iso-42001-audit-prep

ISO/IEC 42001 Audit Prep

A clause-by-clause readiness guide for ISO/IEC 42001:2023 — the international standard for AI Management Systems (AIMS). Produces gap analyses, evidence checklists, and documentation stubs to prepare teams for Stage 1 and Stage 2 certification audits.

---

Step 1 — Establish Context

Before running any clause assessment, orient yourself:

1. Audit type — internal audit, Stage 1 (documentation review), Stage 2 (implementation audit), or surveillance audit?
2. Current certification status — not started, in progress, certified (which cycle)?
3. Existing management systems — does the org already have ISO 9001, ISO 27001, or similar? (enables integration shortcuts)
4. Scope of AIMS — which AI systems/products are in scope for the AIMS?
5. Prior gaps — any known nonconformities from a previous audit?

---

Step 2 — Select Assessment Mode

User request	Mode
"Full readiness check" / "assess everything"	Full clause sweep (Clauses 4–10 + Annex A)
"Stage 1 prep"	Documentation focus — clauses 4, 5, 6, 7
"Stage 2 prep"	Implementation focus — clauses 8, 9, 10 + Annex A
"Just the gaps"	Gap-only output — skip confirmed items
Specific clause named	That clause only
"Annex A controls"	Annex A + B only
Ambiguous	Ask: "Should I run a full readiness sweep, or focus on a specific clause or audit stage?"

---

Step 3 — Run the Clause Assessment

Load reference files as needed and generate a Clause Assessment Block for each selected clause.

Reference files:

• references/clauses-4-7.md — Context, Leadership, Planning, Support
• references/clauses-8-10.md — Operation, Performance Evaluation, Improvement
• references/annex-a.md — Organizational AI controls (A.2–A.10)
• references/annex-b.md — AI system impact categories and controls
• references/evidence-guide.md — What auditors look for, document by document

Clause Assessment Block Format

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📋 ISO 42001 — CLAUSE [X]: [CLAUSE TITLE]
Audit mode: [Stage 1 / Stage 2 / Internal]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

REQUIREMENTS CHECKLIST
───────────────────────
Mark each: ✅ Evidence exists | ⚠️ Partial / in progress | ❌ Gap | N/A

[ ] [Requirement 1] — Evidence needed: [doc/record type]
[ ] [Requirement 2] — Evidence needed: [doc/record type]
...

GAPS
─────
[Numbered list of ❌ and ⚠️ items]

DOCUMENTATION STUBS NEEDED
────────────────────────────
[List of documents that need to be created or completed]

AUDITOR FOCUS AREAS
────────────────────
[What a certification auditor will specifically probe in this clause]

CLAUSE READINESS: 🟢 Ready | 🟡 Needs work | 🔴 Not ready
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

---

Step 4 — Produce the Gap Analysis Report

After all clauses are assessed, output a consolidated report:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📊 ISO 42001 GAP ANALYSIS REPORT
Organization: [name if known]
AIMS Scope: [AI systems in scope]
Audit target: [Stage 1 / Stage 2 / Internal]
Date: [today]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

⚠️ ADVISORY NOTICE
───────────────────
This output is generated by an AI skill and is provided for informational and
governance support purposes only. It does not constitute legal advice, regulatory
advice, or a formal compliance determination. Do not rely on this output as a
substitute for advice from qualified legal counsel, a licensed compliance
professional, or a certified auditor. Review all outputs with appropriate human
expertise before taking compliance action.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

CLAUSE READINESS SUMMARY
──────────────────────────
  Clause 4 — Context             [🟢 / 🟡 / 🔴]
  Clause 5 — Leadership          [🟢 / 🟡 / 🔴]
  Clause 6 — Planning            [🟢 / 🟡 / 🔴]
  Clause 7 — Support             [🟢 / 🟡 / 🔴]
  Clause 8 — Operation           [🟢 / 🟡 / 🔴]
  Clause 9 — Performance eval    [🟢 / 🟡 / 🔴]
  Clause 10 — Improvement        [🟢 / 🟡 / 🔴]
  Annex A — AI Controls          [🟢 / 🟡 / 🔴]

CRITICAL GAPS (audit blockers)
───────────────────────────────
1. [Gap — Clause reference]
2. [Gap — Clause reference]
...

PRIORITIZED ACTION PLAN
────────────────────────
Priority 1 — Must resolve before audit:
  • [Action] — Owner: ___ — Due: ___

Priority 2 — Should resolve before audit:
  • [Action] — Owner: ___ — Due: ___

Priority 3 — Can address in next cycle:
  • [Action] — Owner: ___ — Due: ___

DOCUMENTS TO CREATE / COMPLETE
────────────────────────────────
[ ] [Document name] — Clause ref — Owner: ___
[ ] [Document name] — Clause ref — Owner: ___
...

ESTIMATED READINESS
────────────────────
[Narrative: how close is the org to audit-ready, and what's the critical path?]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

---

Step 5 — Offer Outputs

After presenting the gap analysis, offer:

1. Save report as Markdown — full gap analysis as a .md file for the audit preparation folder
2. Generate document stubs — blank-but-structured templates for each missing document
3. Owner assignment table — spreadsheet-ready table of all actions with owner/due date columns
4. Nonconformity register — pre-formatted register for tracking gaps through to closure
5. Cross-framework mapping — map ISO 42001 gaps to NIST AI RMF or EU AI Act equivalents via hitl-compliance-gate

---

Key Principles

• Advisory only — All outputs produced by this skill are for informational and governance support purposes only. They do not constitute legal advice, regulatory advice, or a formal compliance determination. No output from this skill should be relied upon as a substitute for advice from qualified legal counsel, a licensed compliance professional, or a certified auditor with jurisdiction-specific expertise.
• Evidence first — auditors don't take your word for it; every requirement needs a document or record
• Stage 1 vs Stage 2 — Stage 1 is a desk review (do the documents exist?); Stage 2 is implementation (are they actually followed?)
• Integration opportunity — if ISO 27001/9001 is already in place, flag integration shortcuts clearly
• Annex A is not optional — organizations must select and justify Annex A controls; omissions require documented rationale
• Documented information is king — ISO standards live and die by controlled documents; always specify what form evidence should take