - enough to judge readiness and to plan stage 2. It does not verify conformity in depth.

Reasoned conclusion: readiness is not demonstrated.

• Internal audit excluded clauses 7, 9 and 10, so the system has never been audited as a whole; the requirement for a complete audit programme is unmet on the evidence available.
• The management review is eleven months old and its agenda omits the status of risk treatment actions - a required input. Recency and content both need testing.
• A triage tool used on patients with no impact assessment is a high-risk indicator for stage 2, not something to leave unmentioned.
• Whether the CIO's approval of the policy satisfies the top-management requirement depends on establishing where top management sits in this hospital; that is a stage 2 question but must be flagged.

Recommendation. Record these as areas of concern in the stage 1 report, state plainly that major nonconformities are likely at stage 2, and either proceed with a stage 2 plan weighted to clauses 5, 9 and 6.1.4, or recommend postponement until internal audit and management review have run over the full system. Do not tell the hospital how to remediate - that is consultancy. The regulator's expectation is irrelevant to the recommendation.

The vendor's certificate is not audit evidence of the hospital's conformity. It evidences the vendor's management system, not the hospital's control over the tool it operates, and it cannot be extended to cover the hospital's use, oversight, data handling or incident response.

What it legitimately is: one input the hospital may use in its own supplier evaluation, and a factor that can inform - but not reduce - the audit team's assessment of risk in that area.

Planning consequences for stage 2:

• Verify the hospital's supplier selection, contracting and performance-monitoring controls against its third-party relationship requirements, including who is accountable for model updates.
• Ask for the contract terms on model change notification, training-data provenance, bias testing evidence, incident notification and audit rights.
• Sample the hospital's own monitoring records: overrides of triage recommendations, escalation rates, clinician feedback, downtime.
• If the vendor is audited at all, it is to test the hospital's control over the externally provided process - not to re-audit the vendor's management system.

Conclusion to record: reliance on the supplier certificate as a substitute for the hospital's own controls would itself be a finding; as a planning input, it changes emphasis, not scope.

Sampling here must be risk-based, not convenience-based. The tool acts on patients continuously, so a sample drawn from office hours would misrepresent the system.

Proposed sampling logic:

• Time coverage: night shifts, weekends and peak-demand periods, where workarounds and overrides concentrate; shift handover records.
• Population coverage: all recorded overrides or downgrades of triage priority in the period, plus cases where the tool's output was not available; small populations should be examined completely rather than sampled.
• People: clinicians who actually use the output, not only the project sponsor; the accountable clinical lead; the person who approves model updates.
• Records: training and competence of users, incident and near-miss logs, monitoring metrics against defined thresholds, and the evidence that results were analysed and acted on.
• Change events: every model or configuration change during the period, since impact assessment and risk review should have been triggered.

Justification. Selection follows risk of harm to patients, frequency of use and variability of conditions. The plan must state the populations, the rationale, and what an exception would mean, so that any conclusion drawn from the sample can be defended as representative rather than anecdotal.