ISO 42001 Clause 9.2: Audit How the AIMS Works

What clause 9.2 requires in practice

Clause 9.2 requires internal audits that give the organisation reliable information about its AI management system. Clause 9.2.1 sets the purpose: audits take place at planned intervals and establish whether the system conforms to the organisation's own requirements and to the standard, and whether it is effectively implemented and maintained. Clause 9.2.2 sets the machinery: an audit programme covering frequency, methods, responsibilities, planning requirements and reporting, shaped by the importance of the processes and by previous audit results.

For each audit the organisation defines objectives, criteria and scope, chooses auditors and conducts audits so that the process is objective and impartial, and ensures results reach relevant managers. Documented information must exist as evidence that the programme was implemented and of what the audits found. The outputs are a programme, completed audit reports and evidence of reporting upward.

Follow a decision across processes

A useful audit trail can begin with one AI use and follow its scope, assessment, treatment, approval, operation and evaluation. The auditor compares evidence with defined criteria rather than simply checking whether each document exists. This is an illustrative method, not a prescribed universal audit sequence.

The approach can reveal contradictions between processes. A treatment plan may require competent review, while operating evidence shows that reviewers lack the information needed. A complete document index would not resolve that gap.

Why clause 9.2 matters to the business

An internal audit is the cheapest way to discover a problem before a customer, regulator or certification auditor does. It tests whether policies survive contact with real work, particularly in AI, where uses change fast and teams adapt tools informally. A competent, impartial audit gives management an accurate picture without the defensiveness that often accompanies external findings. It also builds internal skill, because process owners learn how to present evidence. Where audit is treated as a rehearsal or paperwork exercise, the business loses that early-warning value and may meet the same weakness again, with more at stake, during an external review.

How to implement clause 9.2

Aim for audits that examine how decisions are actually taken. A practical approach that Sterling teams follow, which the standard does not mandate, is set out below. Expect the first cycle to teach you where evidence is thin, and treat those gaps as useful programme input.

1. Choose audit topics by consequence and change, giving fast-moving AI uses and repeat-finding areas more attention.
2. Write audit objectives as questions, such as whether a changed use passed through the assessment process.
3. Select criteria from your own procedures and the relevant clauses, and state them before gathering evidence.
4. Combine interviews, record review and observation, and adapt the method when remote review cannot show real operation.
5. Appoint auditors who are not marking their own work, and bring in specialist knowledge where the subject needs it.
6. Report findings with the criterion, the evidence and the conclusion, and separate improvement suggestions from nonconformities.
7. Send reports to managers with authority over the process concerned, and keep the programme records.

Illustrative BPO example: the approved purpose changes quietly

Illustrative manufacturing example: a control exists but does not work

A manufacturer requires a second review of uncertain AI inspection results. Records show a reviewer for every sampled case, but discussions reveal that the reviewer receives the same low-quality image that caused uncertainty in the first place.

The auditor examines whether the organisation verified the treatment's effectiveness and responded to known limitations. Specialist input may be needed to understand the evidence. The audit does not itself certify product conformity or replace technical inspection; it examines whether the management-system requirements and arrangements are met.

Connect audit purpose with programme design

Clause 9.2.1 establishes what internal audit needs to tell the organisation. Clause 9.2.2 establishes the programme and individual-audit arrangements. Process importance and previous results inform the programme, while each audit has defined objectives, criteria and scope.

Choose methods and participants appropriate to the question. Interviews, record review and observation can complement one another. Remote access can support some audits, but the method must still provide adequate evidence about the actual activity.

Preserve objectivity and useful expertise

Auditors need to evaluate evidence without inappropriate pressure or self-interest. Where a small team has overlapping roles, design arrangements that protect impartiality. An external specialist can conduct an internal audit on the organisation's behalf; that does not turn it into independent certification.

Audit competence and technical competence can be combined across a team. The auditor need not personally reproduce every specialist evaluation, but should understand enough to judge whether required evaluation occurred and whether conclusions are supported. Do not make claims beyond the available expertise.

Report what the evidence supports

Explore each numbered part

Common nonconformities with clause 9.2

Internal audits of AI governance often show these patterns.

• The audit programme shows dates only, with no link to process importance or previous results.
• Audits check that documents exist and do not follow a real AI use through to operation.
• Auditors review their own design or operating decisions, so impartiality is not protected.
• Findings do not identify the criterion relied on, or opinions are presented as requirements.
• Reports reach the person interviewed but not a manager able to change the process.