ISO/IEC 42001 internal audit and management review
- Clause 9.2 (internal audit) and 9.3 (management review) are what distinguish an operated AIMS from a documented one.
- Internal audit must cover the whole AIMS over a defined cycle, not sample-of-convenience.
- Management review must be attended by leadership with authority to make the changes it proposes.
- Both are the two most-common late-stage failures — build them first, not last.
- Records must be dated, owned and traceable to action.
- General information, not legal advice. Current as of July 2026.
Why these two clauses matter most
A management system is not a folder of policies. It is a set of activities that happen on a cycle, produce evidence, and drive change. Internal audit and management review are the two clauses where the cycle is most visible to an outside auditor, which is why certification bodies open with them.
What internal audit under 9.2 looks like
- A documented audit programme covering the whole AIMS over a defined period (typically annual or 24-month cycles).
- Independence — the auditor is not the person who owns the process being audited.
- Competence — the auditor has the training and experience to audit an AI management system.
- A structured audit report per audit, with findings classified and tracked to closure.
- A view of the whole programme showing coverage, cadence and status of findings.
What management review under 9.3 looks like
- Held at a defined frequency (typically at least annually, more often for a mature AIMS).
- Attended by the leadership team with authority to allocate resources and make policy changes.
- A prescribed input pack — audit results, performance data, incidents, changes in context, stakeholder feedback, opportunities for improvement.
- Documented outputs — decisions taken, actions assigned to owners with dates.
- Minutes retained and traceable into the next cycle.
The most-common failures
Internal audit that samples what is easy rather than covering the AIMS on a programme. Findings raised but never closed. Management review scheduled but repeatedly postponed. Management review 'held' but attended by a compliance manager alone, with no leadership decision to record. Auditors see these patterns immediately.
Build them early, not late
Both cycles need to have actually run for a period before the Stage 2 audit; a first internal audit conducted in the week before Stage 2 is visible for what it is. Plan them into the AIMS from the start, not as a last box to tick.
Key terms
- Internal audit programme
- The rolling plan by which an organisation audits its own management system, independent of the process owner.
- Management review
- The periodic leadership review of the management system's performance and its need for change (Clause 9.3).