Managing an ISO/IEC 42001 audit program
Programme, not plan
The audit programme is the set of audits planned over a period, with its own objectives, risks, resources and performance measures. ISO 19011 clause 5 gives the cycle: establish objectives → identify risks and opportunities to the programme → establish the programme (frequency, duration, methods, criteria, responsibilities) → implement → monitor → review → improve. ISO/IEC 42001 clause 9.2 requires the internal audit programme to be planned, taking account of the importance of processes and previous results.
Design inputs: the AIMS scope; the AI system inventory and criticality; legal, regulatory and contractual obligations; incidents and complaints; risk and impact assessment results; previous audit results and open corrective actions; organizational change, new or retired AI systems, and model retraining cycles; available auditor competence and technical experts; and remote versus on-site feasibility, including access to systems and data.
Implement: schedule audits, assign competent auditors with attention to independence, provide resources and work documents, and control records.
Monitor and measure: plan completion, timeliness of corrective action closure, recurrence of findings, coverage of AI systems and clauses across the cycle, and auditor performance and competence development. Feed results into management review (clause 9.3) and adjust the programme.
Combine sensibly: integrated audits with ISO/IEC 27001 or ISO 9001 save effort, but AI-specific controls - data, impact assessment, lifecycle - still need sufficient time. Combined does not mean compressed.
Traps: presenting an audit plan as an audit programme; building a programme that never reaches high-risk AI systems because it repeats a comfortable checklist; using the same auditor for years without refreshing AI competence; omitting risks to the programme itself, such as auditor unavailability or refused access to model documentation.
Rule of thumb: programme = what, when, who and why over a cycle; plan = one audit. If a question concerns coverage across a year, resources or competence, it is asking about the programme.