|
SERVICES › SAMPLES › AI GOVERNANCE › A10
Optional ISO/IEC 42001 readiness check (excerpt)
Part of the AI governance review worked example for Quillmarrow Supplies Pte. Ltd. (fictional). Read it here in full or download the files.
Fictional organisation, illustrative only, not a client case study « Back to the AI governance review pack
|
|
|
|
| A10 · Optional ISO/IEC 42001 readiness check (excerpt) |
| Organisation | Quillmarrow Supplies Pte. Ltd. (fictional) |
|---|
| Document | A10 · Optional ISO/IEC 42001 readiness check (excerpt) |
|---|
| Version | 1.0 |
|---|
| Date | 30 October 2026 (illustrative) |
|---|
| Prepared by | Alex Lew, reviewer and sign-off |
|---|
| Client approver (role) | Chief Operating Officer |
|---|
| Label | Fictional organisation, illustrative only, not a client case study |
|---|
Readiness check only. This excerpt considers readiness against ISO/IEC 42001:2023 Artificial intelligence - Management system and identifies documentation and control gaps. It is not an audit and does not provide certification. Certification is voluntary and is carried out by independent certification bodies, not ISO.
The assessment is limited to the information in this illustrative review. It does not establish whether Quillmarrow conforms to the standard. A document prepared in this pack is a starting point; it is not, by itself, evidence that management approved it or that a control operates.
The readiness labels mean: Not started — no relevant evidence supplied; Partial — some relevant information or proposed material is available, but significant evidence or decisions are missing; In place — the relevant arrangement and its operation are supported by sufficient evidence within the scope checked. A label is not an audit opinion.
Clauses 4 to 10
| Clause |
What it expects, in plain words |
What Quillmarrow has now |
Readiness |
Gap |
Pack deliverable that helps |
| 4 Context of the organisation |
Understand the organisation’s circumstances, interested parties and the intended boundaries of its AI management system. |
The case describes Quillmarrow’s business, technology, supplier relationship and reasons for the review; the register identifies 20 uses. |
Partial |
A documented organisation-wide management-system scope, interested-party analysis and their relevant expectations have not been supplied. |
A1 Engagement scope sheet; A2 AI use register |
| 5 Leadership |
Management should give the AI management system direction, assign responsibilities and support its operation. |
The COO is the programme sponsor, use owners are named and the MD approves High-tier uses. A policy is prepared for management approval. |
Partial |
Evidence of policy approval, organisation-wide management-system responsibilities and continuing leadership review has not been supplied. |
A4 AI-use policy; A9 Management report and action plan |
| 6 Planning |
Plan how to address relevant risks and opportunities, set objectives and manage changes. |
The register uses working tiers; the pack includes a risk-tiering method and three identified impact assessments. |
Partial |
Organisation-wide objectives, a documented planning process and evidence that planned actions are tracked have not been supplied. |
A3 Practical risk tiering; A5 AI impact assessments; A9 Management report and action plan |
| 7 Support |
Provide the resources, competence, communication and documented information needed to operate the system. |
Roles are identified and the proposed policy addresses staff guidance and acknowledgement. Selected evidence exists for individual uses. |
Partial |
A competence plan, training and acknowledgement records, document-control arrangements and evidence of resources have not been supplied. |
A4 AI-use policy; A6 Human oversight decision matrix |
| 8 Operation |
Put planned processes and controls into practice and manage AI-related risks through operation and change. |
Oversight is specified in the register; AI-03 has an approval-gate requirement and an agent-control specification. Evidence for several uses remains incomplete. |
Partial |
For AI-03, technical bounds, approval workflow and test evidence are missing. Operational evidence for other controls and a consistent change process are also incomplete. |
A5 AI impact assessments; A6 Human oversight decision matrix; A8 Agent governance checklist |
| 9 Performance evaluation |
Monitor and evaluate whether the management system and its controls are working, and provide management with the results. |
AI-14 has a forecast method note, override log and quarterly accuracy check. AI-10 has configuration, posting-permission and reconciliation evidence. |
Partial |
These examples do not establish organisation-wide evaluation. A management-system monitoring plan, internal audit evidence and management review records have not been supplied. |
A2 AI use register; A6 Human oversight decision matrix; A9 Management report and action plan |
| 10 Improvement |
Address problems, make corrections and improve the management system over time. |
The proposed policy provides an incident-reporting route, and the action plan can record owners and follow-up. A shared-folder near-miss is identified as a review trigger. |
Partial |
Records showing how issues are investigated, corrected, checked for effectiveness and used to improve the system have not been supplied. |
A4 AI-use policy; A9 Management report and action plan |
The register identifies complete evidence for AI-07, AI-10, AI-14 and AI-18. This supports consideration of those specific uses; it does not demonstrate that a whole management-system clause is in place. Evidence for AI-13 and AI-15 is missing, while the remaining register entries are partial.
Annex A themes
The following are plain-language themes for further consideration, not a control-by-control assessment. No Annex A control numbers are assigned here.
| Theme |
Readiness |
Illustrative position |
| Policies for AI |
Partial |
A staff AI-use policy is prepared for approval; approval and communication records are not supplied. |
| Internal organisation |
Partial |
The COO, use owners and MD have defined roles; wider management-system responsibilities need documenting. |
| Resources |
Partial |
The review identifies tools and responsible roles; a documented competence and resource assessment is missing. |
| Impact assessment |
Partial |
AIA-01, AIA-02 and AIA-03 are identified; assessment findings and supporting evidence are not all supplied. |
| AI system life cycle |
Partial |
The pack proposes approval, monitoring and change controls; consistent operation across the life cycle is not evidenced. |
| Data |
Partial |
Information categories and data-handling questions are identified; several vendor flows, settings and retention arrangements remain unconfirmed. |
| Information for interested parties |
Partial |
The enterprise customer questionnaire and proposed applicant and customer communications identify needs; approved communications and their use are not evidenced. |
| Use of AI systems |
Partial |
The register records statuses and intended human oversight; operation of several gates and checks remains unverified. |
| Third-party relationships |
Partial |
Vendor due diligence is requested, and partner data-processing terms for AI-18 are confirmed; evidence for other vendors remains incomplete. |
What a full readiness engagement would add
A full readiness engagement would be organisation-wide and separately quoted before it starts. It would agree the intended management-system boundary; examine the organisation’s context, governance and objectives; and review relevant documented processes and evidence across the business.
It would also consider applicable Annex A themes in greater depth, interview control owners, trace selected controls to supporting records, and develop a prioritised gap and action plan. Its scope and methods would be agreed separately. It would remain a readiness engagement, not certification or a guarantee of a certification outcome.
Suggested order of work
- Set the boundary. The COO should agree the intended AI management-system scope, relevant business activities and interested parties, including the Malaysia fulfilment relationship.
- Confirm leadership and ownership. Ask the MD to consider the proposed policy, confirm responsibilities and decide how management will oversee High-tier uses and unresolved gaps.
- Complete the evidence inventory. Use the register to identify missing settings, vendor terms, assessments and operating records; retain existing restrictions while gaps remain.
- Put priority controls into operation. Address AI-03’s approval and technical-control evidence, maintain the AI-04 hold, and define monitoring and intervention records for the other uses.
- Establish review and improvement. Agree objectives, staff guidance, monitoring, issue follow-up and management review; retain evidence of decisions and check whether corrective actions work.
About this sampleFictional organisation, illustrative only, not a client case study. Quillmarrow Supplies Pte. Ltd., its people, vendors, findings and dates are invented. Nothing in this document reports a client result. I personally review and sign off every deliverable. You appoint your own DPO. I support them. This is practical compliance support, not legal advice. For legal advice, use a Singapore-qualified lawyer. What's not included - Legal advice, legal opinions on vendor terms or regulatory representation.
- AI Verify technical testing, model benchmarking, penetration testing or security engineering, unless the relevant work is separately scoped.
- Building an AI system, implementing integrations or changing live permissions and configurations.
- Certification, a compliance guarantee or an assurance that a model cannot fail.
- An organisation-wide ISO/IEC 42001 readiness engagement unless expressly included in the quote.
- Healthcare-sector work or on-site delivery.
ISO/IEC 42001 work is a readiness check only, never certification. Questions about this sample: DM @alewyl1 on X, or ask for a free intro call (coffee chat). |
|
|
|
|
|