Why Clause 8 Is Where ISO 42001 Gets Real
If you have been auditing management systems for any length of time, you know that Clauses 4 through 7 are largely about intent. Context, policy, planning, competence. Important, yes, but they describe what an organisation says it will do. Clause 8 is where you find out whether it actually does it.
On this page
For ISO 42001, the AI management system standard, Clause 8 covers four distinct requirements: operational planning and control, AI risk assessment in operation, AI risk treatment in operation, and the AI system impact assessment. Each of these has its own audit logic, and together they form the most technically demanding part of any ISO 42001 audit.
This article walks through how to audit each of those requirements in practice. It is written for auditors who are either preparing to audit an AI management system for the first time or who want to sharpen their approach to a clause that many organisations still struggle to implement well.
Understanding the Structure of Clause 8
Before diving into audit technique, it helps to understand what ISO 42001 is actually asking for across Clause 8 as a whole.
- Clause 8.1 requires the organisation to plan, implement, control, and maintain the processes needed to meet its AIMS requirements and to implement the actions determined in Clause 6.
- Clause 8.2 requires the organisation to conduct AI risk assessments at planned intervals and when significant changes are proposed.
- Clause 8.3 requires the organisation to implement its AI risk treatment plan.
- Clause 8.4 requires AI system impact assessments to be conducted at planned intervals.
What makes this clause particularly interesting is the interplay between these four requirements. The risk assessment drives the risk treatment plan. The impact assessment is a separate but related activity that looks at consequences for people and society, not just organisational risk. As an auditor, you need to understand both the individual requirements and how they connect.
For a useful comparison of how operational controls are approached across different ISO standards, the article on Operational Planning and Control in ISO 42001: Clause 8.1 in Practice provides solid background before you go on site.
Exemplar Global Certified Training ProviderRTP No. 310970
Auditing Clause 8.1: Operational Planning and Control
What the Clause Actually Requires
Clause 8.1 is the operational backbone of the AIMS. The organisation must plan, implement, control, and maintain the processes needed to meet its requirements. It must also ensure those processes are carried out in accordance with the criteria established for them, and retain documented information to the extent necessary to have confidence that processes have been carried out as planned.
The clause also requires the organisation to control planned changes and review the consequences of unintended changes, taking action to mitigate adverse effects where necessary. Outsourced processes must be controlled or influenced as well.
What to Look for During the Audit
Start by identifying which AI systems are in scope. Ask the organisation to walk you through each system and explain what controls are in place to govern how it operates. You are looking for evidence that the organisation has translated its planning outputs from Clause 6 into actual operational practice.
Common questions to ask include:
- How do you determine the criteria for your AI system processes, and where are those criteria documented?
- How do you manage changes to AI systems, including updates to models, training data, or deployment environments?
- What happens when an AI system produces an unexpected output? Who is notified and what is the response process?
- How do you control AI systems or components that are provided by third parties?
A common gap at Clause 8.1 is that organisations have documented their AI systems at a high level but have not established specific process criteria. They can tell you what the system does, but they cannot show you the criteria against which they evaluate whether it is operating as intended. That is a finding worth raising.
Another gap is change management. AI systems change frequently, whether through model retraining, data pipeline updates, or changes to the underlying infrastructure. Ask specifically about how these changes are captured, reviewed, and approved before deployment. If the answer is that changes happen continuously and there is no formal review, you have a problem with Clause 8.1 and likely with Clause 6.3 as well.
Evidence to Collect
Useful evidence at Clause 8.1 includes process descriptions or operating procedures for AI systems, change request records, records of process monitoring, and any documented criteria used to evaluate AI system performance. Look for records that demonstrate the organisation has actually implemented its controls, not just written them down.
Auditing Clause 8.2: AI Risk Assessment in Operation
The Difference Between Planning and Operation
Clause 6.1.2 requires the organisation to establish and maintain an AI risk assessment process. Clause 8.2 requires that process to actually be run, at planned intervals and when significant changes are proposed or occur. This distinction matters. Planning a risk assessment process is not the same as conducting one.
The operational risk assessment requirement means the organisation must have a schedule or trigger mechanism for when assessments are conducted, and it must retain documented information as evidence that assessments have occurred.
Audit Questions for Clause 8.2
When auditing this clause, focus on three things: frequency, triggers, and outputs.
On frequency, ask the organisation how often it conducts AI risk assessments. What is the planned interval? Is there a schedule? Has it been followed? Look for records of assessments and check the dates against the stated schedule. If the organisation says it conducts assessments annually but the last one was eighteen months ago, that is a nonconformity.
On triggers, ask what constitutes a significant change that would prompt an assessment outside the scheduled cycle. Useful examples to probe include: a change in the AI model, a change in the data used to train or operate the system, a change in the deployment environment, or a change in the way the system outputs are used. If the organisation cannot articulate what would trigger an unscheduled assessment, or if it can articulate it but has no evidence of applying that trigger in practice, raise it as a finding.
On outputs, ask to see the results of the most recent risk assessment. Does it cover the AI systems in scope? Does it identify risks in a way that is consistent with the methodology established in Clause 6.1.2? Has it been reviewed and approved by someone with appropriate authority?
Common Nonconformities at Clause 8.2
The most common issue is that organisations conduct an initial risk assessment during implementation and then do not repeat it. The system goes live, time passes, and nobody revisits the assessment. This is particularly problematic for AI systems because the risk profile can change significantly as the system learns, as data changes, or as the context of use evolves.
A second common issue is that the trigger for an unscheduled assessment is not defined, or is defined but never applied. When you ask whether any significant changes have occurred since the last assessment, the answer is often yes. When you ask whether those changes prompted a new assessment, the answer is often no.
Auditing Clause 8.3: AI Risk Treatment in Operation
From Plan to Practice
Clause 8.3 requires the organisation to implement its AI risk treatment plan. This sounds straightforward, but in practice it means you need to verify that the controls identified in the risk treatment plan have actually been put in place and are operating effectively.
The risk treatment plan should have been established under Clause 6.1.3. Your job at Clause 8.3 is to confirm that what was planned has been implemented. This requires you to cross reference the treatment plan with operational evidence.
How to Audit This in Practice
Select a sample of risk treatment actions from the plan. For each one, ask the organisation to demonstrate that the action has been implemented. This might involve reviewing technical configurations, observing operational processes, interviewing staff, or examining records.
For example, if the risk treatment plan states that a human review step will be applied before any AI generated recommendation is acted upon, ask to see evidence of that review step in practice. Are there records of human review decisions? Is there a documented process for what happens when the reviewer disagrees with the AI output?
If the treatment plan states that certain data types will be excluded from training datasets to manage bias risk, ask how that exclusion is enforced. Is it a technical control, a procedural control, or both? Is there evidence that it has been applied?
The Link Between 8.2 and 8.3
One thing to watch for is whether the risk treatment plan has been updated following the operational risk assessments required by Clause 8.2. If a new risk has been identified in an operational assessment, has the treatment plan been updated to address it? If not, you have a gap that spans both clauses.
This cross clause linkage is important. ISO 42001 is designed as a system, and Clause 8 is where the system either holds together or falls apart. The article on Repeating AI Risk Assessment and Treatment in Operation: Clauses 8.2 and 8.3 goes deeper into this relationship and is worth reviewing before an audit.
Auditing Clause 8.4: The AI System Impact Assessment
What Makes This Requirement Unique
The AI system impact assessment is the requirement that most distinguishes ISO 42001 from other management system standards. It is not about organisational risk in the traditional sense. It is about the impacts that AI systems may have on individuals, groups, and society more broadly.
The standard requires organisations to conduct impact assessments at planned intervals. The assessment should consider impacts such as effects on privacy, fairness, human rights, safety, and the environment. The scope of what needs to be assessed will depend on the nature of the AI system and the context in which it operates.
For a thorough treatment of what this assessment involves conceptually, the article on AI Impact Assessments in Practice: From Fairness to Human Rights covers the key dimensions well.
What Auditors Need to Check
When auditing Clause 8.4, start by establishing whether the organisation has conducted an impact assessment at all. This sounds basic, but many organisations implementing ISO 42001 for the first time conflate the risk assessment with the impact assessment. They are related but distinct activities. The risk assessment is primarily concerned with risks to the organisation. The impact assessment is concerned with consequences for people and society.
Once you have confirmed an assessment exists, examine its scope. Does it cover all AI systems within the AIMS scope? Does it consider the range of impacts the standard contemplates? A common gap is an impact assessment that addresses only one dimension, such as data privacy, while ignoring others such as fairness, safety, or broader societal effects.
Check the frequency of the assessment. Clause 8.4 requires it to be conducted at planned intervals, which means the organisation should have a defined schedule and evidence that the schedule has been followed. Ask when the last assessment was conducted and request the documented output.
Audit Questions for Clause 8.4
Useful questions to ask during the audit include:
- How do you define the scope of your impact assessment? Which AI systems are included and why?
- What dimensions of impact does your assessment consider? Walk me through the methodology.
- Who conducts the assessment? What is their competence to evaluate impacts on affected individuals and communities?
- What happens when the assessment identifies a significant negative impact? What is the response process?
- How often do you conduct the assessment, and how do you decide whether a change to an AI system triggers an interim assessment?
- Can you show me the output of your most recent assessment and explain what actions were taken as a result?
Common Gaps at Clause 8.4
The most common gap is that the impact assessment has been conducted once, at implementation, and not repeated. Like the risk assessment, the impact assessment needs to be a living activity. As AI systems evolve, as their use cases expand, and as the populations they affect change, the impact profile changes too.
A second common gap is that the assessment is superficial. It identifies potential impacts in general terms but does not engage with the specific characteristics of the AI system in question. An auditor reviewing a facial recognition system should expect to see a much more detailed treatment of fairness and bias than an auditor reviewing a document classification tool.
A third gap is lack of evidence that findings from the impact assessment have driven any action. If the assessment identifies a risk of discriminatory outcomes but there is no corresponding treatment, no monitoring, and no change to how the system operates, the assessment is not fulfilling its purpose.
Exemplar Global Certified Training ProviderRTP No. 310970Connecting Clause 8 to the Rest of the AIMS
One of the most effective audit approaches for Clause 8 is to trace a thread through the entire system. Start with an AI system, follow it through the risk assessment, into the risk treatment plan, through the operational controls, and into the impact assessment. Then check whether the findings from each of those activities have fed back into the planning processes and into management review.
If the system is working as intended, you should be able to follow that thread without losing it. If you find a break in the chain, whether a risk that was identified but not treated, a treatment that was planned but not implemented, or an impact assessment that was conducted but not acted on, that is where your findings will be.
This process based approach to auditing is more effective than working through the clauses in sequence. It gives you a realistic picture of how the AIMS functions in practice, and it tends to surface the most significant gaps rather than minor documentation issues.
Preparing for a Clause 8 Audit: Practical Tips
Before going on site, review any documentation the organisation has provided. This should include the AI risk assessment, the risk treatment plan, and any impact assessment reports. Look for internal consistency. Do the risks in the assessment match the treatments in the plan? Does the impact assessment cover the same systems as the risk assessment?
Prepare a sample of AI systems to examine in detail. If the organisation operates multiple AI systems, you will not have time to examine all of them. Select a sample that is representative of the range of systems, including those with higher risk profiles and those that affect external parties.
Prepare questions in advance, but be ready to follow the evidence wherever it leads. Clause 8 audits often surface issues that were not visible in the documentation review. An AI system that looks well controlled on paper may have significant operational gaps when you start asking specific questions about how it actually runs.
If you are building your skills in this area, the ISO 42001 Lead Auditor training at Audit Workshop covers the full audit process for AI management systems, including detailed guidance on Clause 8 and the impact assessment requirement. The training is delivered by auditors with real certification audit experience, which means you get practical technique rather than a clause by clause recitation of the standard.
