ISO 42001 performance evaluation and improvement

ISO 42001:2023 9.1 asks you to monitor and evaluate the AI management system’s performance, 9.2 to audit it at planned intervals, and 9.3 for top management to review it. Clause 10.1 asks for continual improvement, and 10.2 for a reaction to each nonconformity and corrective action that removes its cause.

The requirement in plain English

Monitoring and evaluation (ISO 42001:2023 9.1). You decide what to monitor and measure, how, when, and when the results are analysed and evaluated, and you keep the results. The aim is to judge whether the management system performs and is effective, which for AI means measuring both the management system (objectives met, assessments current) and the AI systems themselves through the monitoring each one has under ISO 42001:2023 Annex A 6.2.6.

Internal audit (ISO 42001:2023 9.2). You audit at planned intervals to check that the system meets your own requirements and the standard’s, and that it is effectively implemented and maintained. You plan an audit programme with frequency, methods, responsibilities and reporting, weighted by how important each process is and what earlier audits found. Each audit has criteria and a scope, auditors are objective and impartial, results go to the relevant managers, and you keep evidence of the programme and the results. The internal audit guide walks through the work.

Management review (ISO 42001:2023 9.3). Top management reviews the system at planned intervals to confirm it is still suitable, adequate and effective. The review considers what happened to earlier actions, changes in your issues and in what interested parties need, how the system is performing, with trends in nonconformities, monitoring results and audit results, and where it could improve. Its results are decisions on improvement and change, kept as documented information.

Continual improvement (ISO 42001:2023 10.1). You keep improving how suitable, adequate and effective the system is.

Nonconformity and corrective action (ISO 42001:2023 10.2). When something does not meet a requirement, you control and correct it and deal with the consequences. You then decide whether the cause needs removing so it does not recur or happen elsewhere, find the cause, act, check the action worked, and change the management system if needed. You keep a record of what happened, what you did and the result.

For AI, the reports people send through the adverse-impact channel (ISO 42001:2023 Annex A 8.3) and AI incidents are among the richest inputs to both the review and corrective action.

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 30-person company running two AI products keeps one measurement framework. It tracks the AI objectives monthly, and for each AI system the measures from its monitoring plan: accuracy against the release baseline, drift, override rates, complaints and adverse-impact reports.

The internal audit programme covers every clause and every applicable Annex A control over 12 months, and audits the higher-impact product twice. Each audit follows one AI system from its use case record through risk and impact assessment, evaluation, deployment approval and monitoring. The auditor is the operations manager, trained in auditing, with an outside AI specialist for the technical controls; neither audits their own work.

The management review runs every six months. The pack is short: open actions, changes in issues and in interested parties’ needs, objective and system trends, audit findings, impact assessment updates and adverse-impact reports. Each decision gets an owner and a date.

Every nonconformity, from an audit finding to an AI incident such as a model that degraded for one customer group, goes into a corrective action record with a root cause, the action, and an effectiveness check three months later. Retraining alone is not accepted as a fix unless the cause it addresses is named.

Evidence an auditor expects

Monitoring and measurement results (required documented information): the auditor checks you measure the AI systems as well as the management system.
Audit programme and audit results (required): coverage over the cycle, impartial auditors, and findings reported.
Management review results (required): the date, who attended, the inputs considered and the decisions made.
Nonconformity and corrective action records (required): cause, action and an effectiveness check for each.
AI incident records: how incidents were contained, investigated and fed into corrective action.
Follow-up of previous actions: the auditor picks a decision from the last review and asks what happened.

Common mistakes

Auditing clauses but not systems

An audit that checks documents against clauses never tests whether a real AI system went through the lifecycle. Sample at least one system end to end in every audit.

The AI lead audits the AI management system

Impartiality fails when the person who built the process audits it. Use a manager from another team, or an outside auditor for the parts nobody else can judge.

Measures only of paperwork

Counting approved documents shows activity, not performance. Include each AI system’s behaviour: drift, errors, overrides and complaints.

Closing an AI incident at the retrain

A retrained model removes the symptom. Clause 10.2 asks for the cause: a data gap, a missed monitoring threshold or a change pushed without evaluation. Fix that too, and check later that it held.

A review that skips the people affected

Adverse-impact reports and impact assessment changes are the AI-specific inputs auditors look for. Put them on the agenda as their own items.

How Sted helps

For ISO 42001 clauses 9 and 10 Sted’s knowledge base carries the Monitoring and Measurement Procedure (PRC-MMP) with its Monitoring and Measurement Framework Record (REC-MMFR) and Monitoring and Measurement Record (REC-MMR), the Internal Auditing Procedure (PRC-IAP) with its Internal Audit Schedule (REC-IAS), Internal Audit Plan (REC-IAP) and Internal Audit Report (REC-IAR), the Management Review Procedure (PRC-MRP) with its Management Review Schedule (REC-MRS), Management Review Record (REC-MRR) and Management Review Action Record (REC-MRA), and the Corrective and Preventive Actions record (REC-CAPA) and AI / Algorithmic Incident Record (REC-AII), both tagged to clause 10.2.
Records are part of the Full Management System plan.
Sted’s knowledge base includes a Corrective and Preventive Actions record template, under its Corrective and Preventive Action Procedure.
Records are part of the Full Management System plan.
33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date.
Audit readiness is the share of done items per adopted standard: approved documents, adopted requirements, records and training.
Audit readiness is visible to administrators only for now.

Sted holds the audit and review records and raises them when they fall due. Audit judgements and review decisions belong to your auditors and top management.

Internal audit guide: planning and running the audit, with an ISO 42001 example.
Management review guide: preparing the pack and minuting decisions.
CAPA and root-cause analysis guide: finding the cause of a nonconformity or AI incident.
ISO 42001 operation and the AI system lifecycle: the monitoring that feeds these clauses.
Internal audit: what an internal audit is, and what it is not.
ISO 42001 context, scope and AI policy: the issues and interested parties whose changes the management review weighs.

Frequently asked questions

Who can carry out an ISO 42001 internal audit?

Anyone competent who does not audit their own work. In a small company that is often a manager from another team trained in auditing, or an outside auditor for the AI-specific parts. Auditors need enough AI knowledge to follow a system from use case to monitoring and judge whether the evidence is real.

How often must an ISO 42001 management review happen?

At planned intervals you set yourself; ISO 42001:2023 9.3 gives no number. Once a year is the usual minimum, and a certification body expects one before stage 2. Organisations whose AI systems change quickly often review every six months.