Closing an ISO/IEC 42001 audit
Findings, report, follow-up
Consolidate findings, remove duplicates, check each against its criterion, and derive conclusions that answer the audit objectives: is the AIMS conforming, effectively implemented and maintained? State clearly where sampling limits confidence.
Closing meeting: present findings and conclusions, ensure the auditee understands each finding and its evidence, and agree factual accuracy and timelines. Agreement on the facts is sought; agreement on grading is not required. Never promise, imply or predict certification - that decision belongs elsewhere.
Report content: objectives, scope (including exclusions), criteria, dates and locations, audit team, findings with evidence and clause references, conclusions, and a statement on sampling. Distribution and retention follow the audit programme and confidentiality rules. Internal audit results go to top management and to the managers responsible for the area.
Corrective action: distinguish correction (fix the instance) from corrective action (remove the cause so it does not recur, clause 10.2) and from verification of effectiveness (evidence the fix held over time). For AI systems, a root cause that stops at "operator error" is usually incomplete - look at data, model change control, deployment gates, monitoring and competence.
Certification context: nonconformities are typically closed within a defined period (commonly up to 90 days for major ones, verified before certification); surveillance occurs at least annually; recertification precedes the end of the three-year cycle. Decisions on certification, suspension or withdrawal are taken by a competent person or committee independent of the audit team.
Traps: treating a signed-off correction as closure of a major nonconformity; letting the same auditor verify actions and make the certification decision; a report that lists nonconformities but contains no conclusion.
Rule of thumb: ask what systemic cause was removed, and what would show it stayed removed.