Corrective Action and Certification Readiness After Internal Audit
Volt Energy is preparing for its ISO/IEC 42001 stage 2 certification audit in eight weeks. Its AIMS covers a load-forecasting AI and a customer-churn model. An internal audit four weeks ago raised three minor nonconformities: the AI risk assessment was not updated after the load-forecasting model was retrained on new data, training records were missing for 12 of 60 staff with AI responsibilities, and two supplier contracts for data feeds contain no AI-specific security or incident clauses. There were also five observations, including that the AI policy is not communicated to contractors. The corrective-action plan lists 'update the risk assessment document', 'send reminder to staff' and 'ask procurement to review contracts'. The AIMS manager wants to close the actions by editing documents before the audit and to postpone the management review until after certification. The certification body has asked for the internal audit report, corrective-action evidence and management review minutes.
1. Assess the corrective-action plan. What is wrong with it and what would a root-cause-based response look like for each nonconformity?
Read the worked answer
The plan treats symptoms as documents. 'Update the risk assessment' does not fix why retraining did not trigger a review. The root cause is likely the absence of a change-management trigger linking model changes to risk assessment. Corrective action: define triggers such as retraining, new data source, supplier change or new use; assign responsibility; update the assessment; assess impact; approve and record. A reminder is not training. For the 12 missing records, find the root cause: no competence matrix, no onboarding requirement, or records not maintained. Fix the process, train, verify competence and retain evidence. 'Ask procurement to review contracts' is not a corrective action. Define AI-specific supplier requirements, assess the two suppliers, amend contracts or apply interim controls, and record residual risk acceptance. Each action needs an owner, due date, evidence and effectiveness check. Internal audit should follow up, not the AIMS manager alone. Editing documents before the audit without changing practice is audit theatre and will likely be detected in interviews and sampling.
2. Advise on the timing of management review and the evidence needed for the stage 2 audit. Can the organization proceed in eight weeks?
Read the worked answer
Management review should not be postponed. Clause 9.3 requires review at planned intervals and includes audit results, nonconformities, risk, performance and improvement. The stage 2 auditor will expect that top management has reviewed the AIMS, including the internal audit findings, before the certification audit. Eight weeks can be enough only if the corrective actions are implemented and verified. Evidence should include a revised risk assessment with trigger and approval, updated training records and competence evidence, supplier assessments and contract amendments or accepted risk, internal audit follow-up, and management review minutes with decisions and actions. The organization can proceed if it can show implementation, not just plans. If the actions are only document edits, delay or expect nonconformities. The certification body decides, not the AIMS manager. A pre-audit readiness check should test evidence by sampling. Also check that the scope, Statement of Applicability and objectives are consistent with the changes.
3. How should Volt use the internal audit findings to drive continual improvement rather than audit theatre?
Read the worked answer
Continual improvement means using findings to change the system. Volt should analyse the three nonconformities for common causes: change management, competence and supplier management. Update the risk register and objectives, set metrics for on-time risk reviews, training completion and supplier compliance, and review trends. Communicate lessons to contractors and staff. Verify effectiveness after a period; if the same issue recurs, the corrective action failed. The internal audit programme should follow up and escalate. Management review should track improvement actions. Certification is a milestone, not the goal. The organization should avoid 'closing' actions by editing documents because that teaches the wrong behaviour and leaves risk. A mature response is to record what was learned, update the AIMS and show top-management ownership. If the stage 2 audit finds the same issues, the cost is higher than fixing them now.