ISO/IEC 42001 guide
ISO 42001 audit questions: what ISO/IEC 42001 auditors ask, who they ask, and the evidence that answers them
Clause by clause: ISO/IEC 42001:2023 requirements: every clause explained →
The questions ISO/IEC 42001 certification auditors put to top management, the AIMS lead, system owners, engineering, data, procurement and HR, the evidence that answers each, the four that catch AI teams out, and how to prepare people without scripting them.
Key points
- An ISO/IEC 42001 auditor usually follows one AI system from the inventory to the supplier agreement, asking the owner of each link for its record.
- The 22 questions below are grouped by who is asked, each paired with the evidence that settles it.
- The hardest questions concern change, third-party models and whether the impact assessment altered anything. Prepare for those first.
- Coach people to explain their own work; never script answers, back-fill records or argue. Sterling's mock audit asks these questions before the certification body does.
How AIMS auditors ask their questions
What does an ISO/IEC 42001 auditor ask? Mostly open questions that make people show how an AI system is governed in practice: which systems are in scope, show me the impact assessment for this one, what changed because of it. Each answer is checked against a record. Certification bodies work to ISO/IEC 17021-1, which recognises three ways of gathering evidence: interviewing people, observing activities, and reviewing documents and records. ISO/IEC 42006 adds requirements for AI management systems.
A typical trail begins with one entry in the AI system inventory and runs through its impact assessment, the risks it raised, the controls chosen for them, the verification record from before deployment, the provenance of the training data and, where the model came from a supplier, the agreement that divides responsibilities. A break anywhere in that chain is where a finding appears. Audit planning and sampling are explained in our guide to ISO/IEC 42001 Stage 1 and Stage 2 audits.
Questions for top management, the AIMS lead and risk owners
These interviews test whether leaders direct the AIMS, and whether the risk register, Statement of Applicability and treatment plan agree.
| Question | Who is asked | Evidence that answers it |
|---|---|---|
| Why ISO/IEC 42001, and what must the AIMS achieve for you? | Top management | Issues and interested parties' requirements, reflected in the AI policy and objectives (clause 4) |
| Which AI systems does the certificate cover, and what is your role for each? | Top management or AIMS lead | The documented scope (4.3) and an inventory naming each system, its owner and whether you develop, provide or use it |
| Which AI objectives have you set, and how are you doing against them? | Top management | Objectives with owners, measures and dates; current results; action where one is off track (6.2) |
| Who approved the risk treatment plan and accepted the residual risk? | Top management | Approval by designated management, recorded against the plan and each accepted residual risk (6.1.3) |
| Show me a decision from your last management review and what came of it. | Top management | Minutes that deal with AI risks, incidents and resources; the resulting action, completed (9.3) |
| How do you decide how serious an AI risk is? | AIMS lead | Risk criteria and a method built so that repeated assessments give consistent, valid and comparable results (6.1.2) |
| Pick one risk and show me how it was treated. | AIMS lead or risk owner | The register entry, the chosen controls, the matching Statement of Applicability line and proof the treatment works (6.1.3, 8.3) |
| Why did you exclude this Annex A control? | AIMS lead | A justification in the Statement of Applicability that agrees with the risk register and your role |
| How can staff raise a concern about an AI system, and what happened to the last one? | AIMS lead | The reporting route, a logged concern and how it was handled (A.3.3 Reporting of concerns) |
| Is climate change a relevant issue for your AI systems? | AIMS lead or top management | A context review showing the question was asked and the reasoning either way (4.1) |
Questions for system owners, engineering, data, procurement and HR
Here the auditor follows individual systems.
| Question | Who is asked | Evidence that answers it |
|---|---|---|
| Show me the impact assessment for this system. Who could be affected, and how? | System owner | A documented assessment of what deployment, intended use and foreseeable misuse could mean for individuals, groups and society (6.1.4) |
| When was it last reassessed, and what triggered that? | System owner | Risk and impact reassessments at planned intervals or after significant change, retained (8.2, 8.4) |
| What is this system for, and how do you prevent other uses? | System owner | The documented intended use and the user information that states it (A.9.4, A.8.2) |
| How was this model verified and validated before release? | Engineering or data science | Acceptance criteria, test results against them and the deployment decision (A.6.2.4, A.6.2.5) |
| How do you know it still performs as intended in operation? | Engineering or operations | Monitoring measures and thresholds, and the action taken on the last alert (A.6.2.6) |
| Which events does the system log? Show me one. | Engineering | Event logs defined for the system, retained and retrievable on request (A.6.2.8) |
| Where did the training data come from, and on what basis do you use it? | Data science | Acquisition and provenance records for each data set (A.7.3, A.7.5) |
| How did you check the data was fit for this purpose? | Data science | Quality criteria, the checks run and their results, and the preparation steps recorded (A.7.4, A.7.6) |
| If this system caused harm, who would you tell, and how? | System owner | An incident communication process and a record of its use or rehearsal (A.8.4) |
| The model comes from a supplier. Who is responsible for what? | Procurement or legal | Agreements that allocate responsibilities, supplier evaluation and monitoring records (A.10.2, A.10.3) |
| Who works on this system, and how do you know they are competent? | HR or AIMS lead | Competence requirements for each role; education, training and experience records |
| What does the AI policy mean for your job? | Any employee in scope | An answer in their own words; awareness records |
The four questions that catch AI teams out
- "Is this every system?" Auditors test the inventory by asking teams which tools they use each day. An unlisted AI feature inside a business application is the usual gap. The answer is a maintenance method, such as a procurement check, not a longer list.
- "Is the version in production the one you assessed?" Models are retrained and prompts rewritten. The auditor compares assessment and deployment dates; a change process that triggers reassessment is the evidence.
- "What did the assessment change?" An impact assessment that found nothing and led to nothing, for a system that shapes decisions about people, invites a closer look. The method is covered in our guide to the AI system impact assessment.
- "You say the supplier handles that. Show me." Responsibility is not transferred by assertion. The agreement and your monitoring of it answer the question; the AI risk assessment and treatment guide explains where supplier risks sit.
How to prepare people without scripting them
The aim is a data scientist who can open the provenance record without help and a director who can explain one risk decision in plain words.
- Walk the trail yourselves. Follow two systems from inventory entry to supplier agreement and repair every missing link.
- Brief by role, then have people explain back. Each team hears what the AI policy and objectives mean for its work and restates it in its own words.
- Teach four habits. Hear the whole question, answer it and stop, show rather than describe, and say "I would check" when that is the truth.
- Settle the logistics. Guides, the timetable and how restricted records will be viewed.
What not to do in front of the auditor
- Recited answers. Identical wording from every engineer prompts a request for last month's example, which no script covers.
- Impact assessments written in the final fortnight. Ten assessments carrying the same date, for systems in production for a year, turn a missing record into a question of integrity.
- Steering the sample. The auditor chooses which system to follow. A weakness disclosed with its corrective action under way shows the AIMS working; one hidden and found undermines the rest.
- Arguing. Disagree calmly, with evidence, while the auditor is still on site. The certification body has an appeals process; our guide to ISO/IEC 42001 nonconformities explains how findings are graded and challenged.
How Sterling's mock audit works
After your internal audit and management review, Sterling's expert and experienced consultants run a mock audit as a certification audit is run: plan, opening meeting, interviews from the boardroom to the data team, system trails, closing meeting.
The difference: every finding is graded as a certification body would grade it and closed with evidence before the real audit, and each person hears how they answered, so coaching replaces scripts.
How Sterling prepares your AI teams
The first hard questions come from us, not the certification body.
The mock audit is planned from the gap analysis, and its findings and closure evidence sit in Effivity, included with the engagement at no additional cost. We ensure successful certification for our clients. The independent, accredited certification body you choose audits and decides; Sterling does not certify.
Book a free discovery callISO/IEC 42001 audit questions: questions buyers ask
Will the auditor want to see our model code or training data?
Usually the auditor asks for records that prove the controls operate, such as test results and logs, rather than the model itself. If some records cannot leave a controlled environment, agree with the certification body before the audit how they will be viewed.
Are the audit questions different if we only use AI and do not develop it?
Yes, the weight shifts. Expect more on intended use, supplier responsibilities, user information and monitoring, and fewer on design and training data where those controls are justifiably excluded in your Statement of Applicability.
Will auditors interview our engineers and data scientists?
Yes. Anyone within the certified scope can be interviewed, and the people who build and monitor the systems hold the life-cycle and data records.
What happens if a system owner gives a wrong answer?
One slip is rarely a finding by itself. The auditor looks for the weakness behind it: if several owners cannot find their current impact assessment, the finding concerns the process, not the person.
Who should guide the auditor during the audit?
Someone who knows the systems and where their records live, can bring people in quickly and stays silent during interviews, usually the AIMS lead. Each auditor normally has a guide unless the audit team leader and you agree otherwise.
More ISO/IEC 42001 guides
Every guide in the ISO/IEC 42001 series is written for one question and links back to the hub for the whole picture.
- AI system impact assessment, with ISO/IEC 42005
- AI impact assessment
- ISO 42001 risk assessment and treatment
- ISO/IEC 42001 Annex A: the 38 controls explained
- ISO 42001 certification in Australia
- ISO 42001 for banks and financial services
- ISO 42001 benefits
- ISO/IEC 42001 certification process, step by step
- ISO/IEC 42001 certification cost: what moves the price
- ISO/IEC 27001 to ISO/IEC 42001: extending an ISMS into an AIMS
- ISO/IEC 42001 requirements explained, clause by clause
- ISO/IEC 42001 and the EU AI Act: what the certificate does not give
Keep exploring
Explore more about ISO/IEC 42001
Watch a video on how to implement ISO 42001 here.
Watch a video on ISO 42001 requirements here.
ISO/IEC 42001 resources
Services for ISO/IEC 42001
Talk to a consultant
Prepare your AI teams for the ISO/IEC 42001 audit with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice