ISO/IEC 42001 readiness in four to six weeks.
A fixed-scope assessment of your AI management system, run to Lead Auditor standard. You find out which requirements you meet with evidence, which you meet on paper only, and what stands between you and certification.
Auditors test operating records.
Most organisations preparing for ISO/IEC 42001 have the policies. What a certification auditor asks for next is the operating evidence: the impact assessment completed before the system went live, the monitoring record that shows the model was checked, the corrective action that was actually closed.
This assessment samples that evidence the way an auditor would, so the gaps surface in your own report before a Stage 1 audit finds them.
"A control that exists only in the policy is a nonconformity waiting for a sample. The assessment finds it first."
Terence KokYou need to show your AI is governed.
- You plan ISO/IEC 42001 certification in the next twelve to eighteen months
- A regulator, customer or tender is asking for evidence of AI governance
- You run AI in regulated, public or critical services and your board wants an independent view
- You already hold ISO/IEC 27001 and want to know how far it carries you
You have no AI in use yet.
- You are still choosing your first use cases: a single advisory session is the better fit
- You need the certificate itself: that comes from an accredited certification body
- You need engineering delivery: that is a scoped project, separate from the assessment
Depending on where you are, one of these is likely the better starting point:
Private AI Strategy Session →AI Governance & ROI Executive Programme →
Government & Enterprise Programmes →
Three phases over four to six weeks.
Scope and inventory
Week one. Every AI system in scope listed with its owner, intended use and risk tier, and the context of the management system agreed with your sponsor.
Evidence and interviews
The middle weeks. Each requirement and the Annex A controls you have selected are tested against operating records. Samples are drawn with a recorded seed, so anyone can replay them and get the same items.
Report and board readout
The final week. A graded gap register, a review of your Statement of Applicability and impact assessments, and a roadmap presented to your board or executive committee.
Four deliverables your auditor will recognise.
AI system inventory
Every system in scope with its owner, purpose, data, risk tier and the controls that apply to it.
Graded gap register
Each gap graded as a certification auditor would grade it, with the evidence examined and the reason for the grade.
SoA and impact assessment review
Your Statement of Applicability and AI system impact assessments checked for completeness and for evidence behind each decision.
Roadmap and board readout
The gaps in order, each with an owner, an effort estimate and a target date, presented to the people who fund the work.
Fee: on enquiry, fixed after scoping. Engagements are contracted through Orion Five Engineering Pte Ltd (UEN 201509695E).
Published work this engagement applies.
Each method below is public, versioned and deposited with a DOI, so you can read it before you enquire and your auditor or board can check it afterwards. These are open deposits, not peer-reviewed papers.
| Published work | How it is used here | Record |
|---|---|---|
| Reference architectureGoverned Agentic RAG: Reference Architecture | Maps each control in an agentic retrieval pipeline to an ISO/IEC 42001 clause or Annex A control. The same map is used when testing those controls against operating records. | doi:10.5281/zenodo.22727449 |
| FrameworkTRACE Framework | Used on agentic systems in the inventory to set the risk tier and to check that the escalation pathway has been exercised, not only documented. | doi:10.5281/zenodo.22722217 |
| FrameworkFour-Question AI Governance Baseline | The four baseline questions frame the context and ownership interviews in week one. | doi:10.5281/zenodo.22722219 |
| FrameworkGoverned Cognitive Layer (Layer 8) | The reference for where deterministic checks and the audit trail sit, compared with what has been built. | doi:10.5281/zenodo.22722227 |
| Case studyRobodebt: How an Automated Debt Scheme Failed | Used in the board readout on why an impact assessment needs evidence behind it. | doi:10.5281/zenodo.23393553 |
Rate your clauses and draft your Statement of Applicability first → Free, no sign-up.
The credentials are not badges. They set the standard each output is written to.
- ISO/IEC 42001 Lead AuditorCertified ISO/IEC 42001 Lead Auditor Professional (BSI), AI Management Systems
- The governance diagnosis
Governance gaps are assessed against the clauses of ISO/IEC 42001:2023, the AI management system standard, so the written summary describes your position in the terms an external auditor would use.
- AIGPArtificial Intelligence Governance Professional (Singapore Management University)
- The risk and impact assessment
Risk, impact and accountability questions follow the AI governance body of knowledge the AIGP certifies: who is accountable, what the system may do, what happens when it is wrong, and what must be recorded.
- RMCRegistered Management Consultant, Singapore
- The engagement itself
Scope, confidentiality, independence and the written record are handled to the Registered Management Consultant standard, the Singapore accreditation for management consulting practice.
What people ask before enquiring.
Is this a certification audit?
No. Certification is issued by an accredited certification body after its own Stage 1 and Stage 2 audits. This assessment tells you, before that, where you would stand: which requirements you already meet with evidence, which you meet on paper only, and which are missing. Keeping the two separate also keeps the assessment independent of whoever certifies you.
How long does it take?
Four to six weeks, depending on how many AI systems and sites are in scope. One business unit with two or three systems usually fits in four weeks.
What do you need from us?
A named sponsor, an hour each with the owners of the AI systems in scope, and read access to your policies, risk records and the operating records behind them, such as model monitoring reports and change logs.
Do you fix the gaps as well?
The roadmap names an owner and a sequence for every gap. If you want help closing them, that runs afterwards as a separate retainer or project, so the assessment itself stays an independent view.
Does it cover the EU AI Act, the NIST AI RMF or Singapore's Model AI Governance Framework?
Where they apply to you, the gap register carries a crosswalk, so one piece of evidence can be traced to each framework that asks for it.
How is it priced?
A fixed fee, agreed after a short scoping call once the number of systems and sites is known. There are no day rates and no open-ended extensions.
Ready to scope an assessment? You will hear back within one business day.
Let's Talk →
I took the Lead Auditor qualification because the question boards now ask me most is whether they can prove their AI is under control. An assessment like this answers it with records. If the answer is that you are further away than you hoped, it is far better to hear it from me in week four than from a certification body at Stage 1.
