ISO 42001 audit preparation: a six-week plan

Good preparation for the ISO 42001 audit starts six weeks before the audit date. In that period you make sure your documents are complete, that your internal audit has taken place and that staff know what to expect. Use the checklist per requirement for this. The auditor assesses your system based on what they see and hear, so the preparation largely determines the result. The audit process itself follows fixed steps that you can learn in advance.

What the auditor wants to see

The certifying body carries out its assessment in two stages. In the first stage it checks whether the documentation is complete. In the second stage it tests whether the system works in practice. These two stages require different preparation. Read the audit process for the details of each stage.

In practice, an auditor looks for three things: whether the policy exists, whether the policy is followed, and whether you learn from it. Keep these three questions in mind when you build the plan below.

The plan per week

Week 6: check the inventory and scope. Go through the AI register and check that every system is within scope. Also check whether any new systems have been added since the last analysis. A system missing from the register is an error you will quickly encounter in audits.

Week 5: bring documents up to date. Check each document for the correct version and date. The policy, the risk analyses and the statement of applicability must describe the current situation. Documents that have not been updated after the last change are a common finding.

Week 4: internal audit and nonconformities. Carry out the internal audit if it has not yet been done, or check the report if it already exists. List all open nonconformities with a status and an owner. An open nonconformity is not a problem, but a nonconformity without a plan is. Read internal audit for ISO 42001 for the approach.

Week 3: prepare staff. Give a short briefing to the staff who will be interviewed during the audit. They do not need to know the standard, but they must know what their role in the system is and where the evidence is kept. See the section on interviews below.

Week 2: mock audit. Have someone who did not set up the system carry out a mock audit. That person asks questions and asks for evidence. Note everything that cannot be found directly. That is your list for the final week.

Week 1: final check and logistics. Make sure the documents are ready in a place you can open during the audit. Confirm the agenda with the auditor. Arrange a room, a contact person and a moment when you can discuss the findings.

Documents that must be ready

This list is not complete, but these are the documents that are requested in almost every audit. For the full documentation see documentation for ISO 42001.

An extra tip: make a short table of contents for your document folder for the auditor. Then they can find what they are looking for quickly and do not have to ask where something is.

An example audit agenda

An auditor sets their agenda in advance. Below is a fictional example for an organisation with one AI system. Ask the auditor for the exact schedule, as it differs per certifying body.

Interviews with staff

The auditor talks to people, not only to documents. Prepare staff for three questions: what do you do with the AI system, where is the evidence, and what do you do if something goes wrong. Do not let them answer from memory. Point them to the document instead.

Tell staff that “I don’t know, I need to look that up” is an honest answer. An invented answer is much worse. See also common mistakes for what auditors often see as careless.

After the audit

After the audit you receive a report with findings. Major and minor findings have different deadlines; read about these in the section on the audit process. Plan a short evaluation with the team straight after the audit. What went well, what did not, and what will you take into the next surveillance audit?

If you want to prepare for the full assessment, look back at the checklist per requirement. That checklist is a good basis for the week before the audit.

Common doubts

May I ask the auditor for an introductory call beforehand? That is common, especially for a first certification. Ask what the auditor wants to see and what they expect from the planning. Keep to procedural questions and do not ask substantive questions that steer the audit itself.

What if the mock audit reveals major gaps? Then you move the date or prioritise the gaps. An audit postponed by a week is better than an audit that ends with open major findings. Discuss this with the certifying body.

Does management have to attend the audit? Management is usually present at the opening meeting, because leadership is a requirement. Make sure someone with decision-making authority is there, even if the rest of the day is spent with the project leader and the owners.

Can I still change the documents just before the audit? Small corrections that you can explain are fine. A policy that is suddenly rewritten in the week before the audit is visible to the auditor. That often leads to questions about actual practice.

How do I deal with a critical auditor? Stick to the facts, refer to the evidence and note questions you cannot answer immediately. A finding is not a personal attack, and a conversation based on evidence is often quicker than a discussion.

Further reading

• The ISO 42001 audit process
• Certifying bodies for ISO 42001
• ISO 42001 certification step-by-step plan
• Frequently asked questions about ISO 42001