AIGO — ISO/IEC 42001 Assurance Mapping

1. Document Purpose

This document defines the AIGO assurance mapping for ISO/IEC 42001:2023, connecting the requirements of an Artificial Intelligence Management System (AIMS) to assurance activities within the AIGO framework. ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an AIMS for organizations that provide or use AI-based products or services. The purpose of this mapping is to establish an assurance architecture covering:

management-system conformity;
control design;
control implementation;
operating effectiveness;
documented information;
evidence quality;
risk and opportunity management;
AI lifecycle governance;
performance evaluation;
internal audit;
management review;
corrective action;
continual improvement;
certification readiness; and
external certification boundaries.

This document is an operational AIGO assurance mapping. It does not constitute an ISO/IEC 42001 audit, certification, accreditation, conformity assessment, or audit opinion.

2. Mapping Information

Field	Value
Mapping	AIGO ISO/IEC 42001 Assurance Mapping
Version	0.1
Status	Draft
Document Identifier	`AIGO-MAP-ISO42001-009`
Document Type	ISO Management-System Mapping
Mapping Package	`AIGO-MAP-ISO42001`
Primary Standard	ISO/IEC 42001:2023
Standard Edition	First edition
Publication	December 2023
Primary Assurance Areas	Clauses 9 and 10, plus relevant requirements throughout the AIMS
Supporting Standard	ISO/IEC 42006:2025
Architecture	`AIGO-MAP-ISO42001-ARCH-001`

ISO/IEC 42006:2025, published in July 2025, specifies additional requirements for bodies auditing and certifying AIMS against ISO/IEC 42001 and supplements ISO/IEC 17021-1. It is therefore relevant to the external-certification boundary but does not replace ISO/IEC 42001 or define AIGO’s internal assurance process.

3. Assurance Principle

AIGO assurance should establish whether the organization’s AIMS governance is:

appropriately designed;
implemented;
operating;
evidenced;
monitored;
reviewed; and
improved.

The core relationship is:

ISO/IEC 42001 Requirement
        ↓
AIGO Requirement Mapping
        ↓
AIGO Control
        ↓
Control Implementation
        ↓
Evidence
        ↓
Assurance Criteria
        ↓
Assurance Activity
        ↓
Finding / Conclusion
        ↓
Corrective Action
        ↓
Verification

4. Assurance Boundary

AIGO should distinguish:

AIGO Internal Assurance

from:

ISO/IEC 42001 Internal Audit

and:

External Certification Audit

and:

Accredited Certification

These activities may overlap in evidence but have different purposes and authority. ISO/IEC 42006:2025 applies to bodies that audit and certify AIMS and builds on ISO/IEC 17021-1. AIGO assurance must not represent itself as an accredited certification activity unless the applicable external requirements are actually satisfied.

5. Assurance Relationship Types

The mapping should support:

DESIGN_ASSURANCE
IMPLEMENTATION_ASSURANCE
OPERATING_EFFECTIVENESS
EVIDENCE_ASSURANCE
TECHNICAL_ASSURANCE
RISK_ASSURANCE
PROCESS_ASSURANCE
INTERNAL_AUDIT_SUPPORT
MANAGEMENT_SYSTEM_ASSURANCE
CERTIFICATION_READINESS
REGULATORY_ASSURANCE
FOLLOW_UP_ASSURANCE

6. Assurance Status

AIGO assurance records should support:

NOT_PLANNED
PLANNED
IN_PROGRESS
COMPLETE
FINDINGS_OPEN
FOLLOW_UP_REQUIRED
VERIFIED
CLOSED
SUPERSEDED

These statuses describe AIGO assurance activities and do not represent ISO certification status.

7. Assurance Conclusion Model

AIGO may use:

EFFECTIVE
EFFECTIVE_WITH_OBSERVATIONS
PARTIALLY_EFFECTIVE
INEFFECTIVE
INSUFFICIENT_EVIDENCE
NOT_ASSESSED

These conclusions apply to the defined assurance scope and criteria only. They should not be converted into an unsupported claim of ISO/IEC 42001 conformity.

8. Assurance Scope

The assurance scope should identify:

AIMS scope;
organizational units;
AI systems;
processes;
controls;
locations;
suppliers where relevant;
evidence period;
applicable standard edition;
AIGO mapping version.

The scope should be approved before assurance begins.

9. Assurance Criteria

Assurance criteria may include:

ISO/IEC 42001 requirements;
applicable Annex A controls;
approved AIGO controls;
AIMS policy;
organizational procedures;
objectives;
applicable legal requirements;
contractual obligations.

The source of each criterion must be explicit.

10. Clause 4 Assurance — Context of the Organization

Assurance should evaluate whether the organization has established an appropriate understanding of:

internal issues;
external issues;
relevant AI activities;
interested parties;
relevant requirements;
AIMS scope.

Potential evidence:

context analysis;
stakeholder register;
AIMS scope;
governance records;
management review inputs.

Assurance should examine whether the context remains current rather than merely verifying the existence of a document.

11. Context Assurance Tests

Potential tests include:

inspect context record;
compare with current AI portfolio;
review material organizational changes;
assess stakeholder identification;
verify AIMS scope;
sample management-review updates.

Potential finding: ISO_CONTEXT_STALE

12. Clause 5 Assurance — Leadership

Assurance should evaluate:

leadership commitment;
AI policy;
accountability;
responsibilities;
authorities;
integration of the AIMS into organizational processes.

Evidence may include:

approved policy;
governance assignments;
leadership decisions;
management review;
resource decisions;
objectives.

13. Leadership Assurance Tests

Potential tests:

Policy Approved?
       ↓
Roles Assigned?
       ↓
Authorities Defined?
       ↓
Resources Provided?
       ↓
Management Review Active?
       ↓
Leadership Actions Evidenced?

A signed policy alone should not be treated as sufficient evidence of leadership commitment.

14. Clause 6 Assurance — Planning

Assurance should assess:

risks and opportunities;
AI objectives;
planning actions;
change planning;
alignment with AIMS scope.

Potential evidence:

risk register;
objectives;
action plans;
change records;
management review.

15. Risk Assurance

AIGO Risk Assurance should evaluate whether:

risks are identified;
assessment methods are defined;
risks are analyzed consistently;
treatment is assigned;
residual risk is understood;
monitoring exists;
material changes trigger reassessment.

The assurance conclusion should be tied to the organization’s stated risk methodology.

16. Opportunity Assurance

Assurance may review whether significant opportunities identified by the organization are:

documented;
evaluated;
assigned;
monitored;
reviewed.

AIMS planning should not be limited exclusively to adverse risk.

17. AIMS Objectives Assurance

Assurance should test:

objective definition;
ownership;
measurement;
target;
monitoring;
review;
improvement.

Potential evidence:

objective register;
KPI results;
management-review record;
improvement actions.

18. Change Planning Assurance

Assurance should determine whether material organizational or AI-system changes are assessed for AIMS impact. Potential triggers:

new AI systems;
major model changes;
acquisitions;
outsourcing;
organizational restructuring;
significant legal changes.

19. Clause 7 Assurance — Support

Support assurance should cover:

resources;
competence;
awareness;
communication;
documented information.

20. Resource Assurance

Assurance should determine whether resources are sufficient for the defined AIMS scope and objectives. Potential evidence:

staffing;
budgets;
infrastructure;
technical resources;
assurance resources;
training resources.

AIGO should record resource deficiencies as management-system risks or improvement actions where appropriate.

21. Competence Assurance

Competence assurance should evaluate whether relevant personnel have appropriate competence for their roles. Potential evidence:

competence profiles;
role requirements;
training;
experience;
qualifications;
supervised activities;
assessments.

AI literacy should be treated as a related capability, not as a substitute for all role competence.

22. Awareness Assurance

Assurance may test whether personnel are aware of:

AI policy;
relevant responsibilities;
risks;
controls;
consequences of nonconformance;
escalation mechanisms.

Methods may include:

interviews;
sampling;
knowledge assessments;
observation.

23. Communication Assurance

Assurance should assess whether required AI governance communication is:

defined;
timely;
assigned;
documented;
effective.

Potential areas:

internal communication;
management reporting;
supplier communication;
regulatory communication;
affected-person communication.

24. Documented-Information Assurance

Assurance should evaluate:

document approval;
version control;
access;
protection;
retrieval;
distribution;
retention;
disposition.

AIGO Document Integrity and Evidence controls should provide supporting mechanisms.

25. Document Integrity Tests

Potential tests:

sample controlled documents;
compare versions;
verify approvals;
verify ownership;
verify change history;
test retrieval;
verify obsolete-document controls.

Potential findings:

DOCUMENT_VERSION_GAP
DOCUMENT_APPROVAL_GAP
DOCUMENT_INTEGRITY_GAP
DOCUMENT_RETENTION_GAP

26. Clause 8 Assurance — Operation

Operational assurance should evaluate whether planned AI governance processes operate as defined. Areas include:

AI lifecycle;
risk treatment;
AI development or acquisition;
deployment;
monitoring;
changes;
incidents;
suppliers;
operational records.

27. AI Lifecycle Assurance

AIGO should test whether governance controls are active at appropriate lifecycle stages:

Planning
 ↓
Design
 ↓
Development / Acquisition
 ↓
Validation
 ↓
Approval
 ↓
Deployment
 ↓
Operation
 ↓
Monitoring
 ↓
Change
 ↓
Retirement

The evidence should show that governance gates are not merely theoretical.

28. AI System Assurance

For sampled AI systems, assurance should verify alignment between:

AI System Profile;
intended purpose;
classification;
risk;
controls;
approval;
monitoring;
incidents;
changes;
retirement status.

29. Operational Control Assurance

For each selected control, assurance should determine:

Designed?
Implemented?
Operating?
Evidence Generated?
Exceptions Managed?
Monitored?
Reviewed?

A control may be technically implemented but operationally ineffective.

30. Supplier / Third-Party Assurance

Where external providers support AI activities, assurance may evaluate:

supplier selection;
requirements;
contracts;
due diligence;
monitoring;
evidence;
incidents;
changes.

Sampling should be risk-based.

31. AI System Change Assurance

Assurance should evaluate whether material changes are:

requested;
assessed;
approved;
tested;
documented;
monitored;
reflected in risk;
reflected in evidence.

Potential finding: CHANGE_IMPACT_NOT_COMPLETE

32. Incident Assurance

AIGO Incident Assurance should evaluate whether:

incidents are identified;
severity is assessed;
responsibilities are clear;
containment occurs;
root cause is investigated;
corrective action is taken;
effectiveness is verified.

33. Clause 9 Assurance — Performance Evaluation

Clause 9 is the primary AIMS performance-evaluation layer. AIGO should map it to:

monitoring;
measurement;
analysis;
evaluation;
internal audit;
management review.

34. Monitoring Assurance

Assurance should evaluate:

monitoring objectives;
indicators;
thresholds;
measurement methods;
data quality;
reporting;
escalation;
action.

35. Measurement Assurance

A measurement should have:

defined metric;
source;
method;
frequency;
owner;
target or threshold where appropriate;
evidence.

Uncontrolled metrics should not be presented as management-system measures.

36. Analysis and Evaluation Assurance

Assurance should determine whether monitoring results are actually analyzed and used. Example:

Metric
 ↓
Result
 ↓
Trend
 ↓
Analysis
 ↓
Risk / Opportunity
 ↓
Management Action

37. AI Performance Assurance

Where relevant, technical performance may be assessed using:

accuracy;
robustness;
reliability;
bias;
security;
availability;
human oversight;
safety indicators.

The applicable metrics depend on system context.

38. Internal Audit Architecture

AIGO should maintain a clear relationship:

AIMS Requirement
      ↓
Audit Criteria
      ↓
Audit Programme
      ↓
Audit
      ↓
Evidence
      ↓
Findings
      ↓
Corrective Action
      ↓
Follow-Up

39. Internal Audit Programme

The audit programme should be risk-based and consider:

importance of processes;
changes;
previous audit results;
incidents;
control maturity;
regulatory significance.

The audit programme should define:

scope;
frequency;
methods;
responsibilities;
reporting.

40. Auditor Competence

Internal auditors should have competence appropriate to the audit scope. Potential competence areas:

management systems;
AI governance;
risk;
controls;
technical AI where required;
applicable legal/regulatory context.

41. Auditor Independence

Where possible, internal auditors should avoid auditing activities for which they are directly responsible. The assurance record should document independence considerations.

42. Internal Audit Evidence

The audit record should include:

audit ID;
scope;
criteria;
auditor;
period;
methodology;
evidence;
findings;
conclusion;
report;
corrective action.

43. Audit Finding Classification

AIGO may classify findings as:

OBSERVATION
MINOR_NONCONFORMITY
MAJOR_NONCONFORMITY
CRITICAL_GOVERNANCE_GAP
OPPORTUNITY_FOR_IMPROVEMENT

These are internal AIGO classifications. They should not be confused with the terminology or formal conclusions of an external certification body.

44. Follow-Up Audit

Follow-up should determine:

action implemented;
evidence provided;
root cause addressed;
effectiveness demonstrated;
residual risk acceptable.

A finding should not be closed solely because management states that an action is complete.

45. Management Review Assurance

Management review should be assessed for:

frequency;
required inputs;
participation;
decisions;
actions;
resource decisions;
improvement decisions;
evidence.

ISO’s harmonized management-system structure requires management review evidence and decisions concerning continual improvement and changes to the management system.

46. Management Review Inputs

Potential assurance checks include:

previous actions;
internal/external changes;
interested parties;
performance trends;
nonconformities;
corrective actions;
monitoring results;
audit results;
opportunities for improvement.

47. Management Review Outputs

Assurance should verify documented decisions concerning:

improvement opportunities;
AIMS changes;
resources;
risks;
priorities;
corrective actions.

48. Clause 10 Assurance — Improvement

Improvement assurance should cover:

nonconformity;
corrective action;
continual improvement.

49. Nonconformity Assurance

When a nonconformity occurs, assurance should test:

Nonconformity
 ↓
Correction
 ↓
Cause Analysis
 ↓
Corrective Action
 ↓
Implementation
 ↓
Effectiveness
 ↓
Closure

50. Root-Cause Assurance

Root-cause analysis should be proportionate to the issue. Potential methods may include:

causal analysis;
five-whys;
fault-tree analysis;
process analysis;
technical investigation.

The method should match the problem.

51. Corrective-Action Assurance

Assurance should determine whether corrective action actually addresses the cause. A superficial symptom correction should not automatically be considered effective corrective action.

52. Continual-Improvement Assurance

Improvement should be supported by evidence from:

monitoring;
audits;
incidents;
changes;
complaints;
management review;
risk;
regulatory developments.

The improvement process should show measurable or otherwise demonstrable progress where appropriate.

53. Annex A Assurance

The Annex A control mapping should have assurance coverage for applicable controls. For each control:

ISO Annex A Control
       ↓
Applicability
       ↓
AIGO Control
       ↓
Implementation
       ↓
Evidence
       ↓
Assurance

AIGO should not assume every Annex A control is applicable to every organization or AI scope.

54. Control Applicability Assurance

Assurance should test whether control applicability decisions are:

documented;
justified;
current;
linked to AIMS scope;
reviewed after change.

Where an Annex A control is treated as non-applicable, the organization should maintain the required justification.

55. Control Design Assurance

AIGO should assess whether mapped controls:

address their objective;
have owners;
define activities;
produce evidence;
include monitoring;
support escalation.

56. Control Implementation Assurance

Implementation assurance should verify:

procedures exist;
roles are assigned;
systems are configured;
evidence is generated;
workflows operate.

57. Operating-Effectiveness Assurance

Where the assurance scope includes operating effectiveness, testing should cover a defined evidence period. Potential methods:

sample completed assessments;
sample changes;
sample incidents;
reperform controls;
inspect system configurations;
observe workflows.

58. Evidence Assurance

The Evidence Mapping should connect to assurance through:

Evidence Requirement
      ↓
Evidence Record
      ↓
Evidence Validation
      ↓
Assurance Testing

Evidence should be evaluated for:

authenticity;
integrity;
completeness;
currency;
traceability.

59. AIGO Evidence Coverage

A future evidence coverage result may be:

FULL
PARTIAL
GAP
NOT_APPLICABLE
PENDING

Assurance should identify critical evidence gaps.

60. AI Risk Assurance

The risk assurance model should connect:

AI System
 ↓
Risk
 ↓
Control
 ↓
Residual Risk
 ↓
Monitoring
 ↓
Management Review

Assurance should assess whether this chain is operational.

61. AIMS Risk Assurance

AIMS-level risks should also be reviewed. Examples:

inadequate governance;
unclear accountability;
insufficient competence;
obsolete policy;
inadequate evidence;
ineffective monitoring;
ineffective improvement.

62. Technical Assurance

For technically significant AI systems, technical assurance may cover:

model testing;
data quality;
model performance;
robustness;
security;
logging;
monitoring;
change control.

Technical assurance should be performed by appropriately competent personnel.

63. Human Oversight Assurance

Where human oversight is part of the AIMS control architecture, assurance should evaluate:

role;
authority;
competence;
information;
intervention;
override;
escalation;
evidence.

64. AI Literacy Assurance

AIGO should assess whether the organization takes appropriate measures to support AI literacy and competence. The detailed AI literacy mapping for the EU AI Act remains separate from ISO/IEC 42001 assurance. AIGO should avoid treating one framework’s training evidence as automatic proof of another framework’s competence requirement.

65. Governance Assurance

Governance assurance should review:

accountability;
policy;
decision authority;
roles;
committee structures;
reporting;
management review.

66. Regulatory Mapping Assurance

Where AIGO integrates ISO/IEC 42001 with other regulatory frameworks, assurance should verify that:

applicable requirements are identified;
AIGO controls are reusable where appropriate;
conflicts are recognized;
legal sources are current;
framework-specific claims remain separated.

67. Cross-Framework Assurance

A common AIGO control may support both ISO/IEC 42001 and another framework. Example:

AIGO Change Control
     ├── ISO/IEC 42001
     ├── EU AI Act
     └── Organizational Policy

Assurance should verify each relationship separately where the underlying requirements differ.

68. Assurance and Certification Readiness

AIGO can provide: ISO42001_CERTIFICATION_READINESS where the organization wants to prepare for an external certification audit. The readiness review may assess:

scope;
documented information;
controls;
evidence;
internal audit;
management review;
corrective action;
continual improvement.

69. Certification Boundary

AIGO certification-readiness assurance is not certification. ISO/IEC 42006:2025 defines requirements for bodies that audit and certify AIMS according to ISO/IEC 42001 and supplements ISO/IEC 17021-1. Therefore:

AIGO Readiness Assurance
        ≠
Certification Audit

and:

Certification Audit
        ≠
AIGO Internal Assurance

70. External Certification Evidence

When preparing for certification, AIGO should help assemble:

AIMS scope;
policy;
context;
risks;
objectives;
controls;
documented information;
operational evidence;
internal audit;
management review;
corrective actions;
improvement.

71. Certification-Body Boundary

AIGO should not select, designate, or impersonate a certification body. The organization should independently verify certification-body credentials and applicable accreditation arrangements. ISO/IEC 42006:2025 is specifically aimed at bodies conducting AIMS audits and certification.

72. Certification Evidence Traceability

The evidence package should maintain:

ISO Requirement
      ↓
AIGO Control
      ↓
Evidence
      ↓
Internal Assurance
      ↓
Certification Readiness
      ↓
External Audit Evidence

This prevents external certification evidence from being confused with AIGO internal assurance.

73. Assurance Planning Cycle

The annual assurance cycle may follow:

Risk Review
    ↓
Assurance Planning
    ↓
Scope
    ↓
Criteria
    ↓
Testing
    ↓
Findings
    ↓
Corrective Action
    ↓
Follow-Up
    ↓
Management Review
    ↓
Next Cycle

The actual cadence should be risk-based.

74. Assurance Universe

The assurance universe should include:

AIMS processes;
AI systems;
controls;
suppliers;
governance;
evidence;
regulatory mappings.

Risk and materiality should drive selection.

75. Assurance Risk Rating

Potential assurance priority:

CRITICAL
HIGH
MEDIUM
LOW
INFORMATIONAL

Factors include:

AI impact;
risk;
control criticality;
previous findings;
change;
regulatory significance.

76. Assurance Sampling

Sampling can be used for:

AI systems;
control executions;
incidents;
changes;
monitoring;
supplier evidence.

The population and method should be documented.

77. Assurance of AI Portfolio

At portfolio level, AIGO may assess:

number of AI systems;
classification coverage;
risk coverage;
control coverage;
evidence coverage;
assurance coverage;
open findings.

78. Assurance of AI System Portfolio Changes

Portfolio assurance should detect:

new systems without governance records;
retired systems still active;
changes without assessment;
duplicate system records;
unmanaged supplier systems.

79. Assurance of AIMS Boundaries

The assurance review should verify that the actual operational AI activities remain within the approved AIMS scope. Potential finding: AIMS_SCOPE_MISMATCH

80. Assurance of Exclusions

Where parts of an organization or AI portfolio are outside the AIMS scope, assurance should verify:

scope statement;
rationale;
governance boundaries;
review;
consistency with the standard’s requirements.

81. Assurance of Interested-Party Requirements

Assurance may test:

stakeholder identification;
relevant needs;
communication;
change monitoring.

82. Assurance of AI Policy

Assurance should assess:

approval;
relevance;
communication;
implementation;
review.

83. Assurance of Roles

Assurance should determine whether:

roles exist;
responsibility is assigned;
authority is adequate;
ownership is current.

84. Assurance of Objectives

Assurance should evaluate:

objectives;
measurement;
results;
action where objectives are missed.

85. Assurance of Resources

Assurance may assess whether resource constraints create management-system risk.

86. Assurance of Competence

Assurance may use:

sample training records;
interviews;
observation;
role profiles;
technical assessments.

87. Assurance of Documented Information

Assurance should assess:

controlled documents;
records;
evidence;
access;
retention;
integrity.

88. Assurance of Operational Controls

For selected AI systems, assurance should trace:

Requirement
 ↓
Control
 ↓
Procedure
 ↓
Execution
 ↓
Evidence
 ↓
Monitoring

89. Assurance of Monitoring

Assurance should verify that monitoring produces actionable information. A metric that is collected but never analyzed may represent a monitoring-design weakness.

90. Assurance of Internal Audit

Assurance should review whether internal audit:

covers the AIMS;
uses appropriate criteria;
remains sufficiently independent;
produces findings;
follows up actions.

91. Assurance of Management Review

Assurance should verify that management review:

occurs;
considers appropriate inputs;
produces documented outputs;
results in decisions where needed.

92. Assurance of Improvement

Assurance should verify that:

findings are addressed;
corrective actions are effective;
improvement is evidenced;
recurring failures trigger broader action.

93. Assurance and Repository Tools

The following tools should support assurance:

Schema Validator;
Reference Validator;
Traceability Validator;
Control Coverage Validator;
Evidence Coverage Validator;
Framework Consistency Checker;
Document Integrity Checker;
Repository Health Checker.

94. Assurance Findings

Potential ISO/AIGO findings:

ISO_ASSURANCE_NOT_PLANNED
ISO_ASSURANCE_OVERDUE
ISO_SCOPE_GAP
ISO_CONTEXT_GAP
ISO_LEADERSHIP_GAP
ISO_PLANNING_GAP
ISO_SUPPORT_GAP
ISO_OPERATION_GAP
ISO_PERFORMANCE_EVALUATION_GAP
ISO_INTERNAL_AUDIT_GAP
ISO_MANAGEMENT_REVIEW_GAP
ISO_CORRECTIVE_ACTION_GAP
ISO_CONTINUAL_IMPROVEMENT_GAP
ISO_EVIDENCE_GAP
ISO_CONTROL_EFFECTIVENESS_GAP

95. Critical Assurance Findings

Potential critical findings include:

AIMS scope materially differs from actual AI activities;
management-system risks are unmanaged;
internal audit is absent where required by the AIMS;
management review is not functioning;
significant corrective actions remain ineffective;
critical controls cannot be evidenced;
material documented information is uncontrolled;
assurance findings are repeatedly closed without effectiveness verification.

96. Assurance Evidence Requirements

Every assurance activity should maintain:

scope;
criteria;
methodology;
evidence;
reviewers;
test results;
conclusion;
findings;
follow-up.

97. Assurance Evidence Integrity

Assurance records should be:

version controlled;
attributable;
protected;
traceable;
retained.

The assurance conclusion should be reproducible from the evidence reviewed.

98. Assurance Independence

The assurance record should identify:

reviewer;
organizational role;
independence level;
conflicts of interest;
approval.

99. Assurance Competence

Assurance personnel should have competence appropriate to the scope. Potential domains:

ISO management systems;
AI governance;
AI risk;
technical AI;
data governance;
security;
applicable legal context.

100. Technical-Assurance Competence

Where technical testing is required, reviewers should have appropriate expertise. A management-system auditor should not be assumed to possess sufficient technical expertise for every AI-system technical evaluation.

101. Assurance and External Specialists

The organization may use external specialists for:

AI testing;
cybersecurity;
data science;
safety;
legal analysis.

Specialist outputs should be controlled evidence.

102. Assurance and Outsourcing

Where assurance activities are outsourced, the organization should control:

provider competence;
scope;
confidentiality;
independence;
evidence;
deliverables.

103. Assurance of Outsourced AI Processes

Where critical AI activities are outsourced, assurance may include supplier evidence and external assurance reports. The organization remains accountable for the effectiveness of its AIMS.

104. Assurance and Management-System Integration

AIGO should enable combined assurance across management systems. For example:

AI Governance Control
      ├── ISO/IEC 42001
      ├── Information Security
      ├── Privacy
      └── EU AI Act

Assurance should identify which criterion is being tested for each framework relationship.

105. Combined Evidence

One evidence record may support multiple frameworks where:

scope is valid;
requirements are compatible;
relationships are documented.

This is a major benefit of a unified AIGO control architecture.

106. Combined Assurance

A single assurance activity may assess several framework relationships, provided:

each criterion is separately identified;
reviewer competence covers all scopes;
evidence is sufficient;
conclusions are separated by framework where necessary.

107. Assurance and Regulatory Change

A material change to ISO/IEC 42001 implementation guidance or related standards should trigger:

Source Change
 ↓
Mapping Review
 ↓
Control Impact
 ↓
Evidence Impact
 ↓
Assurance Impact
 ↓
Management Review

ISO currently lists ISO/IEC AWI 42003, guidance on implementation of ISO/IEC 42001, as under development. This should be monitored as an external development, not treated as an existing normative requirement.

The AIGO assurance mapping should monitor relevant related standards, including:

ISO/IEC 42005:2025;
ISO/IEC 42006:2025;
relevant AI testing standards;
future ISO/IEC 42003 guidance.

ISO currently lists ISO/IEC 42005:2025 and ISO/IEC 42006:2025 as published standards, while ISO/IEC 42003 remains under development.

109. Assurance and ISO/IEC 42005

Where AIGO uses AI impact-assessment practices aligned with ISO/IEC 42005:2025, the assurance record should identify that standard separately. It should not be represented as an additional mandatory clause of ISO/IEC 42001.

110. Assurance and ISO/IEC 42006

ISO/IEC 42006:2025 is relevant to certification bodies auditing and certifying AIMS and supplements ISO/IEC 17021-1. AIGO should therefore use ISO/IEC 42006 as a certification-boundary reference, not as a direct organizational AIMS requirement.

111. Assurance and Certification Readiness

The certification-readiness assessment may evaluate:

Scope
 ↓
Context
 ↓
Leadership
 ↓
Planning
 ↓
Support
 ↓
Operation
 ↓
Performance Evaluation
 ↓
Improvement

The result should identify readiness gaps and not issue a certification conclusion.

112. Certification Readiness Findings

Potential findings:

CERTIFICATION_READINESS_GAP
DOCUMENTED_INFORMATION_GAP
INTERNAL_AUDIT_GAP
MANAGEMENT_REVIEW_GAP
CONTROL_EVIDENCE_GAP
CORRECTIVE_ACTION_GAP
SCOPE_GAP
OBJECTIVE_GAP

113. Assurance and Certification Audit Preparation

AIGO may support preparation through:

evidence indexing;
requirement-to-evidence traceability;
audit-request response;
document review;
interview preparation;
corrective-action tracking.

114. Certification-Audit Evidence Boundary

Evidence prepared for a certification audit should be treated as: EXTERNAL_AUDIT_SUPPORT_EVIDENCE until the certification body performs its own assessment.

115. AIMS Assurance Dashboard

Potential dashboard fields:

Measure	Purpose
AIMS Scope Coverage	Governance
Requirements Mapped	Traceability
Controls Implemented	Control maturity
Evidence Coverage	Demonstrability
Assurance Coverage	Validation
Open Findings	Risk
Overdue Actions	Remediation
Internal Audit Status	Performance
Management Review Status	Governance
Certification Readiness	External readiness

116. Assurance Coverage Calculation

AIGO may calculate:

Applicable Requirements
        ↓
Mapped
        ↓
Controlled
        ↓
Evidenced
        ↓
Assured

The resulting coverage percentage is an internal governance indicator and not an ISO conformity percentage.

117. Assurance Prioritization Matrix

Factor	Higher Priority When
AI Risk	High
Rights Impact	High
Safety Impact	High
Regulatory Significance	High
Systemic Risk	Present
Prior Findings	Recurring
Control Maturity	Low
Evidence Quality	Weak
Change Activity	High

118. Assurance and AI System Materiality

The assurance plan should prioritize AI systems based on:

business criticality;
safety;
rights impact;
regulatory classification;
system scale;
autonomy;
external reliance.

119. Assurance Sampling by AI System

A portfolio may be divided into:

Tier 1 — Critical
Tier 2 — High
Tier 3 — Moderate
Tier 4 — Low

The actual tiering should use the organization’s risk methodology.

120. Assurance of AI System Retirement

Assurance should verify that retired systems:

are no longer operational;
retain required records;
have closed incidents;
have completed obligations;
have documented final status.

121. Assurance Follow-Up

All major findings should have follow-up evidence. Potential statuses:

ACTION_OPEN
ACTION_IMPLEMENTED
VERIFICATION_PENDING
VERIFIED_EFFECTIVE
VERIFIED_INEFFECTIVE
CLOSED

122. Assurance and Management Review Escalation

Critical or recurring findings should be escalated to management review. AIGO should not allow material findings to remain indefinitely within an operational team.

123. Assurance and Continual Improvement

AIMS improvement should be demonstrated through a continuing feedback loop:

Evidence
 ↓
Monitoring
 ↓
Assurance
 ↓
Finding
 ↓
Improvement
 ↓
Change
 ↓
Verification

This provides operational evidence of continual improvement.

124. Assurance Quality Criteria

A high-quality assurance activity should be:

objective;
evidence-based;
criteria-based;
competent;
appropriately independent;
traceable;
documented;
repeatable;
proportionate.

125. Assurance Limitations

AIGO assurance may identify gaps and provide readiness conclusions, but it cannot independently:

certify ISO/IEC 42001;
act as an accredited certification body;
establish accreditation;
bind ISO;
issue an internationally recognized certificate;
guarantee external audit outcomes.

ISO/IEC 42006:2025 specifically governs bodies performing AIMS audit and certification and supplements ISO/IEC 17021-1.

126. Assurance Traceability Model

The complete assurance chain is:

ISO/IEC 42001
      ↓
Clause / Annex A
      ↓
AIGO Requirement
      ↓
AIGO Control
      ↓
AIGO Record
      ↓
Evidence
      ↓
Assurance Criteria
      ↓
Assurance Activity
      ↓
Finding
      ↓
Corrective Action
      ↓
Verification
      ↓
Management Review

127. Assurance Registry Requirements

The future machine-readable registry should support:

assuranceId
isoReference
aigoControlId
scope
criteria
evidenceIds
assuranceType
reviewer
independence
period
method
status
findingIds
followUpIds
conclusion

128. Assurance and Existing Schemas

Assurance Activity	AIGO Schema
Assurance record	Assurance
Requirements	Assessment
Risk	Risk
Control	Control
Evidence	Evidence
Monitoring	Monitoring
Incident finding	Incident
Corrective change	Change
Improvement	Improvement
Management conclusion	Management Review
Accountability	Governance

129. Assurance and Existing Templates

Primary templates:

AI Assurance Template;
AI Evidence Record Template;
AI Risk Assessment Template;
AI Control Assessment Template;
AI Management Review Template;
AI Change Management Template;
AI Incident Template;
AI Continuous Improvement Template.

No additional certification template is required for the mapping package.

130. Assurance and Validation Tools

The mapping should support:

Schema Validator;
Reference Validator;
Traceability Validator;
Control Coverage Validator;
Evidence Coverage Validator;
Framework Consistency Checker;
Document Integrity Checker;
Repository Health Checker.

131. Assurance Findings

Potential AIGO findings include:

ISO_ASSURANCE_SCOPE_UNRESOLVED
ISO_ASSURANCE_CRITERIA_MISSING
ISO_ASSURANCE_NOT_PLANNED
ISO_ASSURANCE_OVERDUE
ISO_EVIDENCE_INSUFFICIENT
ISO_CONTROL_INEFFECTIVE
ISO_INTERNAL_AUDIT_GAP
ISO_MANAGEMENT_REVIEW_GAP
ISO_CORRECTIVE_ACTION_INEFFECTIVE
ISO_CONTINUAL_IMPROVEMENT_GAP
ISO_CERTIFICATION_READINESS_GAP

132. Critical Assurance Findings

Potential critical findings include:

AIMS scope does not reflect actual AI activities;
management-system controls lack evidence;
required internal audit is absent or ineffective;
management review is not functioning;
major corrective actions are repeatedly ineffective;
critical AI governance controls are not operating;
certification-readiness claims are unsupported.

133. Assurance Metrics

Potential metrics:

Metric	Purpose
Requirements Assured	Coverage
Controls Assured	Control coverage
Evidence Reviewed	Evidence coverage
Findings Open	Remediation
Critical Findings	Risk
Overdue Findings	Management attention
Repeat Findings	Control maturity
Follow-Up Effectiveness	Corrective action
Certification Readiness	External preparation

134. Assurance Review Frequency

The assurance programme should be reviewed:

annually;
after significant organizational changes;
after material AI-system changes;
after major incidents;
after major audit findings;
after material changes to ISO guidance or related standards.

135. Regulatory / Standards Watch

The organization should monitor:

ISO/IEC 42001 status;
ISO/IEC 42005;
ISO/IEC 42006;
future ISO/IEC 42003 guidance;
relevant AI testing standards.

The purpose is to identify impacts on assurance criteria without prematurely treating draft standards as mandatory requirements. ISO currently lists ISO/IEC 42003 as under development, while ISO/IEC 42005 and ISO/IEC 42006 are published.

136. Current Standard Baseline

The current primary standard is: ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system ISO lists it as the first edition, published in December 2023. Related current standards:

ISO/IEC 42005:2025 — AI system impact assessment;
ISO/IEC 42006:2025 — AIMS audit and certification bodies.

These are related standards and should not be merged into the ISO/IEC 42001 requirement baseline.

137. Assurance Source Hierarchy

Assurance criteria should follow:

ISO/IEC 42001
        ↓
Applicable Related Normative Requirements
        ↓
Approved AIGO Mapping
        ↓
AIGO Control
        ↓
Organizational Procedure
        ↓
Evidence

Guidance should be clearly identified as guidance.

138. Assurance and AIGO Architecture

The assurance layer completes the AIGO ISO mapping:

Requirements
    ↓
Controls
    ↓
Lifecycle
    ↓
Risk
    ↓
Governance
    ↓
Evidence
    ↓
Implementation
    ↓
Assurance

139. Assurance and Master Mapping

The master mapping remains: 01-AIGO-ISO-42001-Mapping-v0.1.md This document adds assurance depth and should not replace the master mapping.

140. Assurance and Requirements Mapping

02-AIGO-ISO-42001-Requirements-Mapping-v0.1.md remains authoritative for detailed requirement relationships. Assurance should use those relationships as its criteria source.

141. Assurance and Control Mapping

03-AIGO-ISO-42001-Control-Mapping-v0.1.md remains authoritative for the ISO control mapping. AIGO assurance tests whether those mapped controls are appropriately implemented and effective.

142. Assurance and Lifecycle Mapping

04-AIGO-ISO-42001-Lifecycle-Mapping-v0.1.md defines lifecycle relationships. Assurance should verify governance gates across the lifecycle.

143. Assurance and Risk Mapping

05-AIGO-ISO-42001-Risk-Mapping-v0.1.md defines risk architecture. Assurance should verify:

risk identification;
treatment;
monitoring;
residual risk;
change.

144. Assurance and Governance Mapping

06-AIGO-ISO-42001-Governance-Mapping-v0.1.md defines leadership and governance relationships. Assurance should verify:

accountability;
policy;
roles;
management review;
governance decisions.

145. Assurance and Evidence Mapping

07-AIGO-ISO-42001-Evidence-Mapping-v0.1.md defines evidence relationships. This assurance document defines how that evidence is evaluated.

146. Assurance and Implementation Mapping

08-AIGO-ISO-42001-Implementation-Mapping-v0.1.md defines practical implementation. Assurance evaluates whether the planned implementation actually operates.

147. Assurance and Future AIGO Control Mapping

10-AIGO-ISO-42001-AIGO-Control-Mapping-v0.1.md will provide the detailed control-level crosswalk. Assurance should reference stable AIGO control IDs from that document rather than duplicating control definitions.

148. Assurance and Registry

00-AIGO-ISO-42001-Mapping-Registry-v0.1.json should eventually contain assurance relationships and identifiers. This document defines what those relationships mean.

149. Assurance Quality Control

Before an assurance report is finalized, verify:

Scope Defined
Criteria Defined
Evidence Identified
Evidence Reviewed
Method Recorded
Reviewer Identified
Independence Considered
Findings Validated
Conclusion Supported
Follow-Up Defined

150. Final Assurance Lifecycle

The intended AIGO ISO/IEC 42001 assurance lifecycle is:

ISO/IEC 42001 Requirement
        ↓
AIGO Mapping
        ↓
AIGO Control
        ↓
Implementation
        ↓
Evidence
        ↓
Monitoring
        ↓
Assurance
        ↓
Finding
        ↓
Corrective Action
        ↓
Verification
        ↓
Management Review
        ↓
Continual Improvement

This structure allows the AIGO framework to support systematic preparation, internal assurance, and controlled readiness for external assessment without confusing those activities with formal certification.

151. Document Control

Field	Value
Document	AIGO ISO/IEC 42001 Assurance Mapping
Version	0.1
Status	Draft
Document Identifier	`AIGO-MAP-ISO42001-009`
Document Type	ISO Management-System Mapping
Primary Standard	ISO/IEC 42001:2023
Related Standard	ISO/IEC 42006:2025
Owner
Legal / Standards Reviewer
Governance Reviewer
Assurance Reviewer
Framework Architect
Approved By
Effective Date
Next Review Date

152. Document Status

Document: AIGO — ISO/IEC 42001 Assurance Mapping Version: 0.1 Status: Draft Working Name: AIGO Full Name: AI Governance Operating Framework Document Identifier: AIGO-MAP-ISO42001-009 Document Type: ISO Management-System Mapping This document maps ISO/IEC 42001 management-system assurance requirements to the AIGO assurance architecture, including performance evaluation, internal audit, management review, evidence evaluation, control effectiveness, corrective action, continual improvement, certification readiness, and the boundary between internal AIGO assurance and external AIMS certification. End of Document

​AIGO — ISO/IEC 42001 Assurance Mapping

​1. Document Purpose

​2. Mapping Information

​3. Assurance Principle

​4. Assurance Boundary

​5. Assurance Relationship Types

​6. Assurance Status

​7. Assurance Conclusion Model

​8. Assurance Scope

​9. Assurance Criteria

​10. Clause 4 Assurance — Context of the Organization

​11. Context Assurance Tests

​12. Clause 5 Assurance — Leadership

​13. Leadership Assurance Tests

​14. Clause 6 Assurance — Planning

​15. Risk Assurance

​16. Opportunity Assurance

​17. AIMS Objectives Assurance

​18. Change Planning Assurance

​19. Clause 7 Assurance — Support

​20. Resource Assurance

​21. Competence Assurance

​22. Awareness Assurance

​23. Communication Assurance

​24. Documented-Information Assurance

​25. Document Integrity Tests

​26. Clause 8 Assurance — Operation

​27. AI Lifecycle Assurance

​28. AI System Assurance

​29. Operational Control Assurance

​30. Supplier / Third-Party Assurance

​31. AI System Change Assurance

​32. Incident Assurance

​33. Clause 9 Assurance — Performance Evaluation

​34. Monitoring Assurance

​35. Measurement Assurance

​36. Analysis and Evaluation Assurance

​37. AI Performance Assurance

​38. Internal Audit Architecture

​39. Internal Audit Programme

​40. Auditor Competence

​41. Auditor Independence

​42. Internal Audit Evidence

​43. Audit Finding Classification

​44. Follow-Up Audit

​45. Management Review Assurance

​46. Management Review Inputs

​47. Management Review Outputs

​48. Clause 10 Assurance — Improvement

​49. Nonconformity Assurance

​50. Root-Cause Assurance

​51. Corrective-Action Assurance

​52. Continual-Improvement Assurance

​53. Annex A Assurance

​54. Control Applicability Assurance

​55. Control Design Assurance

​56. Control Implementation Assurance

​57. Operating-Effectiveness Assurance

​58. Evidence Assurance

​59. AIGO Evidence Coverage

​60. AI Risk Assurance

​61. AIMS Risk Assurance

​62. Technical Assurance

​63. Human Oversight Assurance

​64. AI Literacy Assurance

​65. Governance Assurance

​66. Regulatory Mapping Assurance

​67. Cross-Framework Assurance

​68. Assurance and Certification Readiness

​69. Certification Boundary

​70. External Certification Evidence

​71. Certification-Body Boundary

​72. Certification Evidence Traceability

​73. Assurance Planning Cycle

​74. Assurance Universe

​75. Assurance Risk Rating

​76. Assurance Sampling

​77. Assurance of AI Portfolio

​78. Assurance of AI System Portfolio Changes

​79. Assurance of AIMS Boundaries

AIGO — ISO/IEC 42001 Assurance Mapping

1. Document Purpose

2. Mapping Information

3. Assurance Principle

4. Assurance Boundary

5. Assurance Relationship Types

6. Assurance Status

7. Assurance Conclusion Model

8. Assurance Scope

9. Assurance Criteria

10. Clause 4 Assurance — Context of the Organization

11. Context Assurance Tests

12. Clause 5 Assurance — Leadership

13. Leadership Assurance Tests

14. Clause 6 Assurance — Planning

15. Risk Assurance

16. Opportunity Assurance

17. AIMS Objectives Assurance

18. Change Planning Assurance

19. Clause 7 Assurance — Support

20. Resource Assurance

21. Competence Assurance

22. Awareness Assurance

23. Communication Assurance

24. Documented-Information Assurance

25. Document Integrity Tests

26. Clause 8 Assurance — Operation

27. AI Lifecycle Assurance

28. AI System Assurance

29. Operational Control Assurance

30. Supplier / Third-Party Assurance

31. AI System Change Assurance

32. Incident Assurance

33. Clause 9 Assurance — Performance Evaluation

34. Monitoring Assurance

35. Measurement Assurance

36. Analysis and Evaluation Assurance

37. AI Performance Assurance

38. Internal Audit Architecture

39. Internal Audit Programme

40. Auditor Competence

41. Auditor Independence

42. Internal Audit Evidence

43. Audit Finding Classification

44. Follow-Up Audit

45. Management Review Assurance

46. Management Review Inputs

47. Management Review Outputs

48. Clause 10 Assurance — Improvement

49. Nonconformity Assurance

50. Root-Cause Assurance

51. Corrective-Action Assurance

52. Continual-Improvement Assurance

53. Annex A Assurance

54. Control Applicability Assurance

55. Control Design Assurance

56. Control Implementation Assurance

57. Operating-Effectiveness Assurance

58. Evidence Assurance

59. AIGO Evidence Coverage

60. AI Risk Assurance

61. AIMS Risk Assurance

62. Technical Assurance

63. Human Oversight Assurance

64. AI Literacy Assurance

65. Governance Assurance

66. Regulatory Mapping Assurance

67. Cross-Framework Assurance

68. Assurance and Certification Readiness

69. Certification Boundary

70. External Certification Evidence

71. Certification-Body Boundary

72. Certification Evidence Traceability

73. Assurance Planning Cycle

74. Assurance Universe

75. Assurance Risk Rating

76. Assurance Sampling

77. Assurance of AI Portfolio

78. Assurance of AI System Portfolio Changes

79. Assurance of AIMS Boundaries