Conducting an ISO/IEC 42001 audit
Evidence, then findings
Open with a meeting confirming scope, criteria, schedule, methods, communication channels and confidentiality. Then collect evidence through interviews, observation of work as performed, and record review. For an AIMS, typical evidence includes the AI system inventory and system-level documentation; dataset provenance, quality checks and consent or licensing records; model evaluation and validation results; logs of human oversight and override; incident and complaint records; impact assessments and the decisions taken on them; supplier due diligence for third-party models; training and awareness records; and monitoring dashboards.
Verify: evidence must be relevant, sufficient and objective. Triangulate - a procedure statement plus an interview plus a sampled record. An auditee's assertion ("we always assess impact before deployment") is a lead, not objective evidence, until you sample deployments and confirm.
Record who, what, where, when and the record or system identifier. This makes findings defensible and traceable.
Form findings against criteria and grade defensibly. A systemic absence or a breakdown raising significant doubt about the AIMS's capability is a major nonconformity; an isolated lapse inside an otherwise working process is minor; an improvement suggestion is neither.
Behave professionally: no consulting, no prescribing solutions, no leading questions, no arguing. Handle obstruction by escalating to auditee management and the audit client, and document it.
Throughout, hold short team meetings, track progress against the plan, redistribute time when a trail proves richer than expected, and keep the auditee representative informed.
Trap: writing "no evidence of X" when the truth is "we did not ask for X". Record what you sampled and what you found.
Rule of thumb for wording: requirement (clause or control) → evidence observed → gap.