ISO 42001 Lead Auditor key terms

An engineered system that produces outputs such as predictions, recommendations, content or decisions for a defined set of objectives, typically by inferring patterns from inputs using models, rules or learned parameters.

The set of interrelated policies, processes, roles and resources an organization uses to direct and control its work with AI, structured in ISO/IEC 42001 by requirements in clauses 4 to 10.

The effect of uncertainty on objectives arising from AI systems, covering potential harms to individuals, groups, society and the environment as well as missed opportunities.

The combined properties, such as safety, security, privacy, fairness, transparency, explainability, robustness and accountability, that determine whether an AI system's behaviour is acceptable in its context of use.

A documented statement of top management's intentions, direction and commitments for AI, providing the framework for setting AI objectives and for responsible development and use.

A person or organization that can affect, be affected by, or perceive itself to be affected by the organization's AI activities, such as users, affected communities, customers and regulators.

The internal and external factors, including legal, ethical, social, technical and market conditions, that are relevant to the organization's purpose and influence how its AI management system must be designed.

The documented boundaries of the AI management system, stating which AI systems, processes, sites and organizational units are covered and justifying any exclusions.

A process that identifies, analyses and evaluates risks connected with AI systems across their life cycle, so the organization can judge which risks need treatment and which are acceptable.

A structured evaluation of the potential consequences of an AI system for individuals, groups, society or the environment, used to decide whether the system should be developed, deployed or continued.

Selecting and applying measures that modify AI risk, such as implementing controls, avoiding the activity, sharing the risk or accepting it, and recording the resulting residual risk.

A controlled document listing the Annex A controls the organization considers applicable, giving reasons for including or excluding each one, and recording the status of implementation.

A requirement from the normative annex of ISO/IEC 42001, addressing themes such as AI policy, internal organization, resources, impact assessment, life cycle, data, information for interested parties and third-party relationships.

The stages an AI system passes through, from conception and development through verification, deployment and operation to decommissioning, each requiring planned controls and reviews.

Controls ensuring data used for AI is relevant, accurate, complete, representative and lawfully obtained, with records of its origin and processing so results can be explained and defended.

A measurable result the organization intends to achieve in relation to AI, consistent with the AI policy and set for relevant functions and levels with defined responsibility and timeframe.

A planned, independent examination of the AI management system against the organization's own criteria and ISO/IEC 42001, carried out to show whether the system conforms and works effectively.

Top management's periodic evaluation of whether the AI management system remains suitable, adequate and effective, based on defined inputs and leading to decisions on improvement and resources.

A systematic, independent and documented process for obtaining objective evidence and evaluating it against agreed criteria to determine how far requirements are met.

The requirements and references against which audit evidence is compared, such as ISO/IEC 42001, the organization's AI policy, its procedures and applicable legal or contractual obligations.

Records, statements of fact or other verifiable information relevant to the audit criteria, collected through interviews, observation, document review and testing of systems.

The outcome of comparing collected evidence with audit criteria; findings record conformity or nonconformity and may be graded by severity and by the risk they represent.

The auditor's professional judgement summarizing how far the audit objectives were met, including overall conformity, effectiveness of the management system and the significance of findings.

The condition of being free from bias, conflicts of interest and pressure so that judgements rest only on evidence; auditors avoid auditing work for which they were responsible.

The combination of education, training, audit experience, AI-related knowledge and personal behaviour that enables an auditor to reach reliable and defensible conclusions.

The possibility that an audit reaches an inappropriate conclusion, together with the consequence of that error; it guides planning, sampling and the depth of evidence gathering.

A statement of what a particular audit is meant to achieve, such as judging conformity with ISO/IEC 42001 or the effectiveness of the AI management system, and it drives scope and criteria.

The agreed boundaries of a specific audit: the organizational units, AI systems, processes, locations and period to be covered, together with any stated limitations.

The description of how a specific audit will be carried out, covering objectives, criteria, scope, schedule, team roles, sampling approach and reporting arrangements.

Records the audit team keeps of evidence collected, tests performed and interim conclusions, providing the basis for the report and proof that the audit followed its plan.

A meeting at the start of the audit to confirm the plan, scope, criteria, communication channels and reporting method with the auditee's management and process owners.

A failure to meet a requirement of the audit criteria, supported by evidence; it is graded major or minor according to its effect on the management system's ability to achieve intended results.

A finding that is not a nonconformity but identifies a weakness or a better practice that could reduce risk or raise the effectiveness of the AI management system.

Selecting fewer than all items from a population of records, systems or activities to draw conclusions about the whole, using a documented and risk-proportionate approach.

The meeting at the end of the audit where findings and conclusions are presented, their evidential basis explained, and timescales for corrective action discussed with the auditee.

A documented account of the audit's objectives, scope, criteria, findings and conclusions, issued to the audit client and used as the basis for corrective action and follow-up.

Verification, often after a defined interval, that corrective actions taken in response to findings have been implemented and have removed the underlying cause.

The arrangements for a set of audits planned over a period, including their frequency, methods, responsibilities, resources and reporting, designed to meet a stated purpose.

The person accountable for establishing, resourcing, monitoring and improving the audit programme, including assigning auditors who are competent and free from conflicts of interest.

A periodic audit conducted after initial certification or during an ongoing programme to confirm that the management system continues to conform and remains effective.