Preparing an ISO/IEC 42001 audit
From programme to plan to working documents
Initiate: confirm feasibility and access - people, sites, systems and records, which for AI includes model documentation, dataset and provenance records, evaluation results and third-party arrangements. Establish contact with the auditee and confirm objectives, scope and criteria. The audit scope must be consistent with the AIMS scope, and exclusions must be stated explicitly.
Document review before the audit shapes the plan; it is not by itself evidence of conformity. Review the AIMS scope, AI policy, AI risk assessment and impact assessment results, statement of applicability, objectives, internal audit and management review outputs, corrective action records and prior reports. What looks thin or contradictory in documents becomes an area for deeper sampling on site.
Plan by risk: identify where AI risk concentrates - number and criticality of AI systems, high-impact or high-autonomy uses, reliance on third-party models or data, incidents, recent model changes, new deployments, weak areas from earlier audits - and allocate time there before mapping activities to clauses and Annex A areas.
The audit plan contains objectives, scope, criteria, dates and locations, participants, team roles, time allocation, meetings and deliverables. Work documents (checklists, sampling plans, record forms) support the audit; they are aids, not scripts, and may be adapted when evidence demands.
Competence: the team needs audit skills plus AI knowledge - data quality, model lifecycle, human oversight, impact assessment - provided by team members or technical experts, who advise but do not audit independently.
Trap: a "plan" listing clause numbers with no objectives, criteria or risk rationale; or last year's plan reused unchanged despite a newly deployed generative AI system.
Rule of thumb: every planned activity should trace to a requirement or an identified risk. If it traces to neither, cut it.