ISO 42001 Clause 9.2.1: Define What the Internal Audit Must Establish
ISO 42001 clause 9.2.1 defines the purpose of internal audit. At planned intervals, the organisation obtains information about conformity with its own AIMS requirements and the standard, and whether the system is effectively implemented and maintained. Those are related but distinguishable questions. A process can follow a poorly designed instruction without achieving its intended result.
What clause 9.2.1 requires in practice
Clause 9.2.1 is the purpose statement for internal audit. It requires the organisation to carry out internal audits at planned intervals so that it receives information on two matters. The first is conformity: whether the AI management system meets the organisation's own requirements for it, and whether it meets the requirements of the standard. The second is whether the system is effectively implemented and maintained.
The two questions are related but not identical. A process can follow the organisation's own written rule faithfully while that rule falls short of the standard, and a process can satisfy the standard on paper yet fail to work in practice. The clause therefore gives auditors two sets of criteria and a test of effectiveness. It does not fix an audit date or method; those belong to the programme under clause 9.2.2. The output is audit information management can act on.
Why clause 9.2.1 matters to the business
Management often assumes that if staff follow procedures, the system must be sound. Clause 9.2.1 challenges that assumption by asking whether the procedures themselves are adequate and whether they achieve results. For the business, this is the difference between discovering a design gap early and learning of it from an incident. Clear audit purpose also saves time, because auditors know what they are trying to establish and avoid ticking through long checklists of marginal value. It supports credibility with clients too, since an organisation that tests its own rules against both internal and external criteria can show that it does not merely mark its own homework.
How to implement clause 9.2.1
Define what the audit must tell you before choosing how to gather evidence. The following steps show one way Sterling teams prepare. Spend a little time on this preparation, because vague audit questions produce vague findings that management cannot use.
- Select an important AI decision and write the questions the audit must answer about it, in plain terms.
- List the internal requirements that apply and the clauses of the standard that relate to the same activity.
- Separate conformity questions from effectiveness questions, so each gets its own evidence and conclusion.
- Plan sampling that includes at least one change or exception, not only routine, successful cases.
- Confirm that someone on the team can judge whether required technical evaluation was competently performed.
- Decide how conclusions will be worded so management can see the criterion, evidence and significance.
- After the audit, check whether the findings gave management new information, and refine the questions.
Identify the criteria before judging the evidence
The organisation's own requirements can include approved procedures, policies and operating conditions within the AIMS. ISO 42001 adds the applicable management-system requirements. An auditor needs to know which criterion supports a conclusion, rather than evaluate a process only against personal preferences.
As an original planning exercise, take an important AI decision and write the questions the audit should answer. Was the required assessment performed? Were the approved conditions implemented? Was treatment effectiveness examined? The questions should connect with evidence that can realistically be obtained.
Illustrative IT example: following an incomplete process
An IT provider's internal procedure requires assessment only when a new AI supplier is purchased. Existing teams extend a tool to new customer decisions without review. Staff can show that they followed the written purchasing procedure, but that does not settle conformity with the standard's significant-change assessment requirements.
The audit examines both criteria. It can identify a weakness in the organisation's method rather than incorrectly conclude that compliant staff behaviour establishes complete AIMS conformity. The report should explain the evidence and the relevant requirement clearly enough for management to respond.
Illustrative construction example: a well-written instruction is unused
A construction consultancy has a clear instruction for reviewing AI-generated planning summaries. Interviews and sampled records show that site teams rely on unreviewed summaries because the review route is too slow for their meetings.
The audit examines implementation and maintenance, including the operating conditions that prevent the instruction from being used. It does not need an actual project loss to identify that an established requirement is not fulfilled. Equally, it should not claim that every summary is inaccurate simply because the process has a gap.
Examine effectiveness with a defined purpose
Effectiveness concerns whether planned activities and intended results are realised. A completed review field provides evidence of an activity but may not show whether the review detects the relevant limitation. The auditor examines how the organisation evaluates that result and whether evidence supports the conclusion.
Keep the audit within its expertise and scope. A management-system audit can examine whether competent technical evaluation occurred and informed decisions. It does not automatically provide an independent technical validation of every model or output.
Use planned intervals and meaningful sampling
Clause 9.2.1 does not prescribe a universal annual audit date. The audit programme establishes appropriate arrangements, considering process importance and previous results. A calendar entry is only a plan until the audit is actually performed.
Sampling should provide useful information for the audit's purpose. Selecting only convenient, successful cases can obscure important weaknesses. Consider a relevant change or exception as well as routine work, and explain limits where the available evidence does not support a broad conclusion.
Evidence and common mistakes
Audit results should connect the requirement, evidence and conclusion. Distinguish a supported nonconformity from a suggestion to use a preferred template. Avoid presenting a supplier certificate as proof that the organisation's own use and controls are effective.
Another mistake is treating internal audit solely as rehearsal for certification. Its value is information management can use to improve the system, including concerns that may not fit a simple clause checklist.
Frequently asked questions
Do our own AIMS procedures count as audit criteria?
Yes. Clause 9.2.1 explicitly includes the organisation's own requirements as well as ISO 42001 requirements.
Can a finding exist before an adverse event?
Yes. Evidence that a requirement is not fulfilled can support a finding without waiting for harm or financial loss.
Does an internal audit establish legal compliance?
No. It has defined criteria, scope and evidence limits. It does not provide universal legal clearance or product certification.
Choose the questions your audit should answer
Bring Sterling an AI process whose conformity or effectiveness is uncertain. Scoped audit support can connect criteria, evidence and Effivity ISO & GRC automation software. ISO 19011 Auditing Management Systems develops relevant audit understanding. See the audit guide and the full library.