Effivity ISO 42001: how the software runs your AI management system, from inventory to audit

What an AIMS auditor looks for when the system runs in software

An ISO/IEC 42001 auditor does not test the tool. They test whether three mechanisms work together: the AI risk assessment, the risk treatment with its Statement of Applicability, and the impact assessment for each AI system. The quickest test is to follow one system from your inventory. Who owns it? Which risks were identified for it, and what treatment was chosen? Does the Statement of Applicability agree with that treatment? When the model was last retrained, was the impact assessment looked at again?

Where these records live in separate spreadsheets and slide decks, that trail usually breaks at the first change. The inventory lists a system the risk register has never heard of, or the impact assessment still describes the version from a year ago. Clauses 8.2 and 8.4 expect both assessments to be repeated at planned intervals or when significant change happens, so a stale record is a finding, not a formality.

Running the AIMS in Effivity means the inventory entry, the risks, the controls, the impact assessment and the reviews are held in one system with owners, dates and version history. The auditor pulls a thread and your system owner shows them the whole chain.

Effivity ISO 42001 modules: clauses 4 to 10 and Annex A

The table shows where each part of the AIMS is kept and the record it leaves behind. Module names follow Effivity's own; where no dedicated module exists for an AI-specific requirement, the record is a register or form configured during set-up.

A worked trace: a retrained screening model

A recruitment firm uses a CV-screening model supplied by a vendor. The vendor announces a retrained version. The system owner logs the change against the system in the inventory, which flags that the risk and impact assessments are due for review. The impact assessment is revisited with the HR lead: does the new training data change who could be disadvantaged? One new risk is added to the register, a control for pre-deployment validation is confirmed in the treatment plan, and the supplier record is updated with the vendor's release notes. When the auditor samples that system, the dates line up: change, reassessment, treatment, approval.

What is configured at the start of a Sterling engagement

Effivity is set up in the first weeks, while the gap analysis is under way, so the workshops write straight into the system rather than into documents that are typed up later.

• The inventory first. The AI system register is built with the functions that own each system, including tools bought in, so scope and ownership are visible before any assessment starts.
• Your risk criteria. Likelihood, consequence and acceptance levels are set in Risk Management so that repeated assessments give consistent, comparable results, as clause 6.1.2 asks.
• The impact assessment form. Its fields follow your method: intended use, foreseeable misuse, the individuals, groups and societies affected, and the jurisdictions involved. AI system impact assessment, with ISO/IEC 42005 covers the method itself.
• Roles and reminders. System owners, approvers and reviewers are named, and review dates are set so reassessments surface before they fall overdue.
• The project plan. Milestones from the gap analysis are tracked with owners, so management sees progress directly.

How risks are identified and treated is explained in ISO/IEC 42001 AI risk assessment and treatment, with ISO/IEC 23894; this guide deals only with where the results are kept.

AI systems that keep changing

Models are retrained, data sources altered and vendor versions replaced, so an AIMS that records only the state at certification ages within months.

In Effivity each change is logged against the system it affects, with a named owner and a due date for the reassessment it triggers. Dashboards show which systems have assessments overdue and which treatments are still open, and reminders escalate what nobody picked up. Incidents, including a complaint about an AI output, are recorded with their response and communication, and a recurring cause becomes a nonconformity with a corrective action and an effectiveness check.

Organisations already running ISO/IEC 27001 in Effivity usually extend the same system: document control, supplier records, audits and corrective actions are shared, and the AI registers are added. ISO/IEC 27001 to ISO/IEC 42001: extending an ISMS into an AIMS explains that route.

Internal audit, surveillance and Sustain™

Before the certification body's Stage 1 readiness review, the internal audit covering clauses and controls is planned and reported in the Internal Audit module, and the management review is minuted in Management Review. Findings become nonconformity records and are closed with evidence before Stage 2. The audit method is set out in ISO/IEC 42001 internal audit: auditing an AI management system, and the review itself in ISO/IEC 42001 management review: inputs, outputs and the record.

After certification, the body returns for surveillance audits every year and for recertification in the third year. Surveillance looks for continuity: reassessments done when systems changed, audits held, reviews completed, actions verified. Under Sustain™, Sterling continues internal audits and system upkeep in the same Effivity system as new AI systems enter scope.

What Effivity does not do

Effivity holds the AIMS; it does not make its judgements. Whether a risk is acceptable, whether an impact on a group of people is significant or whether a control can be excluded remains a decision for your designated management, who must explain it to the auditor. Nor does it test models or monitor outputs; it records that those checks happened and what they found.

• An inventory nobody updates. A system missing from the register is outside every other record, and auditors often find one in an interview.
• Impact assessments filled once. A form completed at set-up and never revisited contradicts the change log.
• A Statement of Applicability detached from the register. Controls marked as implemented with no risk or treatment behind them are hard to defend.

Effivity for ISO/IEC 42001: questions buyers ask