aims-audit

name: aims-auditdescription: >  ISO 42001 AI Management System (AIMS) audit-prep playbook. Use when an ISO 42001  certification audit is scheduled (Stage 1 or Stage 2), when a surveillance or  internal AIMS audit is due, or when preparing an AI Impact Assessment (AIIA).license: MIT + Commons Clausemetadata:   version: 1.0.0  author: borghei  category: compliance  domain: ra-qm-team  updated: 2026-05-27  tags: [iso42001, aims, ai-management-system, audit-prep, certification, ai-governance, ai-impact-assessment]

AIMS Audit Prep (ISO 42001)

Operational playbook for ISO 42001:2023 AI Management System (AIMS) audit preparation. Whether targeting initial certification, surveillance audit, or annual internal audit.

When to use this skill vs. iso42001-ai-management:

• This skill: audit imminent; need readiness sprint
• iso42001-ai-management: building AIMS from scratch; multi-quarter program

---

When to use this skill

---

ISO 42001 audit structure

Stage 1 (documentation review)

• Auditor reviews AIMS documentation (typically 1-3 days)
• Confirms scope, applicability, key documents present
• Identifies gaps before Stage 2
• Typically 2-3 weeks before Stage 2

Stage 2 (operational assessment)

• Auditor onsite (or remote) verifies AIMS operating effectively
• 3-10 days depending on scope + system count
• Walkthroughs, interviews, evidence sampling
• Conclusion: certification recommended (subject to non-conformity closure) or not

Surveillance audits

• Annual; reduced scope vs initial
• Typically 1-3 days
• Focus on high-risk areas + changes since prior audit

Re-certification (year 3)

• Full audit; similar to initial
• Typically every 3 years

---

AIMS audit-prep sprint

4-week sprint (mature AIMS, surveillance audit)

Week 1: Internal audit + gap analysis
Week 2: Remediation + AI inventory refresh
Week 3: Documentation review + walkthrough rehearsal
Week 4: Auditor onsite

8-week sprint (Stage 1 + Stage 2 initial certification)

Weeks 1-3: AIMS documentation completion (Annex A controls coverage)
Weeks 4-5: Stage 1 audit + gap closure
Weeks 6-7: Stage 2 operational evidence prep + mock walkthroughs
Week 8: Stage 2 audit

---

ISO 42001 clauses + Annex A controls

Clauses (4-10): management system

Annex A controls (10 areas)

---

Critical audit areas

AI Inventory + Impact Assessments

AI Policy + Governance

AI Lifecycle Management (Annex A.6)

Data Governance (Annex A.7)

Third-party AI (Annex A.10)

---

Clarify First

Before running the audit-prep, settle the inputs below. When one is missing or vague and would change the result, ask about it; when it wouldn't, use a sensible default and say which one you used.

• Audit type and stage: Stage 1 documentation review, Stage 2 operational, surveillance, or internal (sets sprint length and whether the focus is documentation or operational evidence).
• AIMS maturity: mature system vs building from gaps (picks the 4-week vs 8-week sprint).
• AI systems in scope: which systems and how many (drives the AIIA count and Annex A coverage).

Ask about the two or three inputs that matter most for this request, not the whole list. If the user wants a result straight away, produce it and state your assumptions at the top.

Quick start

1. Run readiness score: python3 scripts/aims_readiness_score.py --config aims-controls.yaml
2. Check AIIA per system: python3 scripts/ai_impact_assessment_checker.py --aiia system-aiia.yaml
3. Pick sprint length based on score
4. Execute sprint per references/iso42001-aims-readiness-checklist.md

---

Common AIMS audit findings

• AI inventory incomplete — shadow AI not captured
• AIIA missing for systems that look "small" but have impact
• AI lifecycle process not implemented (designed only)
• Data governance generic — not AI-specific
• Performance monitoring missing — drift not detected
• AI policy stale — written before current AI deployment
• Third-party AI vendors not assessed
• Continual improvement not evidenced

---

Tooling

---

Scope & Limitations

In Scope:

• ISO 42001:2023 audit-prep sprints for Stage 1, Stage 2, surveillance and internal audits (4-week and 8-week plans)
• Readiness scoring per clause (4-10) and Annex A area, with a sprint-length recommendation, from aims_readiness_score.py
• AI Impact Assessment completeness checks per Annex A.5 from ai_impact_assessment_checker.py
• Evidence punch lists for AI inventory, policy and governance, lifecycle, data governance and third-party AI, plus an internal audit playbook

Out of Scope:

• Building an AIMS from scratch as a multi-quarter program (see ra-qm-team/iso42001-ai-management/)
• EU AI Act readiness and conformity (see ra-qm-team/audit-prep/ai-act-readiness/ and ra-qm-team/eu-ai-act-specialist/)
• Running several frameworks in one program (see ra-qm-team/audit-prep/compliance-readiness/)
• Acting as the certification body or issuing a certificate

Important Caveats:

• The readiness score adds fixed weights for each control you mark as true in YAML. It measures what you claim, not whether the control works in practice.
• The AIIA checker tests whether sections are filled in, not whether the impact analysis is sound.
• A high score does not predict the certification decision. Only an accredited certification body can recommend certification.

---

References

• iso42001-aims-readiness-checklist.md — punch list per clause + Annex A
• aims-internal-audit-playbook.md — internal audit execution playbook

---

Related skills

• ra-qm-team/iso42001-ai-management — deep ISO 42001 AIMS program management
• ra-qm-team/eu-ai-act-specialist — EU AI Act regulatory companion
• ra-qm-team/audit-prep/ai-act-readiness — AI Act audit-prep variant
• ra-qm-team/audit-prep/compliance-readiness — multi-framework readiness