11.3 Document Review & Stage 1 Readiness

11.3 Document Review & Stage 1 Readiness

Quick Answer: For third-party management system certification, Stage 1 is the readiness and design gate. You review AIMS documented information, understand the organization’s AI context and sites, and decide whether Stage 2 (implementation and effectiveness) can proceed. You are not yet proving every model’s fairness in production—but you are judging whether the system exists on paper and in structure well enough to audit. ISO/IEC 17021-1 frames Stage 1; ISO 19011 still guides how you gather and evaluate information.

Internal auditors may perform an analogous document review before fieldwork even without a formal “Stage 1” label. Certification language is still the exam’s default model—know it and map it to internal practice.

---

Purpose of Stage 1 for Management System Certification

Stage 1 is designed to:

1. Review the client’s management system documented information against the standard
2. Evaluate the client’s site-specific conditions and readiness for Stage 2
3. Review the client’s understanding of the standard’s requirements
4. Obtain information on scope, processes, regulatory context, and multi-site issues
5. Plan Stage 2 by identifying focus areas and confirming logistics and resources
6. Provide a focus for planning Stage 2 by gaining sufficient understanding of the system and operations

  STAGE 1 (design / readiness)          STAGE 2 (implementation / effectiveness)
  +---------------------------+         +--------------------------------------+
  | Documented AIMS           |         | Operating processes & records        |
  | Scope, policy, SoA        |  --->   | Interviews, observation, sampling    |
  | Methods & planning        |         | AI artifacts in real use             |
  | Internal audit / MR status|         | Conformity & effectiveness judgment  |
  +---------------------------+         +--------------------------------------+

What Stage 1 is not: a substitute for Stage 2, a certificate decision, or a consulting redesign of the client’s models. Findings from Stage 1 often appear as areas of concern that must be resolved before or during Stage 2; major design voids justify postponement.

---

Document Review of AIMS Documented Information

Work from the agreed criteria. A practical AIMS Stage 1 document pack includes:

Stage 1 rewards substance: a glossy ethics brochure without SoA or impact method is weaker than concise controlled procedures covering Clauses 4–10 and selected Annex A controls. Check control of documents, real implementation (not restatement), clear interfaces (who runs impact assessment before deployment), and inventory–scope match. Remote document review is fine when secure; use on-site/hybrid Stage 1 when multi-site MLOps or AIMS–engineering disconnects need observation.

---

Evaluating Readiness for Stage 2

Readiness is a professional judgment, not a single checkbox. Typical must-be-true signals before Stage 2:

• Scope is defined and stable enough to audit
• Policy and mandatory planning processes exist (risk, impact, objectives)
• SoA exists with justifications, not a blank template
• The AIMS has been operated long enough to produce records (not only drafts dated last night)
• Internal audit and management review have been conducted in a way that covers the AIMS (or integrated system) with meaningful outputs
• Key process owners are identifiable and available

Scenario: Stage 1 finds a solid AI policy and risk procedure, but zero completed impact assessments for two high-impact clinical decision systems already in production, and an SoA that marks A.5 controls “implemented” with no records. Conclusion: not ready for a full Stage 2 effectiveness audit of those controls. Document concerns; reschedule after evidence exists.

---

Identifying Focus Areas for Stage 2

Stage 1 should leave a risk-based Stage 2 plan, not a uniform clause walkthrough. Typical AIMS focus signals:

1. High-impact AI systems — safety, rights, financial, medical, employment decisions
2. Weak design points — impact assessments, data quality controls, human oversight design
3. Third-party / foundation model dependencies — supplier controls and transparency gaps
4. Change and retraining — models that update frequently without change control evidence
5. SoA anomalies — controls marked N/A without logic; “implemented” without procedure owners
6. Integration seams — AIMS claims to lean on ISMS controls that were never extended to AI-specific risks
7. Multi-site inconsistency — central policy, local shadow deployments

Capture focus areas in the Stage 1 report and feed them into Stage 2 planning and sampling.

---

Common Stage 1 Findings for AIMS

A useful Stage 1 report confirms objectives/scope/criteria, lists documents reviewed, states areas of concern, readiness conclusion and Stage 2 timing, logistics, and competence needs. Do not pretend Stage 2 effectiveness was already tested—but state design voids firmly enough that commercial pressure cannot force a premature Stage 2. Convert conclusions into the plan, team, and working documents next.