ISO/IEC 42011:2023 Organizational Audit Readiness Assessment Checklist
Complete the assessment by selecting the appropriate status for each checkpoint
| CLAUSE | CHECKPOINT ID | AUDIT QUESTION | EVIDENCE REQUIRED | CLIENT ASSESSMENT |
|---|---|---|---|---|
| 4 - Context of Organization | ||||
| 4.1.1 | Internal AI Issues | Are internal AI-related issues (strategy, capability, culture) identified? | SWOT/PESTLE analysis; AI Strategy document; Internal risk register | |
| 4.1.2 | External AI Issues | Are external AI-related issues (regulatory, societal, market) identified? | AI Regulatory landscape report; Legal compliance registry | |
| 4.2.1 | Stakeholder Identification | Are stakeholders affected by AI systems identified and documented? | Stakeholder Register (listing users, developers, affected parties) | |
| 4.2.2 | Stakeholder Expectations | Are stakeholder expectations and obligations assessed? | SLA reviews; Documented stakeholder requirements/obligations | |
| 4.3.1 | AIMS Scope | Is the AIMS scope formally documented and approved? | Formally approved Scope Statement document | |
| 4.4.1 | AI Inventory | Is an inventory of AI systems maintained and current? | Master AI Asset Register (listing models, purpose, and owners) | |
| 5 - Leadership | ||||
| 5.1.1 | Management Accountability | Has top management demonstrated accountability for the AIMS? | Management review minutes; Budget approvals; Org charts | |
| 5.1.2 | AI Governance Integration | Is AI governance integrated into enterprise governance structures? | AI Committee Terms of Reference (ToR); Board meeting notes | |
| 5.2.1 | AI Policy | Is there an approved and communicated AI policy? | Formally signed AI Policy; Proof of staff communication | |
| 5.3.1 | Roles & Responsibilities | Are AI roles, responsibilities, and authorities clearly defined? | Job descriptions for AI roles (e.g., AI Officer, ML Engineer) | |
| 6 - Planning | ||||
| 6.1.1 | Risk Identification | Are AI risks systematically identified prior to deployment? | AI Risk Assessment reports; Risk identification methodology | |
| 6.1.2 | Risk Categorization | Are AI risks categorized (bias, transparency, security, drift)? | Risk Register showing categories for bias, security, and drift | |
| 6.1.3 | Risk Treatment | Are risk treatment actions defined and implemented? | Risk Treatment Plan (RTP) showing mitigation actions | |
| 6.2.1 | AI Objectives | Are AI objectives defined and measurable? | Documented AIMS objectives/KPIs (e.g., 99% uptime, <1% drift) | |
| 6.3.1 | Change Management | Are changes to AI systems assessed for risk impact? | Change Request logs; Impact analysis for model updates | |
| 7 - Support | ||||
| 7.1.1 | Resource Allocation | Are sufficient resources allocated to operate the AIMS? | Resource planning docs; GPU/Cloud budget; Staffing plan | |
| 7.2.1 | Competence | Are AI personnel competent based on training and experience? | CVs; Training certificates; AI competency matrix | |
| 7.3.1 | Awareness | Are staff aware of AI policies and obligations? | Attendance records from AI awareness sessions; Signed policies | |
| 7.4.1 | Communication | Is AI-related communication defined internally and externally? | External/Internal communication strategy; Stakeholder notices | |
| 7.5.1 | Document Control | Is documented information controlled and maintained? | Document Register; Version history records for all policies | |
| 7.5.2 | Data Governance | Is data governance enforced for AI training and inference data? | Data Management Policy; Data lineage diagrams | |
| 7.5.3 | Third-Party Services | Are third-party AI services risk assessed and approved? | Vendor Risk Assessments; AI-specific clauses in vendor EULAs | |
| 8 - Operation | ||||
| 8.1.1 | AI Lifecycle | Is there a defined AI system lifecycle? | MLOps/SDLC workflow diagram; AI development SOPs | |
| 8.1.2 | Development Controls | Are AI design and development activities controlled? | Code review logs; Model architecture specs; Design sign-offs | |
| 8.2.1 | Human Oversight | Are human oversight mechanisms defined and implemented? | Human-in-the-Loop (HITL) procedures; Override logs | |
| 8.3.1 | Assumptions & Limitations | Are AI system assumptions and limitations documented? | Model Cards; Technical whitepapers listing constraints | |
| 8.4.1 | Validation | Are AI systems validated before deployment? | Validation/Test reports; UAT sign-offs; Accuracy metrics | |
| 8.5.1 | Operational Monitoring | Are AI systems monitored during operation? | Monitoring Dashboards (e.g., Grafana); Drift alerts; Uptime logs | |
| 8.6.1 | Decommissioning | Is AI system decommissioning controlled and documented? | Retirement procedure; Data deletion logs for retired models | |
| 9 - Performance Evaluation | ||||
| 9.1.1 | KPIs & Metrics | Are AI KPIs and performance metrics defined? | List of AI metrics (Precision, Recall, F1 score, Latency) | |
| 9.1.2 | Performance Monitoring | Is AI system performance regularly monitored and reviewed? | Monthly/Quarterly Performance Review Reports | |
| 9.2.1 | Incident Logging | Are AI incidents logged, investigated, and escalated? | Incident Management Log; Hallucination/Safety failure logs | |
| 9.2.2 | Corrective Actions | Are corrective actions taken after incidents? | Root Cause Analysis (RCA) reports; Remediation tickets | |
| 9.3.1 | Management Review | Does management periodically review the AIMS? | Management Review Meeting (MRM) agendas and minutes | |
| 9.3.2 | Review Inputs | Are audit results and KPIs inputs to management review? | Internal Audit Reports; KPI summary decks for management | |
| 10 - Improvement | ||||
| 10.1.1 | Nonconformity Identification | Are nonconformities identified and documented? | Nonconformity Register; Audit finding trackers | |
| 10.1.2 | Root Cause Analysis | Is root cause analysis performed for AI issues? | RCA reports (Fishbone/5-Whys) for systemic issues | |
| 10.2.1 | CAPA Implementation | Are corrective actions implemented and tracked? | CAPA (Corrective Action) log showing status of implementation | |
| 10.3.1 | Continual Improvement | Is continual improvement of the AIMS demonstrated? | Service Improvement Plan (SIP); Evidence of model versioning | |
4 - Context of Organization
Are internal AI-related issues (strategy, capability, culture) identified?
Evidence Required:
SWOT/PESTLE analysis; AI Strategy document; Internal risk register
Assessment:
Are external AI-related issues (regulatory, societal, market) identified?
Evidence Required:
AI Regulatory landscape report; Legal compliance registry
Assessment:
Are stakeholders affected by AI systems identified and documented?
Evidence Required:
Stakeholder Register (listing users, developers, affected parties)
Assessment:
Are stakeholder expectations and obligations assessed?
Evidence Required:
SLA reviews; Documented stakeholder requirements/obligations
Assessment:
Is the AIMS scope formally documented and approved?
Evidence Required:
Formally approved Scope Statement document
Assessment:
Is an inventory of AI systems maintained and current?
Evidence Required:
Master AI Asset Register (listing models, purpose, and owners)
Assessment:
5 - Leadership
Has top management demonstrated accountability for the AIMS?
Evidence Required:
Management review minutes; Budget approvals; Org charts
Assessment:
Is AI governance integrated into enterprise governance structures?
Evidence Required:
AI Committee Terms of Reference (ToR); Board meeting notes
Assessment:
Is there an approved and communicated AI policy?
Evidence Required:
Formally signed AI Policy; Proof of staff communication
Assessment:
Are AI roles, responsibilities, and authorities clearly defined?
Evidence Required:
Job descriptions for AI roles (e.g., AI Officer, ML Engineer)
Assessment:
6 - Planning
Are AI risks systematically identified prior to deployment?
Evidence Required:
AI Risk Assessment reports; Risk identification methodology
Assessment:
Are AI risks categorized (bias, transparency, security, drift)?
Evidence Required:
Risk Register showing categories for bias, security, and drift
Assessment:
Are risk treatment actions defined and implemented?
Evidence Required:
Risk Treatment Plan (RTP) showing mitigation actions
Assessment:
Are AI objectives defined and measurable?
Evidence Required:
Documented AIMS objectives/KPIs (e.g., 99% uptime, <1% drift)
Assessment:
Are changes to AI systems assessed for risk impact?
Evidence Required:
Change Request logs; Impact analysis for model updates
Assessment:
7 - Support
Are sufficient resources allocated to operate the AIMS?
Evidence Required:
Resource planning docs; GPU/Cloud budget; Staffing plan
Assessment:
Are AI personnel competent based on training and experience?
Evidence Required:
CVs; Training certificates; AI competency matrix
Assessment:
Are staff aware of AI policies and obligations?
Evidence Required:
Attendance records from AI awareness sessions; Signed policies
Assessment:
Is AI-related communication defined internally and externally?
Evidence Required:
External/Internal communication strategy; Stakeholder notices
Assessment:
Is documented information controlled and maintained?
Evidence Required:
Document Register; Version history records for all policies
Assessment:
Is data governance enforced for AI training and inference data?
Evidence Required:
Data Management Policy; Data lineage diagrams
Assessment:
Are third-party AI services risk assessed and approved?
Evidence Required:
Vendor Risk Assessments; AI-specific clauses in vendor EULAs
Assessment:
8 - Operation
Is there a defined AI system lifecycle?
Evidence Required:
MLOps/SDLC workflow diagram; AI development SOPs
Assessment:
Are AI design and development activities controlled?
Evidence Required:
Code review logs; Model architecture specs; Design sign-offs
Assessment:
Are human oversight mechanisms defined and implemented?
Evidence Required:
Human-in-the-Loop (HITL) procedures; Override logs
Assessment:
Are AI system assumptions and limitations documented?
Evidence Required:
Model Cards; Technical whitepapers listing constraints
Assessment:
Are AI systems validated before deployment?
Evidence Required:
Validation/Test reports; UAT sign-offs; Accuracy metrics
Assessment:
Are AI systems monitored during operation?
Evidence Required:
Monitoring Dashboards (e.g., Grafana); Drift alerts; Uptime logs
Assessment:
Is AI system decommissioning controlled and documented?
Evidence Required:
Retirement procedure; Data deletion logs for retired models
Assessment:
9 - Performance Evaluation
Are AI KPIs and performance metrics defined?
Evidence Required:
List of AI metrics (Precision, Recall, F1 score, Latency)
Assessment:
Is AI system performance regularly monitored and reviewed?
Evidence Required:
Monthly/Quarterly Performance Review Reports
Assessment:
Are AI incidents logged, investigated, and escalated?
Evidence Required:
Incident Management Log; Hallucination/Safety failure logs
Assessment:
Are corrective actions taken after incidents?
Evidence Required:
Root Cause Analysis (RCA) reports; Remediation tickets
Assessment:
Does management periodically review the AIMS?
Evidence Required:
Management Review Meeting (MRM) agendas and minutes
Assessment:
Are audit results and KPIs inputs to management review?
Evidence Required:
Internal Audit Reports; KPI summary decks for management
Assessment:
10 - Improvement
Are nonconformities identified and documented?
Evidence Required:
Nonconformity Register; Audit finding trackers
Assessment:
Is root cause analysis performed for AI issues?
Evidence Required:
RCA reports (Fishbone/5-Whys) for systemic issues
Assessment:
Are corrective actions implemented and tracked?
Evidence Required:
CAPA (Corrective Action) log showing status of implementation
Assessment:
Is continual improvement of the AIMS demonstrated?
Evidence Required:
Service Improvement Plan (SIP); Evidence of model versioning
Assessment: