Auditing Corrective Action and Continual Improvement in ISO 42001

Why Clause 10 Matters More in an AI Management System

Auditing corrective action and continual improvement in ISO 42001 is not a routine end-of-checklist exercise. Clause 10 of an AI Management System (AIMS) sits at the point where everything else either proves itself or falls apart. If the organisation is genuinely learning from AI-related incidents, near misses, and audit findings, you will see it here. If it is not, Clause 10 is where the gaps become impossible to hide.

ISO 42001 brings a particular challenge that auditors familiar with ISO 9001 or ISO 27001 need to appreciate before they walk in. AI systems are dynamic. They can drift, degrade, and produce unexpected outputs in ways that a static product or a fixed information asset does not. That means nonconformities in an AIMS can emerge faster, have broader consequences, and require more nuanced root cause analysis than auditors are used to seeing in other management system contexts.

This article walks through how to audit Clauses 10.1 and 10.2 of ISO 42001 with the rigour and scepticism that AI governance actually demands. The focus is on practical audit technique, what evidence to gather, what questions to ask, and what weak responses look like so you can distinguish genuine improvement from documentation theatre.

Understanding What Clause 10 of ISO 42001 Requires

Before you can audit effectively, you need to be clear on what the standard actually asks. ISO 42001 Clause 10 follows the High Level Structure used across all modern ISO management system standards, so the architecture will be familiar. The substance, however, has some important distinctions when applied to AI.

Clause 10.1: Continual Improvement

Clause 10.1 requires the organisation to continually improve the suitability, adequacy, and effectiveness of its AIMS. That is the same language used in ISO 9001, ISO 14001, and ISO 45001. What differs is the context. An AI system that was appropriate twelve months ago may no longer be adequate if the model has been retrained, the use case has expanded, or the regulatory environment has shifted. Improvement in an AIMS is not just about fixing what went wrong. It is about staying ahead of a technology that changes underneath you.

For a deeper look at what continual improvement requires under this clause, see Continual Improvement in ISO 42001: Making Clause 10.1 Real.

Clause 10.2: Nonconformity and Corrective Action

Clause 10.2 sets out the corrective action process. When a nonconformity occurs, the organisation must react to it, evaluate the need for action to eliminate the cause, implement any necessary corrective action, and review its effectiveness. Documented information is required as evidence of the nature of the nonconformity, the actions taken, and the results of the corrective action.

This is familiar territory for experienced auditors. The challenge in an AIMS context is that the causes of nonconformities are often less obvious. A model producing biased outputs is a nonconformity, but the root cause might sit in training data, in the objective function, in deployment conditions, or in a combination of all three. Auditors need to push harder on root cause analysis here than they might in a traditional quality or safety audit.

For the clause requirements in detail, see Nonconformity and Corrective Action Under ISO 42001 Clause 10.2.

Starting the Audit: Setting Up for Clause 10

Before you begin sampling corrective actions, spend time understanding the inputs that should be feeding into the improvement process. Clause 10 does not operate in isolation. It draws on outputs from performance monitoring under Clause 9.1, internal audit findings from Clause 9.2, management review decisions from Clause 9.3, and AI system impact assessments under Clause 8.4. If those upstream processes are weak, the corrective action register will be thin and the improvement picture will be distorted.

Start your document review by asking for:

• The corrective action register or equivalent tracking tool
• Recent internal audit reports and their associated corrective actions
• The most recent management review minutes, specifically the section on improvement actions
• Any AI incident or near miss logs
• Impact assessment records and any remediation actions arising from them

Look at the volume of entries relative to the size and complexity of the AI systems in scope. A large organisation running multiple high-risk AI applications with only two or three corrective actions raised in twelve months is a red flag. Either the monitoring processes are not finding issues, or issues are being found but not being formally recorded. Both scenarios warrant investigation.

Auditing the Corrective Action Process: What Good Looks Like

When you move into the evidence-gathering phase, the corrective action process needs to be tested end to end. Many auditors make the mistake of reviewing only the documentation and accepting it at face value. The real test is whether the process is working, not whether it is documented.

Step One: Reaction to the Nonconformity

ISO 42001 Clause 10.2 requires the organisation to take action to control and correct the nonconformity and deal with the consequences. For AI-related nonconformities, this might mean suspending a model, restricting its outputs, issuing corrections to affected parties, or escalating to regulators depending on the jurisdiction and the nature of the AI system.

Ask the auditee to walk you through a specific nonconformity from identification to initial response. Questions to use include:

• When was this identified and by whom?
• What immediate action was taken to contain the impact?
• Who was notified and when?
• Was there any obligation to report this externally, and if so, was that obligation met?

Watch for situations where the immediate response was adequate but undocumented, or where the response was delayed because there was no clear escalation path. Both are findings worth noting.

Step Two: Root Cause Analysis

This is where ISO 42001 audits get genuinely interesting. The standard requires the organisation to evaluate the cause of the nonconformity so that it does not recur or occur elsewhere. Root cause analysis for AI-related issues requires technical understanding that goes beyond what a standard corrective action form typically captures.

Common weaknesses you will encounter include:

• Root cause recorded as human error with no further analysis of why the error occurred or what system conditions enabled it
• Root cause focused on the symptom rather than the underlying cause, for example, model output was incorrect rather than investigating why the model produced that output
• Root cause analysis completed by the same person who owns the process, with no independent review
• No consideration of whether the same root cause could produce nonconformities in other AI systems within scope

Ask to see the methodology used for root cause analysis. Five Whys, fishbone diagrams, and fault tree analysis are all acceptable approaches. What matters is that the analysis is genuinely investigative, not a box-ticking exercise. If every corrective action has the same root cause recorded in similar language, that is a sign the process is not functioning as intended.

The skills involved in distinguishing genuine root cause analysis from superficial documentation are covered well in Root Cause Analysis for Corrective Actions: A Practical Guide for ISO Auditors.

Step Three: Implementing Corrective Action

Once the root cause is understood, the organisation must implement corrective action. In an AIMS context, this might involve retraining a model, revising data governance procedures, updating the AI impact assessment, modifying the risk treatment plan, or changing the human oversight arrangements for a particular system.

Check that the corrective action actually addresses the root cause, not just the symptom. A common pattern is for organisations to implement a procedural fix, such as adding a review step, when the root cause is actually a systemic gap in competence or a flawed design decision in the AI system itself. A procedural fix on top of a design problem is not a corrective action. It is a workaround.

Also check that corrective actions have been assigned to specific owners with defined completion dates. Unassigned actions or actions with no target date are rarely completed on time, and often not completed at all.

Step Four: Reviewing Effectiveness

This is the step most organisations handle poorly. The standard requires the organisation to review the effectiveness of any corrective action taken. That means going back after the action has been implemented and checking whether the nonconformity has actually been resolved and whether the root cause has been eliminated.

Ask to see evidence of effectiveness reviews. What you are looking for is some form of verification activity, not just a tick in a box. For AI-related corrective actions, effectiveness review might involve reviewing model performance data after retraining, checking audit results from a subsequent internal audit, or reviewing incident logs to confirm the issue has not recurred.

If the organisation cannot show you evidence of effectiveness reviews, or if every corrective action is marked as effective without any supporting evidence, that is a nonconformity against Clause 10.2.

Auditing Continual Improvement: Going Beyond Corrective Action

Corrective action is reactive. Continual improvement under Clause 10.1 should also be proactive. The distinction matters and is worth testing explicitly during the audit.

Ask the organisation to give you examples of improvement initiatives that were not triggered by a nonconformity or an audit finding. These might include:

• Proactive updates to the AI impact assessment methodology based on emerging best practice
• Enhancements to transparency or explainability features in AI systems based on user feedback
• Revisions to the AI objectives under Clause 6.2 to reflect higher performance targets
• Improvements to the training data governance process based on lessons learned from other organisations or industry guidance

If every improvement the organisation can point to was triggered by a finding from an audit or a regulatory prompt, the improvement culture is reactive rather than genuinely continual. That is worth noting as an observation, and in some contexts it may rise to a nonconformity depending on what the management review records show about proactive improvement planning.

Linking Improvement to AI Objectives

One of the more powerful tests for continual improvement is to trace the connection between the organisation's AI objectives under Clause 6.2 and the improvement actions being taken. If the objectives are meaningful and measurable, there should be a visible connection between performance against those objectives and the improvement initiatives underway.

For example, if an organisation has set an objective to reduce the rate of erroneous AI-generated decisions by fifteen percent over twelve months, you would expect to see monitoring data showing progress against that target, analysis of where the remaining errors are occurring, and improvement actions directed at the most significant contributors to the error rate.

If the objectives and the improvement actions are disconnected, that suggests the management system is not functioning as an integrated whole. The objectives are being maintained for compliance purposes rather than being used to drive genuine improvement.

Common Nonconformities Auditors Find in Clause 10

Based on audit experience across AI governance and related management systems, the following patterns come up repeatedly when auditing Clause 10 of an AIMS:

• Corrective action register not maintained: Actions are identified verbally or in meeting minutes but never formally recorded or tracked to closure
• Root cause analysis absent or superficial: The form has a root cause field but it contains a one-line description of the symptom rather than an analysis of underlying causes
• No effectiveness review: Actions are marked as closed when the task is completed, not when effectiveness has been verified
• Improvement confined to corrective action: The organisation cannot demonstrate any proactive improvement activity that was not triggered by a finding or an incident
• AI-specific issues not captured: The corrective action process handles quality and safety issues but AI-related concerns such as model drift, bias incidents, or transparency failures are handled informally outside the AIMS
• No linkage to management review: Corrective action status and improvement trends are not being reported to management review, meaning top management has no visibility of the improvement picture

Practical Interview Questions for Clause 10

When interviewing the person responsible for the corrective action process, these questions tend to generate useful evidence:

1. Can you show me the last three corrective actions raised and walk me through the status of each one?
2. How does the organisation decide whether an issue requires a corrective action or can be dealt with informally?
3. What method do you use to identify root causes, and who is responsible for completing that analysis?
4. How do you verify that a corrective action has actually worked before closing it?
5. Can you give me an example of an improvement that was not triggered by an audit finding or an incident?
6. How does the corrective action register feed into management review?
7. Have there been any AI-specific incidents in the past twelve months, and if so, how were they handled through this process?

Listen carefully to how the answers are framed. Confident, specific answers with reference to actual records are a good sign. Vague answers, answers that refer to what the process is supposed to do rather than what it actually does, or answers that require multiple follow-up questions to get to specifics are signals that the process may not be functioning as documented.

The skill of distinguishing genuine evidence from inference is something every auditor needs to develop. For a practical treatment of this skill, see Evidence or Inference? Sharpening Your Judgement as an Internal Auditor.

Documenting Your Findings

When you write up findings from Clause 10, be specific. A finding that says corrective action process is not effective is not useful to the auditee and will not drive meaningful improvement. A finding that says the organisation cannot demonstrate effectiveness reviews for any of the six corrective actions reviewed, as required by Clause 10.2(f), is specific, evidence-based, and actionable.

For each finding, record:

• The specific requirement of the standard that has not been met
• The objective evidence you reviewed that demonstrates the gap
• The clause reference

Observations and opportunities for improvement that do not rise to the level of a nonconformity should also be recorded, particularly where you can see the corrective action process functioning but with gaps that could undermine its effectiveness over time.

Building Your ISO 42001 Audit Capability

Auditing an AI Management System effectively requires a combination of standard auditing technique and genuine familiarity with the ISO 42001 requirements. Clause 10 is not technically complex, but applying it to an AI context demands that you understand how AI systems can fail, how root causes in AI governance differ from root causes in traditional quality or safety management, and how to probe beyond documentation to test whether improvement is real.

If you are building your capability in this area, Audit Workshop offers a dedicated ISO 42001 Lead Auditor course that covers the full clause structure including Clause 10, with practical exercises grounded in real AI governance scenarios. The course is delivered by Dilawar Laghari, a certified lead auditor with over fourteen years of compliance experience and more than five hundred external certification audits completed across Australia, the Middle East, and South Asia. Whether you are new to AI auditing or adding ISO 42001 to an existing auditor credential, the training is designed to give you practical skills you can apply immediately.