What ISO 42001 internal audit and management review require before certification
If a customer, contract or regulator now asks for ISO/IEC 42001 certification, your AI management system must already be operating before the certification audit. That means you need an internal audit programme under clause 9.2 and management reviews held by top management under clause 9.3, both run by your organization. An independent certification body reviews that evidence and issues the certificate; it does not run these activities for you, and neither does an implementation partner.
The depth of this work depends on three things: how many AI systems are in scope, how far the AI management system's scope extends across the organization, and how mature your existing governance already is. An organization that already runs an ISO/IEC 27001 internal audit cycle can often extend its auditor pool and review calendar to cover AI. An organization starting from scratch will need to define the audit programme, auditor competence and review inputs before the first cycle. Confirm these points with your certification body early, since its requirements for the programme and records shape what you build.
Clause 9.2.2 asks you to plan the audit programme, covering frequency, methods, scope and reporting, and to select auditors so that the audits are objective and impartial. For guidance on managing that programme and evaluating auditor competence, the newly published *ISO 19011:2026* is the natural next read, since it replaces the 2018 edition. Your internal auditors should not audit work they own, so decide early whether they come from inside the AI teams, the quality function or outside.
How to run the internal audit programme step by step
The sequence turns the AI policy, statement of applicability and clauses 4 to 10 into audit criteria, then produces a programme plan, audit evidence and tracked corrective actions that a certification body can review before stage 1.
Define audit criteria from the AI policy and clauses
Start by listing what the AI management system must do. Build the criteria from the AI policy, the statement of applicability and the requirements in clauses 4 to 10, so each audit question points back to a specific obligation. Owners are the management system lead and the policy owner, with top management confirming the criteria cover the scope set under clause 4.3. The step is complete when every clause has at least one testable criterion and every included Annex A control traces to a criterion. The output is a criteria register that becomes the basis for the checklists.
Set the internal audit programme
Write the internal audit programme as required by clause 9.2.2. It should state the audit frequency, the processes and AI systems covered, the methods used, the responsibilities, and how results are reported and retained. Ground the programme in the scope and the risk picture from the AI risk assessment, so high-impact AI systems are audited at least as often as lower-risk ones. Top management approves the programme. The output is an approved programme plan that defines what will be audited across the cycle.
Select auditors and confirm independence
Assign competent auditors who do not audit their own work. Clause 9.2.2 requires that auditors are selected so the process is objective and impartial. ISO 19011:2026, published on 27 May 2026 as the fourth edition and replacing ISO 19011:2018, sets out guidance on evaluating auditor competence, which you should apply when selecting staff or an outside auditor. Record each auditor's competence and any conflict of interest. The output is an auditor selection record and a documented independence check for each audit.
Prepare the audit plan and checklists
For each audit, write a plan that states the objective, criteria, scope, dates, interviewees and sampling approach. Turn the criteria into checklists that the auditor can work through, including which records to inspect, such as the AI policy version history, impact assessment records and event logs. ISO 19011:2026 guides how the audit is managed from this planning stage. The step is complete when the audit lead has agreed the plan with the auditee. The outputs are the audit plan and the working checklists.
Conduct audits under ISO 19011:2026 principles
Carry out the audit by collecting objective evidence through interviews, record review and observation, and by testing whether the AI management system operates as documented. Apply the audit principles in ISO 19011:2026, including impartiality, evidence-based conclusions and professional judgment. Record what was examined and what was found, including where evidence was sampled. The step is complete when the auditor has reviewed each planned criterion and discussed preliminary observations with the auditee. The output is a set of audit notes linked to the checklists.
Record findings in a findings log
Classify each result as conformity, observation or nonconformity, and log it with the criterion, the evidence reference, the affected AI system and the owner. Keep one findings log for the cycle so trends across audits are visible. Review the log with the management system lead to confirm each finding is accurate and clearly evidenced before it moves on. The output is a maintained findings log that feeds both corrective action and the management review inputs under clause 9.3.2.
Raise nonconformities and track corrective action
For each nonconformity, open a corrective action record under clause 10.2. The record should describe the nonconformity, find the root cause, define the action, name the owner and set the verification method. Actions should address the cause and prevent recurrence, and any change to the AI management system should be reviewed for its effect on other controls. The output is a corrective action register with status for each item.
Verify corrective action and close the loop
Confirm that each corrective action was implemented and that it worked. Use the verification method recorded at the start, such as re-testing the control, re-sampling records or re-interviewing staff. Close a nonconformity only when the evidence shows the requirement is now met. Report the closed and open items in the management review so top management can decide on resources and priorities. The step is complete when the corrective action register shows verified closure or a documented reason for continued follow-up. The output is verified closure evidence that a certification body can inspect.
Who can audit the AI management system without a conflict
Internal audit under ISO 42001 clause 9.2 only produces useful evidence if the people running it are independent of the work they check. The cards below cover who may audit, how competence is judged, and where the certification body's own impartiality rules take over.
Auditors must not audit their own work
The person who built, operated or approved an AI control should not be the one who audits it. Clause 9.2 requires the internal audit to be conducted so that auditors are objective and impartial. Check that each audit assignment names an auditor with no role in the AI system, its data pipeline or its risk decisions under review. If a small team cannot separate these roles, record how the conflict was managed and who approved that arrangement.
Judge auditor competence against ISO 19011
ISO 19011:2026, published 27 May 2026, replaced the 2018 edition and sets out how to evaluate auditor competence. Under the new edition, the organization should define the knowledge and skills an auditor needs for AI management systems, including AI system concepts, risk and impact methods, and clause 9.2 requirements. Keep records showing how each internal auditor met those criteria before assignment.
Keep internal audit separate from certification
Internal audit is the organization's own check on its AI management system before a certification audit. The certification body performs an independent external audit and issues any certificate. Do not let the certification body's auditors design or run your internal audit, because that blurs the line the certifier must protect. Ask any external party helping with preparation to confirm in writing that it will not also perform the certification audit.
Separate control design from control sign-off
A consultant or implementation partner who designed the AI controls should not also sign off that those controls work. Preparation help is valid, but the people who certify effectiveness internally must be independent of the design. Ask who wrote each control, who tested it, and who accepted the result, and confirm that the sign-off role sits with someone the organization employs or appoints.
Certification body applies its own impartiality rules
The certification body must manage impartiality risks under ISO/IEC 17021-1 and related accreditation rules, including conflicts that arise from consulting services it offers to the same client. ISO/IEC 42006:2025 adds requirements on top of ISO/IEC 17021-1 for bodies certifying AI management systems. Before contracting, ask the body how it handles preliminary audits, whether it has provided consultancy to you, and how it confirms its auditors have AI-specific competence.
How the AI policy review feeds management review
The AI policy review is one of the strongest inputs top management can act on, because it is where the organization records whether its stated direction for AI still matches how AI systems are built, provided and used. Control A.2 asks for a documented AI policy, alignment with other organizational policies, and periodic review of that policy. Treat each review as a dated, documented decision with a named approver, the version compared against, the changes made or the reason none were needed, and the date of the next scheduled review. Clause 9.3.2 lists the inputs that management review must consider, and the policy review outcome, together with the status of AI objectives, feeds directly into that meeting. Confirm the review interval you set in your own AI policy and in your internal audit programme so the two schedules do not conflict.
Management review under clause 9.3.2 needs more than the policy. Bring the statement of applicability, the status of AI objectives, results from internal audits under clause 9.2, monitoring and measurement results from clause 9.1, and the status of nonconformities and corrective actions under clause 10.2 into the same review. The top management who take these inputs must be named under clause 5.3, with their responsibilities for the AI management system assigned and communicated. Where the AI risk decisions sit with an executive, record that person's name in the minutes. Auditors commonly ask who approved the AI policy and who decided on resource needs, so the answer should be traceable to a named role, not a team.
Clause 9.3.3 requires the results of management review to record decisions on continual improvement opportunities, any need for changes to the AI management system, and resource needs. Record these as specific actions with an owner and a due date, and link each one to the policy version, objective or audit finding that prompted it. A policy review that concludes with no change still needs its rationale written down. Ask your implementation partner to prepare a template that captures these fields, and ask your certification body which evidence format it expects at stage 1. The NIST AI RMF crosswalk maps GOVERN 2.3, executive responsibility for AI risk decisions, to clauses 5.1, 5.2 and 9.3.1 to 9.3.3, so the same minutes can serve both reviews.
How the NIST AI RMF maps executive accountability to management review
The NIST AI RMF subcategory GOVERN 2.3 addresses executive leadership responsibility for AI risk decisions. In the NIST crosswalk contributed by Microsoft, that subcategory maps to ISO/IEC 42001 clauses 5.1 and 5.2 on leadership and AI policy, and to the management review clauses 9.3.1 to 9.3.3. For a senior leader, this means the decisions made in management review are where accountability for AI risk becomes visible on the record.
- Leadership commitment (clause 5.1): Top management must show that it directs and supports the AI management system, which the crosswalk links to the same executive accountability idea.
- Policy ownership (clause 5.2): The AI policy should be approved at the top level so that review decisions have a clear authority behind them.
- Review at planned intervals (clause 9.3.1): Executives should set and keep a schedule for management review rather than convening it only after an incident.
- Required inputs (clause 9.3.2): Ask for a pack that covers audit results, changes in context, risk and impact outcomes and nonconformities before each meeting.
- Recorded outcomes (clause 9.3.3): Decisions and resource needs should be minuted, with owners and dates, so that the record shows what was decided.
Before relying on this mapping, confirm with your certification body how it will test leadership accountability and the minutes of management review.
The crosswalk links NIST AI RMF GOVERN 1.6, the inventory of AI systems, to the implementation guidance for Annex A controls A.4.2 to A.4.6. Those controls cover the resources an AI system depends on, including data, tooling, system and computing, and human resources. For a compliance lead, the inventory is the working record that feeds the inputs reviewed at management review, so its gaps show up as gaps in the review pack.
- System inventory as the starting point: Keep one register of AI systems with owner, role and status, so every review input can be traced to a system.
- Resource records (A.4.2 to A.4.6): Document the data, tools, infrastructure and people each system relies on, and update them when they change.
- Inputs from monitoring (clause 9.1): Pull measurement results and audit findings into the review pack from the same register.
- Change tracking: Record when a system is added, retired or materially changed, because that changes what management must review.
- Evidence trail: Store each review pack and its minutes under document control, consistent with the documented information requirements in clause 7.5.
Before finalizing the pack, check with your auditor which inventory fields and resource records they expect to sample.
A crosswalk is a mapping aid that shows where a framework's ideas sit next to another standard's clauses. It is not a certification, it does not establish conformity, and it does not replace reading ISO/IEC 42001 itself. When a vendor or consultant presents a mapping as proof of compliance, treat that claim as a starting point for verification, not as evidence.
- Mapping is not conformity: A certificate comes only from an accredited certification body after audit, and DeployOpen does not issue certificates or audit reports.
- Check the source and version: Confirm the crosswalk edition and whether it was contributed by a named organization, and compare it against the published standard.
- Ask for the auditor's view: Request that the certification body confirm, in writing, how it will test the mapped clauses during stage 1 and stage 2.
- Scope the engagement in writing: A fixed-scope agreement should state which clauses, evidence and review records the provider prepares and which the organization owns.
- Keep ownership internal: Executives and compliance staff must own the management review decisions, so do not let a provider sign off on them.
Before accepting any mapping as part of a contract or readiness claim, confirm it against the standard and the certification body's stated method.
What must be in place before the internal audit starts
Clauses 9.2 and 9.3 assume the management system already runs. Before an internal audit or management review can test anything, the organization needs a settled policy, a defined boundary, a usable inventory, real monitoring data, an accountable owner and a fixed review rhythm. Check each item below before scheduling the first audit.
Approved AI policy with a review date
The AI policy sets management direction for the whole system, so the internal audit tests against it. Confirm that top management has approved the policy in writing, that it is communicated to the people who build, buy and operate AI, and that it names the date of its next review. A policy without an approver, an issue date or a review date gives auditors nothing to measure conformity against. Check that the review date falls inside the planned review cycle.
Defined scope and statement of applicability
The scope under clause 4.3 fixes which AI systems and business units the audit covers. The statement of applicability under clause 6.1.3 records which Annex A controls apply and why others are excluded. Confirm that the scope names the AI systems in or out, that every Annex A control has a recorded decision with justification, and that the document has a version and approval date. An auditor will sample exclusions first, so each one needs a stated reason.
AI system inventory
An internal audit cannot sample systems that nobody has listed. The inventory should record each AI system in scope, its role for the organization (provider, developer or user), its owner, its intended purpose and the resources it depends on. Check that the list was reconciled against procurement records, cloud accounts and business unit reports, not only against the engineering team's view. Note the inventory date so the auditor can confirm it was current when sampled.
Monitoring and measurement records
Clause 9.1 requires the organization to monitor and measure AI management system performance, and the internal audit reads those records as evidence. Confirm that defined metrics exist, that they have an owner and collection frequency, and that results are stored with dates. Records should show analysis and follow-up, not only raw data. If monitoring has run for only a short period, tell the auditor so the sample is planned around the actual record.
Named internal audit owner
Clause 9.2.2 expects an internal audit programme that is planned, with responsibilities and criteria defined. The programme needs a named owner who is independent of the processes being audited, so an engineering lead should not audit their own model release. Confirm the owner has documented authority, a defined audit competence basis and access to the systems and records in scope. ISO 19011:2026 describes how to manage the programme and evaluate auditor competence, so check the owner's approach against it.
Management review calendar with minutes and actions
Clause 9.3 requires top management to review the AI management system at planned intervals, using defined inputs and producing defined outputs. Confirm a calendar exists with dates set in advance, attendees named and a standard agenda that covers the inputs in clause 9.3.2. Each meeting should produce minutes, decisions and actions with owners and due dates. Check that previous actions were closed or carried forward, because auditors look for that trail first.
Questions buyers ask about ISO 42001 internal audit and management review
Who must run the ISO 42001 internal audit?
The organization must run its own internal audit. Clause 9.2 requires it to plan an internal audit programme, define audit criteria and scope for each audit, and select auditors so that the process is objective and impartial. The auditors do not have to be external, but they should not audit their own work. Smaller organizations often assign staff from another function, such as a quality or security team, and train them in ISO 19011 audit practice. The certification body reviews this arrangement during the certification audit, so ask it early how it expects independence to be shown.
Can a consultant act as our internal auditor for ISO 42001?
A consultant can help build the internal audit programme, train staff and support an audit, but the organization remains responsible for the internal audit under clause 9.2. Where a consultant also helped design the AI management system, using that same person to audit it creates a conflict that a certification body will question. An implementation partner prepares systems and evidence; it does not issue audit reports or certificates. Confirm with the certification body how it treats consultant-led internal audits before you contract for that role.
How often must ISO 42001 management reviews take place?
ISO/IEC 42001 requires top management to review the AI management system at planned intervals under clause 9.3, and it does not fix a number of months or a fixed frequency in the text you should rely on for scheduling. Set the interval in your own management review procedure, justify it against the pace of AI system change and risk, and confirm it with your certification body before stage 1. Record each review against the required inputs and results in clause 9.3.2 and 9.3.3, so the schedule and the records match.
What internal audit and management review records will the certification body sample?
Expect the certification body to ask for the internal audit programme, the audit plan and criteria for each audit, the auditor selection and competence evidence, the audit reports, and the nonconformities raised and their corrective actions under clause 10.2. For management review, it will sample the agenda, the minutes, the inputs reviewed and the decisions and actions recorded. Auditors check that the records show the programme is operating before the certification audit, not only that a procedure exists. Keep dated, versioned records and be ready to show how findings reached owners and were closed.
How does the NIST AI RMF map executive accountability to management review?
The NIST crosswalk, contributed by Microsoft to the NIST AI Resource Center, maps GOVERN 2.3, which concerns executive leadership responsibility for AI risk decisions, to ISO/IEC 42001 clauses 5.1 and 5.2 and to the management review clauses 9.3.1 to 9.3.3. In practice, this means the executives named in the NIST governance function should be the same people who review the AI management system and approve decisions on AI risk. You can use the crosswalk to show an assessor where that accountability is exercised, but confirm the mapping against the current crosswalk document before relying on it in an audit.
What must our own staff provide for the internal audit and management review?
Your own staff must supply most of the operating evidence. That includes named owners for each AI system and each Annex A control in the statement of applicability, access to records, time for interviews, and managers who will attend reviews and act on decisions. Staff must also be trained in ISO 19011 audit practice if they will audit, and top management must attend the management review in person. An outside partner can prepare templates and run a dry-run audit, but the internal team has to own follow-up, corrective actions and the decisions taken at review.
What an implementation partner can prepare and what it cannot issue
An implementation partner such as DeployOpen can help you build the machinery behind ISO 42001 clauses 9.2 and 9.3 under a fixed, written scope, but it cannot stand in for your internal auditors, your top management or the certification body. In practice, the partner can plan the internal audit programme, prepare audit checklists and sampling records, configure the systems that hold audit evidence, build management review input packs and draft minutes templates, and document how corrective actions move through your tracking tool. Each of these is preparation work. The decisions remain yours: which processes are audited, who is competent to audit them, whether a nonconformity is accepted, and what top management decides after review.
Be precise about what no partner can issue. DeployOpen does not act as the certification body, does not issue audit reports, attestations or certificates, and does not guarantee a certification outcome. Only an independent certification body, accredited where accreditation is in place, can audit your system and grant certification. ISO does not certify organizations itself, and the ISO certification page explains how that separation works. Ask any partner to show, in writing, which deliverables are preparation artifacts and which outputs belong to a third party, and to confirm that it will not sit on both sides of that line.
Before you sign a statement of work, confirm three things. First, the scope should list the specific deliverables, such as an audit programme document, a template library and an evidence folder structure, along with who will sign off each one. Second, the partner should not perform the internal audits itself if it will also help you prepare for the certification audit, because that blurs independence and the certification body may question it. Third, make sure your own staff hold the audit competence and the authority to run the programme after the engagement closes. The cost of a fixed-scope engagement is driven by the number of AI systems in scope, the state of existing records and the number of internal audit cycles you expect to run, so ask for the quote to break these out as one-time build work versus recurring audit support.
How DeployOpen prepares internal audit and management review evidence
DeployOpen is a Chainscore Labs company that plans, implements and documents self-hosted open-source platforms inside the client's own infrastructure. For ISO 42001 internal audit and management review, DeployOpen prepares the systems, records and evidence that the organization's own internal auditors and top management use, while the organization keeps ownership of its controls and any certification body issues the outcome.
How we scope
- The written scope lists which AI systems, business units and clauses 9.2 and 9.3 records are covered before work starts.
- Scope also names the internal auditors, top management members and review inputs the organization already has in place.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work begins.
How we build
- We configure the platforms that hold audit programme records, nonconformity logs and management review minutes inside your environment.
- We set up a documented review cadence and input templates that map to the management review inputs in clause 9.3.2.
- We test that records are versioned, access-controlled and retrievable, so an internal audit sample can be pulled without manual rebuilding.
How we hand over
- You receive documented procedures for the internal audit programme, including how auditor independence and competence are recorded.
- Management review packs are delivered in a form your top management can approve, with action and decision logs attached.
- Handover covers where each piece of evidence lives, who owns it and how it links to the AI policy review and corrective action records.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers can cover updating review inputs as AI systems change, and keeping platform records current between audit cycles.
- Ask any provider to confirm in writing which records remain the organization's responsibility and which parts of the program they support.
