An ISO 42001 audit fails for ordinary reasons: nobody owns the model, the impact file is blank, and the policy was signed and then ignored. Stage 1 can still pass on paper. Stage 2 samples the live system. These ten findings are the pattern that shows up before that visit, and each one has a close-out a team can finish.

How an ISO 42001 audit samples a live system

Stage 1 is the documentation review. The ISO 42001 Stage 2 audit samples implementation: a system in the inventory, a person who can explain it, and a record that matches what the screen shows. These audit findings are a pattern across firms, not a file taken from a named client. Read the audit findings against your own inventory before you book dates. The audit findings that matter are the ones a paper review cannot see.

Fix them before the ISO 42001 Stage 2 audit, while the owners still have a calendar. Do not book the ISO 42001 Stage 2 audit while the register is still called Final_v7. A certification body decides the result. Seven Step Consulting does not issue ISO certificates. Check that the body’s accredited scope includes ISO/IEC 42001:2023 on the NABCB or IAF directory. NABCB accredits management-system bodies in India. Bring the system owner, not only the policy author. An ISO 42001 audit that never opens a screen is not finished.

The AIMS is clauses 4 to 10 plus Annex A, 38 controls under A.2 to A.10. The Statement of Applicability says which apply and why. An AI impact assessment looks at people. An AI risk assessment looks at harm. ISO 27001 may already cover security. It does not name the model.

What to close on an ISO 42001 audit file before the visit

1. No system inventory

The sample asks for a list and gets a strategy slide. On an ISO 42001 audit, a claim that the team “knows what it runs” is not a record. Fix: one register with name, owner, purpose, built or bought, and whether someone can already use it. A pilot a user can touch counts.

2. Policy signed and ignored

The PDF has a signature. The team that ships the model has not opened it. An ISO 42001 audit compares the rule with a real change. Fix: a short policy an operator can apply, plus one record that a live system was checked against it. If the rule cannot be followed on a Tuesday, rewrite the rule. Do not add another signature page.

3. Impact assessment missing

Risk rows talk about downtime. Nobody wrote who could be disadvantaged. An ISO 42001 audit treats a blank impact file as a hole, not as a task for later. Fix: an AI impact assessment for systems that affect a person. Name them in plain words: a borrower, a patient, a job applicant, a customer who will act on the answer. ISO/IEC 42005 is the guidance. You do not need a novel. You need the people and the harm.

4. Intended use written as marketing

The purpose line says “drive impact” or “delight customers” and stops. The fix is operational: who uses it, what decision it influences, and what it must not do. An ISO 42001 audit will read the purpose against a ticket, a prompt, or a score the business actually used.

5. Supplier model left outside scope

A vendor model answers customers, and the inventory says it is not yours. It is your use. Annex A.10 covers suppliers. Fix: put it in scope, name the subprocessor, and record what you can show. If the contract blocks evidence, write that in the Statement of Applicability. An ISO 42001 audit will ask for the clause, not for a hope that the vendor is fine.

6. No one can report a concern

Staff know the model misleads people. There is no path except a complaint to the person who bought it. Fix: a channel a user or an employee can find, with a named reader. An ISO 42001 audit will ask for one real report, or an honest “none received,” with the channel still visible.

7. Logs not kept

Something went wrong last quarter. Nobody can show the input, the output, or who changed the prompt. Missing logs hurt on an ISO 42001 Stage 2 audit because the sample asks for an event. Fix: what you keep, for how long, and who can read it. If prompts hold personal data, note the DPDP Act clock. As of 31 October 2026, Rules 1, 2 and 17 to 21 are in force. Rules 3, 5 to 16, 22 and 23 commence on 13 May 2027. An ISO 42001 audit will not accept a folder of random screenshots.

8. Statement of Applicability copied, every control yes

Someone pasted Annex A and marked all 38 controls applicable, with no reason. That is not a judgment. Fix: a working session. For each control, applicable or not, and why. A “no” with a reason is stronger than a reflexive yes. Tie yes-rows to evidence: a record, a log, a role. An ISO 42001 audit samples the yes-rows. A column of ticks with empty folders is a finding you wrote yourself.

9. Internal audit sampled the manual only

Clause 9.2 happened. The reader opened the policy and interviewed the person who wrote it. No live system was opened. That pass will be repeated, less gently, at the ISO 42001 Stage 2 audit. Fix: sample one system end to end, including a change and the supplier if one sits in the path. An ISO 42001 audit respects a narrow sample that is real.

10. Management review with no inputs

A meeting was held. The minutes say “AIMS reviewed, no issues.” There is no list of inputs. Clause 9.3 expects them: audit results, incidents, changes to systems, objectives, and what interested parties raised. Fix: put those inputs in the pack before the meeting, not as a paragraph typed afterward. If nothing happened, say what you checked to know that. An ISO 42001 audit reads the minutes against the register.

Ten ISO 42001 audit findings a team can close before the Stage 2 sample
Item Close it with
No inventory One register, including pilots and bought tools
Policy ignored A rule an operator can follow, and one check against a live system
No impact record The people named, and the harm stated
Purpose is a slogan Users, the decision, and one use that is banned
Supplier model out The contract, the subprocessor, and evidence you can show
No concern path A channel a user can actually find
No logs What is kept, for how long, and who may read it
SoA all yes A reason on every row, including the honest nos
Manual-only internal audit One live system opened end to end
Review with no inputs A pack of inputs before the meeting, not after

Close-out before dates are locked

Leave the record where an ISO 42001 Stage 2 audit team can open it without a hunt. A tracker for audit findings needs an owner and a date. Close the live-customer items before you polish wording. Stage 2 follows the customer path. Put the evidence on the same row as the system. An ISO 42001 audit should not depend on a search through old chat.

A surveillance audit the next year asks what changed. If the close-out was a speech, year two repeats year one. One list of audit findings stops two owners from closing the same row. Number the close-outs. An ISO 42001 audit moves faster when each open item already has a name and a date.

Book the review before the dates

Pre-audit readiness review is a working session on the ten items, not a certificate rehearsal. Write through https://www.sevenstepconsulting.com/contact-us/ and say which systems are already in front of customers. We will tell you which three items will actually move a Stage 2 sample, and which ones are noise.