> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aigoframework.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 09 AIGO ISO 42001 Assurance Mapping v0.1

# AIGO — ISO/IEC 42001 Assurance Mapping

## 1. Document Purpose

This document defines the AIGO assurance mapping for ISO/IEC 42001:2023, connecting the requirements of an Artificial Intelligence Management System (AIMS) to assurance activities within the AIGO framework.

ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining, and continually improving an AIMS for organizations that provide or use AI-based products or services.

The purpose of this mapping is to establish an assurance architecture covering:

* management-system conformity;
* control design;
* control implementation;
* operating effectiveness;
* documented information;
* evidence quality;
* risk and opportunity management;
* AI lifecycle governance;
* performance evaluation;
* internal audit;
* management review;
* corrective action;
* continual improvement;
* certification readiness; and
* external certification boundaries.

This document is an operational AIGO assurance mapping. It does not constitute an ISO/IEC 42001 audit, certification, accreditation, conformity assessment, or audit opinion.

***

# 2. Mapping Information

| Field                   | Value                                                            |
| ----------------------- | ---------------------------------------------------------------- |
| Mapping                 | AIGO ISO/IEC 42001 Assurance Mapping                             |
| Version                 | 0.1                                                              |
| Status                  | Draft                                                            |
| Document Identifier     | `AIGO-MAP-ISO42001-009`                                          |
| Document Type           | ISO Management-System Mapping                                    |
| Mapping Package         | `AIGO-MAP-ISO42001`                                              |
| Primary Standard        | ISO/IEC 42001:2023                                               |
| Standard Edition        | First edition                                                    |
| Publication             | December 2023                                                    |
| Primary Assurance Areas | Clauses 9 and 10, plus relevant requirements throughout the AIMS |
| Supporting Standard     | ISO/IEC 42006:2025                                               |
| Architecture            | `AIGO-MAP-ISO42001-ARCH-001`                                     |

ISO/IEC 42006:2025, published in July 2025, specifies additional requirements for bodies auditing and certifying AIMS against ISO/IEC 42001 and supplements ISO/IEC 17021-1. It is therefore relevant to the external-certification boundary but does not replace ISO/IEC 42001 or define AIGO's internal assurance process.

***

# 3. Assurance Principle

AIGO assurance should establish whether the organization's AIMS governance is:

* appropriately designed;
* implemented;
* operating;
* evidenced;
* monitored;
* reviewed; and
* improved.

The core relationship is:

```text theme={null}
ISO/IEC 42001 Requirement
        ↓
AIGO Requirement Mapping
        ↓
AIGO Control
        ↓
Control Implementation
        ↓
Evidence
        ↓
Assurance Criteria
        ↓
Assurance Activity
        ↓
Finding / Conclusion
        ↓
Corrective Action
        ↓
Verification
```

***

# 4. Assurance Boundary

AIGO should distinguish:

```text theme={null}
AIGO Internal Assurance
```

from:

```text theme={null}
ISO/IEC 42001 Internal Audit
```

and:

```text theme={null}
External Certification Audit
```

and:

```text theme={null}
Accredited Certification
```

These activities may overlap in evidence but have different purposes and authority.

ISO/IEC 42006:2025 applies to bodies that audit and certify AIMS and builds on ISO/IEC 17021-1.

AIGO assurance must not represent itself as an accredited certification activity unless the applicable external requirements are actually satisfied.

***

# 5. Assurance Relationship Types

The mapping should support:

```text theme={null}
DESIGN_ASSURANCE
IMPLEMENTATION_ASSURANCE
OPERATING_EFFECTIVENESS
EVIDENCE_ASSURANCE
TECHNICAL_ASSURANCE
RISK_ASSURANCE
PROCESS_ASSURANCE
INTERNAL_AUDIT_SUPPORT
MANAGEMENT_SYSTEM_ASSURANCE
CERTIFICATION_READINESS
REGULATORY_ASSURANCE
FOLLOW_UP_ASSURANCE
```

***

# 6. Assurance Status

AIGO assurance records should support:

```text theme={null}
NOT_PLANNED
PLANNED
IN_PROGRESS
COMPLETE
FINDINGS_OPEN
FOLLOW_UP_REQUIRED
VERIFIED
CLOSED
SUPERSEDED
```

These statuses describe AIGO assurance activities and do not represent ISO certification status.

***

# 7. Assurance Conclusion Model

AIGO may use:

```text theme={null}
EFFECTIVE
EFFECTIVE_WITH_OBSERVATIONS
PARTIALLY_EFFECTIVE
INEFFECTIVE
INSUFFICIENT_EVIDENCE
NOT_ASSESSED
```

These conclusions apply to the defined assurance scope and criteria only.

They should not be converted into an unsupported claim of ISO/IEC 42001 conformity.

***

# 8. Assurance Scope

The assurance scope should identify:

* AIMS scope;
* organizational units;
* AI systems;
* processes;
* controls;
* locations;
* suppliers where relevant;
* evidence period;
* applicable standard edition;
* AIGO mapping version.

The scope should be approved before assurance begins.

***

# 9. Assurance Criteria

Assurance criteria may include:

* ISO/IEC 42001 requirements;
* applicable Annex A controls;
* approved AIGO controls;
* AIMS policy;
* organizational procedures;
* objectives;
* applicable legal requirements;
* contractual obligations.

The source of each criterion must be explicit.

***

# 10. Clause 4 Assurance — Context of the Organization

Assurance should evaluate whether the organization has established an appropriate understanding of:

* internal issues;
* external issues;
* relevant AI activities;
* interested parties;
* relevant requirements;
* AIMS scope.

Potential evidence:

* context analysis;
* stakeholder register;
* AIMS scope;
* governance records;
* management review inputs.

Assurance should examine whether the context remains current rather than merely verifying the existence of a document.

***

# 11. Context Assurance Tests

Potential tests include:

* inspect context record;
* compare with current AI portfolio;
* review material organizational changes;
* assess stakeholder identification;
* verify AIMS scope;
* sample management-review updates.

Potential finding:

`ISO_CONTEXT_STALE`

***

# 12. Clause 5 Assurance — Leadership

Assurance should evaluate:

* leadership commitment;
* AI policy;
* accountability;
* responsibilities;
* authorities;
* integration of the AIMS into organizational processes.

Evidence may include:

* approved policy;
* governance assignments;
* leadership decisions;
* management review;
* resource decisions;
* objectives.

***

# 13. Leadership Assurance Tests

Potential tests:

```text theme={null}
Policy Approved?
       ↓
Roles Assigned?
       ↓
Authorities Defined?
       ↓
Resources Provided?
       ↓
Management Review Active?
       ↓
Leadership Actions Evidenced?
```

A signed policy alone should not be treated as sufficient evidence of leadership commitment.

***

# 14. Clause 6 Assurance — Planning

Assurance should assess:

* risks and opportunities;
* AI objectives;
* planning actions;
* change planning;
* alignment with AIMS scope.

Potential evidence:

* risk register;
* objectives;
* action plans;
* change records;
* management review.

***

# 15. Risk Assurance

AIGO Risk Assurance should evaluate whether:

* risks are identified;
* assessment methods are defined;
* risks are analyzed consistently;
* treatment is assigned;
* residual risk is understood;
* monitoring exists;
* material changes trigger reassessment.

The assurance conclusion should be tied to the organization's stated risk methodology.

***

# 16. Opportunity Assurance

Assurance may review whether significant opportunities identified by the organization are:

* documented;
* evaluated;
* assigned;
* monitored;
* reviewed.

AIMS planning should not be limited exclusively to adverse risk.

***

# 17. AIMS Objectives Assurance

Assurance should test:

* objective definition;
* ownership;
* measurement;
* target;
* monitoring;
* review;
* improvement.

Potential evidence:

* objective register;
* KPI results;
* management-review record;
* improvement actions.

***

# 18. Change Planning Assurance

Assurance should determine whether material organizational or AI-system changes are assessed for AIMS impact.

Potential triggers:

* new AI systems;
* major model changes;
* acquisitions;
* outsourcing;
* organizational restructuring;
* significant legal changes.

***

# 19. Clause 7 Assurance — Support

Support assurance should cover:

* resources;
* competence;
* awareness;
* communication;
* documented information.

***

# 20. Resource Assurance

Assurance should determine whether resources are sufficient for the defined AIMS scope and objectives.

Potential evidence:

* staffing;
* budgets;
* infrastructure;
* technical resources;
* assurance resources;
* training resources.

AIGO should record resource deficiencies as management-system risks or improvement actions where appropriate.

***

# 21. Competence Assurance

Competence assurance should evaluate whether relevant personnel have appropriate competence for their roles.

Potential evidence:

* competence profiles;
* role requirements;
* training;
* experience;
* qualifications;
* supervised activities;
* assessments.

AI literacy should be treated as a related capability, not as a substitute for all role competence.

***

# 22. Awareness Assurance

Assurance may test whether personnel are aware of:

* AI policy;
* relevant responsibilities;
* risks;
* controls;
* consequences of nonconformance;
* escalation mechanisms.

Methods may include:

* interviews;
* sampling;
* knowledge assessments;
* observation.

***

# 23. Communication Assurance

Assurance should assess whether required AI governance communication is:

* defined;
* timely;
* assigned;
* documented;
* effective.

Potential areas:

* internal communication;
* management reporting;
* supplier communication;
* regulatory communication;
* affected-person communication.

***

# 24. Documented-Information Assurance

Assurance should evaluate:

* document approval;
* version control;
* access;
* protection;
* retrieval;
* distribution;
* retention;
* disposition.

AIGO Document Integrity and Evidence controls should provide supporting mechanisms.

***

# 25. Document Integrity Tests

Potential tests:

* sample controlled documents;
* compare versions;
* verify approvals;
* verify ownership;
* verify change history;
* test retrieval;
* verify obsolete-document controls.

Potential findings:

```text theme={null}
DOCUMENT_VERSION_GAP
DOCUMENT_APPROVAL_GAP
DOCUMENT_INTEGRITY_GAP
DOCUMENT_RETENTION_GAP
```

***

# 26. Clause 8 Assurance — Operation

Operational assurance should evaluate whether planned AI governance processes operate as defined.

Areas include:

* AI lifecycle;
* risk treatment;
* AI development or acquisition;
* deployment;
* monitoring;
* changes;
* incidents;
* suppliers;
* operational records.

***

# 27. AI Lifecycle Assurance

AIGO should test whether governance controls are active at appropriate lifecycle stages:

```text theme={null}
Planning
 ↓
Design
 ↓
Development / Acquisition
 ↓
Validation
 ↓
Approval
 ↓
Deployment
 ↓
Operation
 ↓
Monitoring
 ↓
Change
 ↓
Retirement
```

The evidence should show that governance gates are not merely theoretical.

***

# 28. AI System Assurance

For sampled AI systems, assurance should verify alignment between:

* AI System Profile;
* intended purpose;
* classification;
* risk;
* controls;
* approval;
* monitoring;
* incidents;
* changes;
* retirement status.

***

# 29. Operational Control Assurance

For each selected control, assurance should determine:

```text theme={null}
Designed?
Implemented?
Operating?
Evidence Generated?
Exceptions Managed?
Monitored?
Reviewed?
```

A control may be technically implemented but operationally ineffective.

***

# 30. Supplier / Third-Party Assurance

Where external providers support AI activities, assurance may evaluate:

* supplier selection;
* requirements;
* contracts;
* due diligence;
* monitoring;
* evidence;
* incidents;
* changes.

Sampling should be risk-based.

***

# 31. AI System Change Assurance

Assurance should evaluate whether material changes are:

* requested;
* assessed;
* approved;
* tested;
* documented;
* monitored;
* reflected in risk;
* reflected in evidence.

Potential finding:

`CHANGE_IMPACT_NOT_COMPLETE`

***

# 32. Incident Assurance

AIGO Incident Assurance should evaluate whether:

* incidents are identified;
* severity is assessed;
* responsibilities are clear;
* containment occurs;
* root cause is investigated;
* corrective action is taken;
* effectiveness is verified.

***

# 33. Clause 9 Assurance — Performance Evaluation

Clause 9 is the primary AIMS performance-evaluation layer.

AIGO should map it to:

* monitoring;
* measurement;
* analysis;
* evaluation;
* internal audit;
* management review.

***

# 34. Monitoring Assurance

Assurance should evaluate:

* monitoring objectives;
* indicators;
* thresholds;
* measurement methods;
* data quality;
* reporting;
* escalation;
* action.

***

# 35. Measurement Assurance

A measurement should have:

* defined metric;
* source;
* method;
* frequency;
* owner;
* target or threshold where appropriate;
* evidence.

Uncontrolled metrics should not be presented as management-system measures.

***

# 36. Analysis and Evaluation Assurance

Assurance should determine whether monitoring results are actually analyzed and used.

Example:

```text theme={null}
Metric
 ↓
Result
 ↓
Trend
 ↓
Analysis
 ↓
Risk / Opportunity
 ↓
Management Action
```

***

# 37. AI Performance Assurance

Where relevant, technical performance may be assessed using:

* accuracy;
* robustness;
* reliability;
* bias;
* security;
* availability;
* human oversight;
* safety indicators.

The applicable metrics depend on system context.

***

# 38. Internal Audit Architecture

AIGO should maintain a clear relationship:

```text theme={null}
AIMS Requirement
      ↓
Audit Criteria
      ↓
Audit Programme
      ↓
Audit
      ↓
Evidence
      ↓
Findings
      ↓
Corrective Action
      ↓
Follow-Up
```

***

# 39. Internal Audit Programme

The audit programme should be risk-based and consider:

* importance of processes;
* changes;
* previous audit results;
* incidents;
* control maturity;
* regulatory significance.

The audit programme should define:

* scope;
* frequency;
* methods;
* responsibilities;
* reporting.

***

# 40. Auditor Competence

Internal auditors should have competence appropriate to the audit scope.

Potential competence areas:

* management systems;
* AI governance;
* risk;
* controls;
* technical AI where required;
* applicable legal/regulatory context.

***

# 41. Auditor Independence

Where possible, internal auditors should avoid auditing activities for which they are directly responsible.

The assurance record should document independence considerations.

***

# 42. Internal Audit Evidence

The audit record should include:

* audit ID;
* scope;
* criteria;
* auditor;
* period;
* methodology;
* evidence;
* findings;
* conclusion;
* report;
* corrective action.

***

# 43. Audit Finding Classification

AIGO may classify findings as:

```text theme={null}
OBSERVATION
MINOR_NONCONFORMITY
MAJOR_NONCONFORMITY
CRITICAL_GOVERNANCE_GAP
OPPORTUNITY_FOR_IMPROVEMENT
```

These are internal AIGO classifications.

They should not be confused with the terminology or formal conclusions of an external certification body.

***

# 44. Follow-Up Audit

Follow-up should determine:

* action implemented;
* evidence provided;
* root cause addressed;
* effectiveness demonstrated;
* residual risk acceptable.

A finding should not be closed solely because management states that an action is complete.

***

# 45. Management Review Assurance

Management review should be assessed for:

* frequency;
* required inputs;
* participation;
* decisions;
* actions;
* resource decisions;
* improvement decisions;
* evidence.

ISO's harmonized management-system structure requires management review evidence and decisions concerning continual improvement and changes to the management system.

***

# 46. Management Review Inputs

Potential assurance checks include:

* previous actions;
* internal/external changes;
* interested parties;
* performance trends;
* nonconformities;
* corrective actions;
* monitoring results;
* audit results;
* opportunities for improvement.

***

# 47. Management Review Outputs

Assurance should verify documented decisions concerning:

* improvement opportunities;
* AIMS changes;
* resources;
* risks;
* priorities;
* corrective actions.

***

# 48. Clause 10 Assurance — Improvement

Improvement assurance should cover:

* nonconformity;
* corrective action;
* continual improvement.

***

# 49. Nonconformity Assurance

When a nonconformity occurs, assurance should test:

```text theme={null}
Nonconformity
 ↓
Correction
 ↓
Cause Analysis
 ↓
Corrective Action
 ↓
Implementation
 ↓
Effectiveness
 ↓
Closure
```

***

# 50. Root-Cause Assurance

Root-cause analysis should be proportionate to the issue.

Potential methods may include:

* causal analysis;
* five-whys;
* fault-tree analysis;
* process analysis;
* technical investigation.

The method should match the problem.

***

# 51. Corrective-Action Assurance

Assurance should determine whether corrective action actually addresses the cause.

A superficial symptom correction should not automatically be considered effective corrective action.

***

# 52. Continual-Improvement Assurance

Improvement should be supported by evidence from:

* monitoring;
* audits;
* incidents;
* changes;
* complaints;
* management review;
* risk;
* regulatory developments.

The improvement process should show measurable or otherwise demonstrable progress where appropriate.

***

# 53. Annex A Assurance

The Annex A control mapping should have assurance coverage for applicable controls.

For each control:

```text theme={null}
ISO Annex A Control
       ↓
Applicability
       ↓
AIGO Control
       ↓
Implementation
       ↓
Evidence
       ↓
Assurance
```

AIGO should not assume every Annex A control is applicable to every organization or AI scope.

***

# 54. Control Applicability Assurance

Assurance should test whether control applicability decisions are:

* documented;
* justified;
* current;
* linked to AIMS scope;
* reviewed after change.

Where an Annex A control is treated as non-applicable, the organization should maintain the required justification.

***

# 55. Control Design Assurance

AIGO should assess whether mapped controls:

* address their objective;
* have owners;
* define activities;
* produce evidence;
* include monitoring;
* support escalation.

***

# 56. Control Implementation Assurance

Implementation assurance should verify:

* procedures exist;
* roles are assigned;
* systems are configured;
* evidence is generated;
* workflows operate.

***

# 57. Operating-Effectiveness Assurance

Where the assurance scope includes operating effectiveness, testing should cover a defined evidence period.

Potential methods:

* sample completed assessments;
* sample changes;
* sample incidents;
* reperform controls;
* inspect system configurations;
* observe workflows.

***

# 58. Evidence Assurance

The Evidence Mapping should connect to assurance through:

```text theme={null}
Evidence Requirement
      ↓
Evidence Record
      ↓
Evidence Validation
      ↓
Assurance Testing
```

Evidence should be evaluated for:

* authenticity;
* integrity;
* completeness;
* currency;
* traceability.

***

# 59. AIGO Evidence Coverage

A future evidence coverage result may be:

```text theme={null}
FULL
PARTIAL
GAP
NOT_APPLICABLE
PENDING
```

Assurance should identify critical evidence gaps.

***

# 60. AI Risk Assurance

The risk assurance model should connect:

```text theme={null}
AI System
 ↓
Risk
 ↓
Control
 ↓
Residual Risk
 ↓
Monitoring
 ↓
Management Review
```

Assurance should assess whether this chain is operational.

***

# 61. AIMS Risk Assurance

AIMS-level risks should also be reviewed.

Examples:

* inadequate governance;
* unclear accountability;
* insufficient competence;
* obsolete policy;
* inadequate evidence;
* ineffective monitoring;
* ineffective improvement.

***

# 62. Technical Assurance

For technically significant AI systems, technical assurance may cover:

* model testing;
* data quality;
* model performance;
* robustness;
* security;
* logging;
* monitoring;
* change control.

Technical assurance should be performed by appropriately competent personnel.

***

# 63. Human Oversight Assurance

Where human oversight is part of the AIMS control architecture, assurance should evaluate:

* role;
* authority;
* competence;
* information;
* intervention;
* override;
* escalation;
* evidence.

***

# 64. AI Literacy Assurance

AIGO should assess whether the organization takes appropriate measures to support AI literacy and competence.

The detailed AI literacy mapping for the EU AI Act remains separate from ISO/IEC 42001 assurance.

AIGO should avoid treating one framework's training evidence as automatic proof of another framework's competence requirement.

***

# 65. Governance Assurance

Governance assurance should review:

* accountability;
* policy;
* decision authority;
* roles;
* committee structures;
* reporting;
* management review.

***

# 66. Regulatory Mapping Assurance

Where AIGO integrates ISO/IEC 42001 with other regulatory frameworks, assurance should verify that:

* applicable requirements are identified;
* AIGO controls are reusable where appropriate;
* conflicts are recognized;
* legal sources are current;
* framework-specific claims remain separated.

***

# 67. Cross-Framework Assurance

A common AIGO control may support both ISO/IEC 42001 and another framework.

Example:

```text theme={null}
AIGO Change Control
     ├── ISO/IEC 42001
     ├── EU AI Act
     └── Organizational Policy
```

Assurance should verify each relationship separately where the underlying requirements differ.

***

# 68. Assurance and Certification Readiness

AIGO can provide:

`ISO42001_CERTIFICATION_READINESS`

where the organization wants to prepare for an external certification audit.

The readiness review may assess:

* scope;
* documented information;
* controls;
* evidence;
* internal audit;
* management review;
* corrective action;
* continual improvement.

***

# 69. Certification Boundary

AIGO certification-readiness assurance is not certification.

ISO/IEC 42006:2025 defines requirements for bodies that audit and certify AIMS according to ISO/IEC 42001 and supplements ISO/IEC 17021-1.

Therefore:

```text theme={null}
AIGO Readiness Assurance
        ≠
Certification Audit
```

and:

```text theme={null}
Certification Audit
        ≠
AIGO Internal Assurance
```

***

# 70. External Certification Evidence

When preparing for certification, AIGO should help assemble:

* AIMS scope;
* policy;
* context;
* risks;
* objectives;
* controls;
* documented information;
* operational evidence;
* internal audit;
* management review;
* corrective actions;
* improvement.

***

# 71. Certification-Body Boundary

AIGO should not select, designate, or impersonate a certification body.

The organization should independently verify certification-body credentials and applicable accreditation arrangements.

ISO/IEC 42006:2025 is specifically aimed at bodies conducting AIMS audits and certification.

***

# 72. Certification Evidence Traceability

The evidence package should maintain:

```text theme={null}
ISO Requirement
      ↓
AIGO Control
      ↓
Evidence
      ↓
Internal Assurance
      ↓
Certification Readiness
      ↓
External Audit Evidence
```

This prevents external certification evidence from being confused with AIGO internal assurance.

***

# 73. Assurance Planning Cycle

The annual assurance cycle may follow:

```text theme={null}
Risk Review
    ↓
Assurance Planning
    ↓
Scope
    ↓
Criteria
    ↓
Testing
    ↓
Findings
    ↓
Corrective Action
    ↓
Follow-Up
    ↓
Management Review
    ↓
Next Cycle
```

The actual cadence should be risk-based.

***

# 74. Assurance Universe

The assurance universe should include:

* AIMS processes;
* AI systems;
* controls;
* suppliers;
* governance;
* evidence;
* regulatory mappings.

Risk and materiality should drive selection.

***

# 75. Assurance Risk Rating

Potential assurance priority:

```text theme={null}
CRITICAL
HIGH
MEDIUM
LOW
INFORMATIONAL
```

Factors include:

* AI impact;
* risk;
* control criticality;
* previous findings;
* change;
* regulatory significance.

***

# 76. Assurance Sampling

Sampling can be used for:

* AI systems;
* control executions;
* incidents;
* changes;
* monitoring;
* supplier evidence.

The population and method should be documented.

***

# 77. Assurance of AI Portfolio

At portfolio level, AIGO may assess:

* number of AI systems;
* classification coverage;
* risk coverage;
* control coverage;
* evidence coverage;
* assurance coverage;
* open findings.

***

# 78. Assurance of AI System Portfolio Changes

Portfolio assurance should detect:

* new systems without governance records;
* retired systems still active;
* changes without assessment;
* duplicate system records;
* unmanaged supplier systems.

***

# 79. Assurance of AIMS Boundaries

The assurance review should verify that the actual operational AI activities remain within the approved AIMS scope.

Potential finding:

`AIMS_SCOPE_MISMATCH`

***

# 80. Assurance of Exclusions

Where parts of an organization or AI portfolio are outside the AIMS scope, assurance should verify:

* scope statement;
* rationale;
* governance boundaries;
* review;
* consistency with the standard's requirements.

***

# 81. Assurance of Interested-Party Requirements

Assurance may test:

* stakeholder identification;
* relevant needs;
* communication;
* change monitoring.

***

# 82. Assurance of AI Policy

Assurance should assess:

* approval;
* relevance;
* communication;
* implementation;
* review.

***

# 83. Assurance of Roles

Assurance should determine whether:

* roles exist;
* responsibility is assigned;
* authority is adequate;
* ownership is current.

***

# 84. Assurance of Objectives

Assurance should evaluate:

* objectives;
* measurement;
* results;
* action where objectives are missed.

***

# 85. Assurance of Resources

Assurance may assess whether resource constraints create management-system risk.

***

# 86. Assurance of Competence

Assurance may use:

* sample training records;
* interviews;
* observation;
* role profiles;
* technical assessments.

***

# 87. Assurance of Documented Information

Assurance should assess:

* controlled documents;
* records;
* evidence;
* access;
* retention;
* integrity.

***

# 88. Assurance of Operational Controls

For selected AI systems, assurance should trace:

```text theme={null}
Requirement
 ↓
Control
 ↓
Procedure
 ↓
Execution
 ↓
Evidence
 ↓
Monitoring
```

***

# 89. Assurance of Monitoring

Assurance should verify that monitoring produces actionable information.

A metric that is collected but never analyzed may represent a monitoring-design weakness.

***

# 90. Assurance of Internal Audit

Assurance should review whether internal audit:

* covers the AIMS;
* uses appropriate criteria;
* remains sufficiently independent;
* produces findings;
* follows up actions.

***

# 91. Assurance of Management Review

Assurance should verify that management review:

* occurs;
* considers appropriate inputs;
* produces documented outputs;
* results in decisions where needed.

***

# 92. Assurance of Improvement

Assurance should verify that:

* findings are addressed;
* corrective actions are effective;
* improvement is evidenced;
* recurring failures trigger broader action.

***

# 93. Assurance and Repository Tools

The following tools should support assurance:

* Schema Validator;
* Reference Validator;
* Traceability Validator;
* Control Coverage Validator;
* Evidence Coverage Validator;
* Framework Consistency Checker;
* Document Integrity Checker;
* Repository Health Checker.

***

# 94. Assurance Findings

Potential ISO/AIGO findings:

```text theme={null}
ISO_ASSURANCE_NOT_PLANNED
ISO_ASSURANCE_OVERDUE
ISO_SCOPE_GAP
ISO_CONTEXT_GAP
ISO_LEADERSHIP_GAP
ISO_PLANNING_GAP
ISO_SUPPORT_GAP
ISO_OPERATION_GAP
ISO_PERFORMANCE_EVALUATION_GAP
ISO_INTERNAL_AUDIT_GAP
ISO_MANAGEMENT_REVIEW_GAP
ISO_CORRECTIVE_ACTION_GAP
ISO_CONTINUAL_IMPROVEMENT_GAP
ISO_EVIDENCE_GAP
ISO_CONTROL_EFFECTIVENESS_GAP
```

***

# 95. Critical Assurance Findings

Potential critical findings include:

* AIMS scope materially differs from actual AI activities;
* management-system risks are unmanaged;
* internal audit is absent where required by the AIMS;
* management review is not functioning;
* significant corrective actions remain ineffective;
* critical controls cannot be evidenced;
* material documented information is uncontrolled;
* assurance findings are repeatedly closed without effectiveness verification.

***

# 96. Assurance Evidence Requirements

Every assurance activity should maintain:

* scope;
* criteria;
* methodology;
* evidence;
* reviewers;
* test results;
* conclusion;
* findings;
* follow-up.

***

# 97. Assurance Evidence Integrity

Assurance records should be:

* version controlled;
* attributable;
* protected;
* traceable;
* retained.

The assurance conclusion should be reproducible from the evidence reviewed.

***

# 98. Assurance Independence

The assurance record should identify:

* reviewer;
* organizational role;
* independence level;
* conflicts of interest;
* approval.

***

# 99. Assurance Competence

Assurance personnel should have competence appropriate to the scope.

Potential domains:

* ISO management systems;
* AI governance;
* AI risk;
* technical AI;
* data governance;
* security;
* applicable legal context.

***

# 100. Technical-Assurance Competence

Where technical testing is required, reviewers should have appropriate expertise.

A management-system auditor should not be assumed to possess sufficient technical expertise for every AI-system technical evaluation.

***

# 101. Assurance and External Specialists

The organization may use external specialists for:

* AI testing;
* cybersecurity;
* data science;
* safety;
* legal analysis.

Specialist outputs should be controlled evidence.

***

# 102. Assurance and Outsourcing

Where assurance activities are outsourced, the organization should control:

* provider competence;
* scope;
* confidentiality;
* independence;
* evidence;
* deliverables.

***

# 103. Assurance of Outsourced AI Processes

Where critical AI activities are outsourced, assurance may include supplier evidence and external assurance reports.

The organization remains accountable for the effectiveness of its AIMS.

***

# 104. Assurance and Management-System Integration

AIGO should enable combined assurance across management systems.

For example:

```text theme={null}
AI Governance Control
      ├── ISO/IEC 42001
      ├── Information Security
      ├── Privacy
      └── EU AI Act
```

Assurance should identify which criterion is being tested for each framework relationship.

***

# 105. Combined Evidence

One evidence record may support multiple frameworks where:

* scope is valid;
* requirements are compatible;
* relationships are documented.

This is a major benefit of a unified AIGO control architecture.

***

# 106. Combined Assurance

A single assurance activity may assess several framework relationships, provided:

* each criterion is separately identified;
* reviewer competence covers all scopes;
* evidence is sufficient;
* conclusions are separated by framework where necessary.

***

# 107. Assurance and Regulatory Change

A material change to ISO/IEC 42001 implementation guidance or related standards should trigger:

```text theme={null}
Source Change
 ↓
Mapping Review
 ↓
Control Impact
 ↓
Evidence Impact
 ↓
Assurance Impact
 ↓
Management Review
```

ISO currently lists ISO/IEC AWI 42003, guidance on implementation of ISO/IEC 42001, as under development.

This should be monitored as an external development, not treated as an existing normative requirement.

***

# 108. Related Standard Monitoring

The AIGO assurance mapping should monitor relevant related standards, including:

* ISO/IEC 42005:2025;
* ISO/IEC 42006:2025;
* relevant AI testing standards;
* future ISO/IEC 42003 guidance.

ISO currently lists ISO/IEC 42005:2025 and ISO/IEC 42006:2025 as published standards, while ISO/IEC 42003 remains under development.

***

# 109. Assurance and ISO/IEC 42005

Where AIGO uses AI impact-assessment practices aligned with ISO/IEC 42005:2025, the assurance record should identify that standard separately.

It should not be represented as an additional mandatory clause of ISO/IEC 42001.

***

# 110. Assurance and ISO/IEC 42006

ISO/IEC 42006:2025 is relevant to certification bodies auditing and certifying AIMS and supplements ISO/IEC 17021-1.

AIGO should therefore use ISO/IEC 42006 as a **certification-boundary reference**, not as a direct organizational AIMS requirement.

***

# 111. Assurance and Certification Readiness

The certification-readiness assessment may evaluate:

```text theme={null}
Scope
 ↓
Context
 ↓
Leadership
 ↓
Planning
 ↓
Support
 ↓
Operation
 ↓
Performance Evaluation
 ↓
Improvement
```

The result should identify readiness gaps and not issue a certification conclusion.

***

# 112. Certification Readiness Findings

Potential findings:

```text theme={null}
CERTIFICATION_READINESS_GAP
DOCUMENTED_INFORMATION_GAP
INTERNAL_AUDIT_GAP
MANAGEMENT_REVIEW_GAP
CONTROL_EVIDENCE_GAP
CORRECTIVE_ACTION_GAP
SCOPE_GAP
OBJECTIVE_GAP
```

***

# 113. Assurance and Certification Audit Preparation

AIGO may support preparation through:

* evidence indexing;
* requirement-to-evidence traceability;
* audit-request response;
* document review;
* interview preparation;
* corrective-action tracking.

***

# 114. Certification-Audit Evidence Boundary

Evidence prepared for a certification audit should be treated as:

`EXTERNAL_AUDIT_SUPPORT_EVIDENCE`

until the certification body performs its own assessment.

***

# 115. AIMS Assurance Dashboard

Potential dashboard fields:

| Measure                  | Purpose            |
| ------------------------ | ------------------ |
| AIMS Scope Coverage      | Governance         |
| Requirements Mapped      | Traceability       |
| Controls Implemented     | Control maturity   |
| Evidence Coverage        | Demonstrability    |
| Assurance Coverage       | Validation         |
| Open Findings            | Risk               |
| Overdue Actions          | Remediation        |
| Internal Audit Status    | Performance        |
| Management Review Status | Governance         |
| Certification Readiness  | External readiness |

***

# 116. Assurance Coverage Calculation

AIGO may calculate:

```text theme={null}
Applicable Requirements
        ↓
Mapped
        ↓
Controlled
        ↓
Evidenced
        ↓
Assured
```

The resulting coverage percentage is an internal governance indicator and not an ISO conformity percentage.

***

# 117. Assurance Prioritization Matrix

| Factor                  | Higher Priority When |
| ----------------------- | -------------------- |
| AI Risk                 | High                 |
| Rights Impact           | High                 |
| Safety Impact           | High                 |
| Regulatory Significance | High                 |
| Systemic Risk           | Present              |
| Prior Findings          | Recurring            |
| Control Maturity        | Low                  |
| Evidence Quality        | Weak                 |
| Change Activity         | High                 |

***

# 118. Assurance and AI System Materiality

The assurance plan should prioritize AI systems based on:

* business criticality;
* safety;
* rights impact;
* regulatory classification;
* system scale;
* autonomy;
* external reliance.

***

# 119. Assurance Sampling by AI System

A portfolio may be divided into:

```text theme={null}
Tier 1 — Critical
Tier 2 — High
Tier 3 — Moderate
Tier 4 — Low
```

The actual tiering should use the organization's risk methodology.

***

# 120. Assurance of AI System Retirement

Assurance should verify that retired systems:

* are no longer operational;
* retain required records;
* have closed incidents;
* have completed obligations;
* have documented final status.

***

# 121. Assurance Follow-Up

All major findings should have follow-up evidence.

Potential statuses:

```text theme={null}
ACTION_OPEN
ACTION_IMPLEMENTED
VERIFICATION_PENDING
VERIFIED_EFFECTIVE
VERIFIED_INEFFECTIVE
CLOSED
```

***

# 122. Assurance and Management Review Escalation

Critical or recurring findings should be escalated to management review.

AIGO should not allow material findings to remain indefinitely within an operational team.

***

# 123. Assurance and Continual Improvement

AIMS improvement should be demonstrated through a continuing feedback loop:

```text theme={null}
Evidence
 ↓
Monitoring
 ↓
Assurance
 ↓
Finding
 ↓
Improvement
 ↓
Change
 ↓
Verification
```

This provides operational evidence of continual improvement.

***

# 124. Assurance Quality Criteria

A high-quality assurance activity should be:

* objective;
* evidence-based;
* criteria-based;
* competent;
* appropriately independent;
* traceable;
* documented;
* repeatable;
* proportionate.

***

# 125. Assurance Limitations

AIGO assurance may identify gaps and provide readiness conclusions, but it cannot independently:

* certify ISO/IEC 42001;
* act as an accredited certification body;
* establish accreditation;
* bind ISO;
* issue an internationally recognized certificate;
* guarantee external audit outcomes.

ISO/IEC 42006:2025 specifically governs bodies performing AIMS audit and certification and supplements ISO/IEC 17021-1.

***

# 126. Assurance Traceability Model

The complete assurance chain is:

```text theme={null}
ISO/IEC 42001
      ↓
Clause / Annex A
      ↓
AIGO Requirement
      ↓
AIGO Control
      ↓
AIGO Record
      ↓
Evidence
      ↓
Assurance Criteria
      ↓
Assurance Activity
      ↓
Finding
      ↓
Corrective Action
      ↓
Verification
      ↓
Management Review
```

***

# 127. Assurance Registry Requirements

The future machine-readable registry should support:

```text theme={null}
assuranceId
isoReference
aigoControlId
scope
criteria
evidenceIds
assuranceType
reviewer
independence
period
method
status
findingIds
followUpIds
conclusion
```

***

# 128. Assurance and Existing Schemas

| Assurance Activity    | AIGO Schema       |
| --------------------- | ----------------- |
| Assurance record      | Assurance         |
| Requirements          | Assessment        |
| Risk                  | Risk              |
| Control               | Control           |
| Evidence              | Evidence          |
| Monitoring            | Monitoring        |
| Incident finding      | Incident          |
| Corrective change     | Change            |
| Improvement           | Improvement       |
| Management conclusion | Management Review |
| Accountability        | Governance        |

***

# 129. Assurance and Existing Templates

Primary templates:

* AI Assurance Template;
* AI Evidence Record Template;
* AI Risk Assessment Template;
* AI Control Assessment Template;
* AI Management Review Template;
* AI Change Management Template;
* AI Incident Template;
* AI Continuous Improvement Template.

No additional certification template is required for the mapping package.

***

# 130. Assurance and Validation Tools

The mapping should support:

* Schema Validator;
* Reference Validator;
* Traceability Validator;
* Control Coverage Validator;
* Evidence Coverage Validator;
* Framework Consistency Checker;
* Document Integrity Checker;
* Repository Health Checker.

***

# 131. Assurance Findings

Potential AIGO findings include:

```text theme={null}
ISO_ASSURANCE_SCOPE_UNRESOLVED
ISO_ASSURANCE_CRITERIA_MISSING
ISO_ASSURANCE_NOT_PLANNED
ISO_ASSURANCE_OVERDUE
ISO_EVIDENCE_INSUFFICIENT
ISO_CONTROL_INEFFECTIVE
ISO_INTERNAL_AUDIT_GAP
ISO_MANAGEMENT_REVIEW_GAP
ISO_CORRECTIVE_ACTION_INEFFECTIVE
ISO_CONTINUAL_IMPROVEMENT_GAP
ISO_CERTIFICATION_READINESS_GAP
```

***

# 132. Critical Assurance Findings

Potential critical findings include:

* AIMS scope does not reflect actual AI activities;
* management-system controls lack evidence;
* required internal audit is absent or ineffective;
* management review is not functioning;
* major corrective actions are repeatedly ineffective;
* critical AI governance controls are not operating;
* certification-readiness claims are unsupported.

***

# 133. Assurance Metrics

Potential metrics:

| Metric                  | Purpose              |
| ----------------------- | -------------------- |
| Requirements Assured    | Coverage             |
| Controls Assured        | Control coverage     |
| Evidence Reviewed       | Evidence coverage    |
| Findings Open           | Remediation          |
| Critical Findings       | Risk                 |
| Overdue Findings        | Management attention |
| Repeat Findings         | Control maturity     |
| Follow-Up Effectiveness | Corrective action    |
| Certification Readiness | External preparation |

***

# 134. Assurance Review Frequency

The assurance programme should be reviewed:

* annually;
* after significant organizational changes;
* after material AI-system changes;
* after major incidents;
* after major audit findings;
* after material changes to ISO guidance or related standards.

***

# 135. Regulatory / Standards Watch

The organization should monitor:

* ISO/IEC 42001 status;
* ISO/IEC 42005;
* ISO/IEC 42006;
* future ISO/IEC 42003 guidance;
* relevant AI testing standards.

The purpose is to identify impacts on assurance criteria without prematurely treating draft standards as mandatory requirements.

ISO currently lists ISO/IEC 42003 as under development, while ISO/IEC 42005 and ISO/IEC 42006 are published.

***

# 136. Current Standard Baseline

The current primary standard is:

**ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system**

ISO lists it as the first edition, published in December 2023.

Related current standards:

* ISO/IEC 42005:2025 — AI system impact assessment;
* ISO/IEC 42006:2025 — AIMS audit and certification bodies.

These are related standards and should not be merged into the ISO/IEC 42001 requirement baseline.

***

# 137. Assurance Source Hierarchy

Assurance criteria should follow:

```text theme={null}
ISO/IEC 42001
        ↓
Applicable Related Normative Requirements
        ↓
Approved AIGO Mapping
        ↓
AIGO Control
        ↓
Organizational Procedure
        ↓
Evidence
```

Guidance should be clearly identified as guidance.

***

# 138. Assurance and AIGO Architecture

The assurance layer completes the AIGO ISO mapping:

```text theme={null}
Requirements
    ↓
Controls
    ↓
Lifecycle
    ↓
Risk
    ↓
Governance
    ↓
Evidence
    ↓
Implementation
    ↓
Assurance
```

***

# 139. Assurance and Master Mapping

The master mapping remains:

`01-AIGO-ISO-42001-Mapping-v0.1.md`

This document adds assurance depth and should not replace the master mapping.

***

# 140. Assurance and Requirements Mapping

`02-AIGO-ISO-42001-Requirements-Mapping-v0.1.md`

remains authoritative for detailed requirement relationships.

Assurance should use those relationships as its criteria source.

***

# 141. Assurance and Control Mapping

`03-AIGO-ISO-42001-Control-Mapping-v0.1.md`

remains authoritative for the ISO control mapping.

AIGO assurance tests whether those mapped controls are appropriately implemented and effective.

***

# 142. Assurance and Lifecycle Mapping

`04-AIGO-ISO-42001-Lifecycle-Mapping-v0.1.md`

defines lifecycle relationships.

Assurance should verify governance gates across the lifecycle.

***

# 143. Assurance and Risk Mapping

`05-AIGO-ISO-42001-Risk-Mapping-v0.1.md`

defines risk architecture.

Assurance should verify:

* risk identification;
* treatment;
* monitoring;
* residual risk;
* change.

***

# 144. Assurance and Governance Mapping

`06-AIGO-ISO-42001-Governance-Mapping-v0.1.md`

defines leadership and governance relationships.

Assurance should verify:

* accountability;
* policy;
* roles;
* management review;
* governance decisions.

***

# 145. Assurance and Evidence Mapping

`07-AIGO-ISO-42001-Evidence-Mapping-v0.1.md`

defines evidence relationships.

This assurance document defines how that evidence is evaluated.

***

# 146. Assurance and Implementation Mapping

`08-AIGO-ISO-42001-Implementation-Mapping-v0.1.md`

defines practical implementation.

Assurance evaluates whether the planned implementation actually operates.

***

# 147. Assurance and Future AIGO Control Mapping

`10-AIGO-ISO-42001-AIGO-Control-Mapping-v0.1.md`

will provide the detailed control-level crosswalk.

Assurance should reference stable AIGO control IDs from that document rather than duplicating control definitions.

***

# 148. Assurance and Registry

`00-AIGO-ISO-42001-Mapping-Registry-v0.1.json`

should eventually contain assurance relationships and identifiers.

This document defines what those relationships mean.

***

# 149. Assurance Quality Control

Before an assurance report is finalized, verify:

```text theme={null}
Scope Defined
Criteria Defined
Evidence Identified
Evidence Reviewed
Method Recorded
Reviewer Identified
Independence Considered
Findings Validated
Conclusion Supported
Follow-Up Defined
```

***

# 150. Final Assurance Lifecycle

The intended AIGO ISO/IEC 42001 assurance lifecycle is:

```text theme={null}
ISO/IEC 42001 Requirement
        ↓
AIGO Mapping
        ↓
AIGO Control
        ↓
Implementation
        ↓
Evidence
        ↓
Monitoring
        ↓
Assurance
        ↓
Finding
        ↓
Corrective Action
        ↓
Verification
        ↓
Management Review
        ↓
Continual Improvement
```

This structure allows the AIGO framework to support systematic preparation, internal assurance, and controlled readiness for external assessment without confusing those activities with formal certification.

***

# 151. Document Control

| Field                      | Value                                |
| -------------------------- | ------------------------------------ |
| Document                   | AIGO ISO/IEC 42001 Assurance Mapping |
| Version                    | 0.1                                  |
| Status                     | Draft                                |
| Document Identifier        | `AIGO-MAP-ISO42001-009`              |
| Document Type              | ISO Management-System Mapping        |
| Primary Standard           | ISO/IEC 42001:2023                   |
| Related Standard           | ISO/IEC 42006:2025                   |
| Owner                      |                                      |
| Legal / Standards Reviewer |                                      |
| Governance Reviewer        |                                      |
| Assurance Reviewer         |                                      |
| Framework Architect        |                                      |
| Approved By                |                                      |
| Effective Date             |                                      |
| Next Review Date           |                                      |

***

# 152. Document Status

**Document:** AIGO — ISO/IEC 42001 Assurance Mapping

**Version:** 0.1

**Status:** Draft

**Working Name:** AIGO

**Full Name:** AI Governance Operating Framework

**Document Identifier:** `AIGO-MAP-ISO42001-009`

**Document Type:** ISO Management-System Mapping

This document maps ISO/IEC 42001 management-system assurance requirements to the AIGO assurance architecture, including performance evaluation, internal audit, management review, evidence evaluation, control effectiveness, corrective action, continual improvement, certification readiness, and the boundary between internal AIGO assurance and external AIMS certification.

End of Document