Continual Improvement and Preparation for an AIMS Certification Audit
Domain 6 covers Clause 10 plus the practicalities of an external audit: the certification cycle, nonconformity handling, and what auditors sample.
Clause 10
- 10.1 continual improvement targets the suitability, adequacy and effectiveness of the AIMS - not just defect repair. Audit results, management review, incidents, monitoring data and changes in context feed back into risk and impact assessment.
- 10.2 nonconformity: react (control and correct), evaluate the need for action to eliminate causes, implement action, review its effectiveness, update the risk assessment if needed, and retain documented information.
Certification mechanics
- Certification bodies work to ISO/IEC 17021-1, with AIMS-specific requirements in ISO/IEC 42006.
- Stage 1 checks readiness: scope, documentation, completed internal audit and management review. Stage 2 tests effectiveness by sampling operation, records and interviews.
- Certificates typically run three years with surveillance audits (commonly annual) and recertification, and major nonconformities generally must be closed before certification.
Worked example
Stage 2 finds a deployed HR analytics tool with no impact assessment, although procedure PR-05 describes the process. Calling this a documentation nonconformity is wrong: the procedure exists, so the failure is implementation - a major nonconformity against Clause 8 and A.5. The credible response chain is containment (suspend the feature or add human decision review), root cause (the change gate lists privacy review but not impact assessment), corrective action (add the impact assessment trigger to the gate and retro-assess the tool), effectiveness check at the next internal audit, and an update to the risk assessment. React, cause, action, effectiveness, risk update - that chain is what earns marks.
Traps that cost marks
- Answering a nonconformity with a new document instead of a cause analysis.
- Believing certification certifies product safety or demonstrates compliance with AI regulation.
- Arriving at stage 1 without internal audit or management review evidence.
- Preparing for surveillance only in the week before the visit rather than maintaining the cycle.