11.1 Initiating the Audit & Feasibility

11.1 Initiating the Audit & Feasibility

Quick Answer: Before you write an audit plan or open a Stage 1 checklist, initiate the engagement: contact the auditee, confirm who is the audit client, and decide feasibility. For an Artificial Intelligence Management System (AIMS) under ISO/IEC 42001:2023, feasibility fails when critical documented information is missing, access to AI systems or third parties is blocked, or the team lacks time and AI-domain competence. ISO 19011 guides the process; certification bodies also apply ISO/IEC 17021-1 application and Stage 1 logic.

Domain 4 (Preparing an ISO/IEC 42001 audit) starts here. Poor initiation causes rushed Stage 2 work, mid-audit scope fights, and findings challenged as out of scope. Treat it as a professional gate.

---

Why Initiation Matters for AIMS Audits

AI estates are fragmented across product, data science, legal, procurement, and security. Auditing only the “AI governance office” without confirming system boundaries misses material risk. Initiation tests whether the organization can even locate the AIMS and the systems it claims to manage.

  AUDIT CLIENT / CB          AUDIT TEAM LEADER           AUDITEE
  (who wants the audit)      (plans & leads)             (AIMS owner)
         |                          |                         |
         |  engagement /            |   contact,              |
         |  application             |   info request,         |
         +------------------------->|   feasibility           |
                                    +------------------------>|
                                    |<----- cooperation ------|
                                    |   PROCEED / POSTPONE /  |
                                    |   DECLINE               |

Roles to pin down early

---

Contact With the Auditee

ISO 19011 expects the team leader (or audit program manager) to establish communication with the auditee’s management. For AIMS work, that first contact should achieve more than a polite introduction:

1. Confirm purpose and type — initial certification (Stage 1 + Stage 2), surveillance, recertification, internal audit, or supplier (second-party) audit.
2. Confirm authority — named management representative for the AIMS; who can authorize access to production model environments, data platforms, and third-party portals.
3. Clarify language, channels, and confidentiality — model weights, training data, and customer prompts may be highly sensitive; agree NDA/security handling before document transfer.
4. Identify multi-site and remote work — cloud regions, outsourced MLOps, offshore annotation vendors, and “shadow AI” business units.
5. Set a provisional information-request list (see below) with realistic due dates.

If the auditee refuses any discussion of AI system inventory “for IP reasons,” treat that as a feasibility risk. You can often audit process evidence without exfiltrating weights, but total opacity on which systems exist usually means scope cannot be defined. Confirm legal entity names vs. product brands, AI hosting locations, AIMS–ISMS integration, interview windows, and remote-access constraints during the same contact cycle.

---

Determining Feasibility

Feasibility answers: Can this audit achieve its objectives under agreed constraints? ISO 19011 frames feasibility around availability of information, adequate cooperation, and adequate time and resources. Map those pillars to AIMS reality:

Information available

You need enough documented information to plan sampling—not perfection. Typical certification signals: defined AIMS scope, AI policy, risk and impact assessment approaches, SoA with justified inclusions/exclusions, process descriptions for claimed lifecycle/data/transparency/use/third-party controls, and internal audit / management review records (critical before Stage 2).

Cooperation

Cooperation covers people, facilities, and systems: interviews with owners who can explain experiment-to-production paths; observation of human-oversight workflows; access to logs, tickets, change records, and monitoring; supplier liaison for outsourced AI. Endless reschedules of the only model-registry expert are a feasibility problem.

Time and resources

AIMS audits often need more specialist time than document-only MS audits of similar headcount. Weigh auditor-days against system count and risk, technical-expert needs, remote-access logistics, and translation.

Scenario: A healthcare provider lists “all AI systems” for certification, but the inventory is empty and no impact assessments exist. Stage 2 feasibility is not met—document concerns, use Stage 1 for readiness if contracted, and postpone Stage 2 until basic planning records exist.

---

Initial Information Request for AIMS

Send a structured request early. Tailor depth to audit type, but cover these families:

1. Scope of AI systems — inventory IDs, purpose, autonomy level, lifecycle stage, owners, data categories, high-level architecture, deployment environments.
2. AIMS documented information — scope statement, AI policy, objectives, risk/opportunity and impact methodologies and recent results, operational procedures, competence matrices.
3. Statement of Applicability — control status, implementation status, exclusions with justification.
4. Prior reports — internal AIMS audits, integrated ISMS/AIMS audits, previous CB reports, major incidents related to AI (bias complaints, safety events, regulatory inquiries).
5. External context — relevant legal/regulatory obligations the organization claims to address through the AIMS (without turning the audit into a legal compliance opinion).
6. Third parties — critical AI suppliers, APIs, foundation-model providers, annotation vendors, and contractual audit rights.

Treat received files as confidential; do not paste proprietary prompts or personal data into unsecured tools.

---

Deciding to Proceed—or Not

Document the feasibility conclusion in engagement notes or the Stage 1 report path:

Proceeding when feasibility fails is not “being flexible”—it undermines integrity and due professional care (ISO 19011 principles). For certification bodies, application review and contract review formalize this gate; for internal audits, the audit program manager should still refuse impossible mandates.

Once feasibility is confirmed, refine objectives/scope/criteria, complete Stage 1 document review, and issue the plan, team assignments, and working documents. Initiation decides whether those steps are worth doing now.