Why Clause 4 Is the Foundation of Every ISO 42001 Audit
When you walk into an ISO 42001 audit, the temptation is to head straight for the operational controls, the AI risk assessments, and the impact assessments. Those are the visible, tangible parts of an AI Management System (AIMS). But if you skip past Clause 4, or treat it as a quick tick before the real work begins, you will miss the very foundation that everything else rests on.
On this page
Clause 4 of ISO 42001 asks three interconnected questions. What is this organisation's context in relation to AI? Who are the interested parties that matter? And critically, what role does this organisation actually play in the AI ecosystem? The answers to those questions determine the scope of the AIMS, the nature of the risks, and the controls that should be in place. Get Clause 4 wrong and you are auditing against the wrong criteria for the rest of the day.
This article walks through how to audit organisational context and AI roles under ISO 42001 in a way that produces genuine audit value, not just a set of ticked boxes. It draws on the practical realities of auditing organisations that are early in their AI governance journey, which is the reality you will face in most engagements right now.
Understanding What ISO 42001 Clause 4 Actually Requires
Before you can audit Clause 4 effectively, you need to be clear on what it requires. The clause follows the familiar Harmonised Structure pattern used across modern ISO management system standards, but the content is specific to AI and carries nuances that do not exist in ISO 9001 or ISO 45001.
Clause 4.1: Understanding the Organisation and Its Context
This clause requires the organisation to determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcomes of the AIMS. That is the standard Harmonised Structure language. What makes it distinctive in ISO 42001 is the AI lens through which those issues must be viewed.
External issues relevant to an AI context might include the regulatory environment around AI (including Australia's voluntary AI Ethics Framework and emerging legislation), public trust in AI systems, industry sector expectations, and the pace of technological change in the AI tools the organisation uses. Internal issues might include the organisation's existing data governance maturity, the technical competence of its AI teams, its culture around accountability, and the degree to which AI decisions are currently documented and reviewed.
When you audit this clause, you are not just looking for a context document. You are checking whether the organisation has genuinely thought through how AI specifically shapes its internal and external landscape, and whether that thinking is current and connected to the rest of the AIMS.
Clause 4.2: Understanding the Needs and Expectations of Interested Parties
Clause 4.2 requires the organisation to identify interested parties relevant to the AIMS and understand their needs and expectations. In an AI context, the interested party landscape is broader and more complex than in a typical quality or safety management system.
Interested parties in an ISO 42001 context typically include customers who receive outputs from AI systems, workers whose roles are affected by AI, regulators with oversight of AI use, suppliers of AI tools and data, shareholders and investors concerned about AI risk, and in some cases the individuals whose data is processed by AI systems. The individuals affected by AI decisions are a particularly important category that organisations often underestimate.
Your audit here should probe whether the organisation has identified the right parties, whether it has genuinely assessed what those parties need and expect in relation to AI governance, and whether those needs have been translated into requirements that shape the AIMS.
Clause 4.3: Determining the Scope of the AIMS
Scope determination in ISO 42001 is more complex than in most other standards because the organisation must define not just what business functions are included, but which AI systems are within scope. An organisation might operate dozens of AI tools but choose to scope the AIMS around only those that pose meaningful risk or that are customer facing.
When auditing scope, you need to understand whether the boundaries are reasonable and honestly drawn, or whether the organisation has scoped out its highest risk AI applications to make certification easier. A scope that covers only low risk, internal AI tools while leaving customer facing AI systems outside the boundary should prompt hard questions.
Clause 4.4: The AI Management System
Clause 4.4 requires the organisation to establish, implement, maintain, and continually improve the AIMS. At this stage of the audit, you are confirming that the system exists as a coherent whole, not just a collection of documents. The processes must be determined, their interactions understood, and the system must be capable of achieving its intended outcomes.
Exemplar Global Certified Training ProviderRTP No. 310970
Auditing AI Roles: The Most Important Thing to Get Right
One of the most distinctive features of ISO 42001 is its requirement for organisations to identify their role in the AI ecosystem. This is not a generic management system concept. It is specific to AI and it has a direct impact on what the AIMS must contain and what controls are appropriate.
The Three Roles: Provider, Producer, and Customer
ISO 42001 recognises that organisations can occupy different positions in relation to AI systems. The standard uses the terms provider, producer, and customer, though in practice many organisations occupy more than one role simultaneously.
An AI provider is an organisation that makes AI systems available for use by others. A software company that builds and sells an AI powered document processing tool is a provider. A provider carries responsibility for the design, training, and behaviour of the AI system it offers to the market.
An AI producer (sometimes referred to as a developer) is an organisation that develops AI systems, typically for its own use or as part of a product. The distinction between provider and producer can blur in practice, particularly for organisations that build AI internally and then deploy it to customers.
An AI customer is an organisation that uses AI systems developed or provided by others. Most organisations in Australia fall into this category. A business that uses a third party AI tool for recruitment screening, contract analysis, or customer service chatbots is acting as an AI customer.
Why Role Determination Matters for Your Audit
The role an organisation occupies determines the nature of its AI risks and the controls it needs to implement. A provider needs robust processes for AI system design, testing, bias assessment, and documentation for users. A customer needs processes for evaluating the AI systems it procures, understanding their limitations, and managing the risks of using AI outputs in its decisions.
When you audit Clause 4, you need to confirm that the organisation has formally identified its role or roles, that the AIMS has been designed with those roles in mind, and that the controls in place are appropriate to the actual role. An organisation that has identified itself only as a customer but is in fact customising and deploying AI models for clients is operating as a provider without the corresponding governance controls. That is a significant finding.
For a practical deep dive into how organisations determine their AI role and what that means for their AIMS, the published article Provider, Producer or Customer: Determining Your AI Role Under ISO 42001 is worth reviewing before your audit preparation.
Practical Audit Approach: How to Actually Audit Clause 4
Document Review Before the Audit
Before you arrive on site or join the remote session, request the following documents for review. First, the context analysis or equivalent document that captures the organisation's internal and external issues relevant to AI. Second, the interested party register, including what needs and expectations have been identified. Third, the AIMS scope statement, including any exclusions and the AI systems that are within scope. Fourth, any documentation that describes the organisation's AI role or roles.
Read these documents critically. Look for whether the context analysis actually addresses AI specific issues or whether it is a generic management system context document with AI bolted on. Look for whether the interested party register includes the individuals affected by AI decisions, not just the obvious commercial stakeholders. Look for whether the scope statement clearly identifies which AI systems are included and why.
Opening Meeting and Initial Framing
In the opening meeting, set the expectation that Clause 4 will be a substantive part of the audit, not a five minute warm up. Many auditees expect auditors to spend most of their time on operational controls and treat context as a formality. Let them know early that you will be spending real time on it.
Ask the management representative or AI governance lead to walk you through the organisation's AI landscape at a high level before you start sampling. You want to understand what AI systems are in use, what decisions those systems influence, and who is affected by those decisions. This gives you the map you need to audit Clause 4 meaningfully.
Interview Questions for Clause 4.1
When interviewing the person responsible for the context analysis, use questions like these. What external factors have you considered in relation to your AI use? How has the regulatory environment around AI influenced your AIMS? What internal factors affect your ability to govern AI effectively? How recently was this analysis reviewed and what prompted the last update? What would change in your AI context if a key AI supplier changed their terms of service?
You are looking for genuine engagement with these questions, not rehearsed answers that recite the document back to you. If the person responsible cannot explain the context in their own words, that is a sign the analysis was prepared for certification rather than for governance.
Interview Questions for Clause 4.2
For interested parties, ask who the organisation considers to be affected by its AI systems, beyond the obvious commercial relationships. Ask how the organisation knows what those parties expect in relation to AI governance. Ask whether the organisation has engaged directly with any of those parties about AI risks or concerns. Ask how interested party needs are translated into AIMS requirements.
Pay particular attention to whether the organisation has considered the people whose data is processed by AI systems or whose lives are affected by AI decisions. In recruitment AI, for example, job applicants are a significant interested party. In credit scoring AI, loan applicants are affected. If these groups are absent from the interested party register, that is worth noting.
Auditing the Scope Statement
The scope statement should clearly define the boundaries of the AIMS. When auditing it, ask the AI governance lead to walk you through what is inside the scope and what is outside. Then ask why. If AI systems that carry significant risk are outside the scope, you need to understand the rationale.
Common scope issues you will encounter include organisations that have scoped in only their most visible AI system while leaving others unaddressed, organisations that have defined scope in terms of business units rather than AI systems making it ambiguous which systems are actually covered, and organisations that have not updated their scope as new AI tools have been adopted.
The article Defining the Scope of Your AI Management System Under Clause 4.3 provides useful background on what a well constructed scope looks like, which helps calibrate your expectations during the audit.
Auditing AI Role Identification
This is where many ISO 42001 audits surface their most interesting findings. Ask the organisation to show you where it has documented its AI role or roles. Then probe whether that identification is accurate.
Ask questions like: Do you use AI systems developed by third parties? Do you modify or fine tune any of those systems? Do you provide AI outputs or AI powered services to your customers? Do you develop any AI systems internally? The answers will tell you whether the organisation's self identified role matches its actual activities.
A common finding is an organisation that has identified itself as an AI customer but has in fact fine tuned a large language model for its own use and is now providing AI powered outputs to clients. That organisation is operating as both a producer and a provider, and its AIMS should reflect that. If it does not, the risk assessment, the controls, and the scope are all potentially inadequate.
Common Findings When Auditing Clause 4 of ISO 42001
Context Analysis That Is Generic Rather Than AI Specific
The most common finding is a context analysis that reads like it was written for ISO 9001 and then had the word AI inserted a few times. The issues identified are vague, the AI specific regulatory landscape is not addressed, and there is no evidence that the analysis has been reviewed since the AIMS was first established. This is typically a minor nonconformity against Clause 4.1, but it can escalate to major if the context analysis is so disconnected from reality that the AIMS has been built on false premises.
Interested Party Register Missing Affected Individuals
As noted above, many organisations focus their interested party analysis on commercial stakeholders and miss the individuals whose lives are affected by AI decisions. This is particularly significant for organisations using AI in areas like recruitment, lending, insurance, or healthcare. Raise this as a nonconformity or at minimum a significant observation.
Scope That Excludes High Risk AI Systems
If the scope statement excludes AI systems that carry significant risk, and the organisation cannot provide a reasonable justification, that is a finding. The scope must be appropriate to the organisation's actual AI activities, not just the ones that are easy to govern.
Role Identification That Does Not Match Actual Activities
As described above, organisations frequently misidentify their role. This is not always deliberate. Many organisations genuinely have not thought carefully about whether their use of AI tools constitutes production or provision in the sense ISO 42001 intends. Your job as auditor is to help them see the gap, not to catch them out.
Exemplar Global Certified Training ProviderRTP No. 310970Connecting Clause 4 to the Rest of the Audit
The findings from your Clause 4 audit should inform everything that follows. If the context analysis is weak, you should expect the risk assessment to be similarly shallow. If the role identification is inaccurate, the controls are likely to be misaligned. If the scope is too narrow, you may find that significant AI risks are simply not addressed anywhere in the AIMS.
Make explicit connections in your audit notes and your report. If you find a weak context analysis in Clause 4 and then find that the risk assessment does not address the regulatory risks that should have been identified in the context, connect those findings. That pattern tells a more meaningful story than two isolated observations.
For auditors who want to build their competence across the full ISO 42001 audit process, including how to audit operational controls and impact assessments, the article Auditing Operational Controls and Impact Assessments Under Clause 8 picks up where this article leaves off.
Building Your Competence to Audit ISO 42001
ISO 42001 is a genuinely new standard and auditing it well requires more than familiarity with the Harmonised Structure. You need to understand how AI systems work at a conceptual level, what AI specific risks look like, and how the standard's unique requirements around role identification and impact assessment differ from anything in ISO 9001 or ISO 27001.
If you are an internal auditor looking to add ISO 42001 to your scope, or a lead auditor preparing to conduct third party AIMS audits, structured training is the most efficient path. Audit Workshop offers ISO 42001 auditor training at Foundation, Internal Auditor, and Lead Auditor levels, built around practical audit scenarios rather than abstract theory. The courses are designed for practitioners who already understand management systems and want to apply that knowledge to the AI governance space quickly and competently. You can explore the available courses at auditworkshop.com.
