ISO 42001 Lead Auditor flashcards
ISO 42001 Lead Auditor · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- AI management system
- A set of interrelated or interacting elements of an organization, including policies, objectives, processes and resources, used to plan, implement, maintain, review and improve the management of AI.
- AI system
- An engineered system that generates outputs such as predictions, content, recommendations or decisions for a given set of objectives, and that operates with varying levels of autonomy.
- AI system impact
- The effect of an AI system on individuals, groups of people, organizations, society or the environment, which may be positive or negative and is assessed across the AI system life cycle.
- Harmonized structure
- The common clause structure from clause 4 to clause 10 shared by ISO management system standards, which allows ISO/IEC 42001 to be integrated with standards such as ISO 9001 or ISO/IEC 27001.
- Annex A control objectives
- The nine normative control objectives in ISO/IEC 42001, labelled A.2 to A.10, covering policy, internal organization, resources, impacts, life cycle, data, information, use and third-party relationships.
- Statement of Applicability
- A documented statement listing the Annex A controls the organization applies and those it excludes, with justification for each exclusion and for the inclusion of each control.
- AI policy
- Top management's documented intentions and direction for AI, including objectives, commitments to applicable requirements and continual improvement, and a framework for setting AI objectives.
- AI risk assessment
- A process that identifies, analyses and evaluates risks related to AI systems and their use, defines and applies risk criteria, and retains documented information of the results.
- AI system impact assessment
- A structured analysis of how an AI system may affect individuals, groups and society, including potential harms, benefits and mitigations, used to decide whether and how to proceed.
- Management review
- A planned top-management review of the AI management system at defined intervals, considering inputs such as audit results, risks, impacts and performance and producing decisions on improvement and resources.
- Audit
- A systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine the extent of conformity.
- Audit criteria
- The set of requirements, policies, procedures or standards used as a reference against which audit evidence is compared, such as ISO/IEC 42001 and the organization's own AIMS documents.
- Objective evidence
- Data, records or statements of fact about the AIMS that can be verified and that supports an audit finding or conclusion, gathered through interviews, observation and document review.
- Nonconformity
- A failure to meet a requirement of the audit criteria, recorded by the auditor with the requirement, the supporting evidence and a statement of the gap, and requiring correction by the auditee.
- Audit principles
- The seven principles of ISO 19011: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach.
- Audit plan
- A description of the activities and arrangements for a single audit, including objectives, criteria, scope, dates, sites, audit team, schedule and allocation of time.
- Stage 1 audit
- The first part of an initial certification audit, which reviews documented information and the organization's readiness for stage 2 and may identify areas of concern.
- Audit scope
- The extent and boundaries of an audit, such as the organizational units, locations, processes, AI systems and time period covered, agreed with the client and stated in the plan.
- Audit sampling
- Selecting less than the full population of items to obtain information about that population, using judgemental or statistical methods, with results not automatically generalizable.
- Opening meeting
- A meeting at the start of the audit at which the audit team confirms the plan, scope, criteria, communication channels, working arrangements and nonconformity handling with the auditee's management.
- Audit trail
- The sequence of records and evidence that lets an auditor trace how data, decisions or outputs were produced and verified, for example from an AI system's input data to its output.
- Major nonconformity
- A nonconformity that affects the capability of the management system to achieve its intended results, such as a missing required process, a systemic failure or a breach of legal requirements.
- Evidence triangulation
- Confirming an audit finding by obtaining consistent evidence from at least two independent sources, for example an interview, a document review and direct observation of the activity.
- Audit team meeting
- A working meeting of auditors during the audit to exchange evidence, review progress against the plan, align findings and decide whether to adjust the audit scope or time.
- Closing meeting
- A meeting at the end of the audit where the team presents findings, nonconformities, conclusions and recommendations and explains the reporting and follow-up arrangements to the auditee.
- Audit report
- A documented summary of the audit containing objectives, scope, criteria, team, dates, findings, conclusions and, where applicable, a statement on the conformity of the management system.
- Certification decision
- A decision on granting, maintaining, suspending or withdrawing certification, made by the certification body independently of the audit team based on the audit report and related information.
- Follow-up audit
- An audit or verification activity carried out after corrective actions have been implemented to confirm that nonconformities have been effectively resolved and that the management system remains conformant.
- Audit programme
- A set of one or more audits planned for a specific time frame and directed towards a specific purpose, including the arrangements, resources and schedules for the organization's AIMS audits.
- Surveillance audit
- A periodic audit carried out after initial certification, typically at least once a year, to verify continued conformity and the effectiveness of the certified AI management system.
- Recertification audit
- An audit performed before the expiry of a certification cycle, typically every three years, to evaluate the continuing conformity and effectiveness of the entire management system.
- Audit programme risks
- Uncertainties that could affect achievement of the audit programme objectives, such as auditor competence gaps, scheduling conflicts or auditee availability, which are identified and addressed when managing the programme.