Book a time

Frameworks in Practice

Reflections on ISO 42001 and audit training

Peter O'Hanlon, founder of Koncura

Frameworks in Practice: all 12 articles

Purpose

Open the series in your own voice, as someone who has built AI systems for twenty years and has just been through ISO 42001 Lead Auditor training (SAI Global) and ISO 19011 training. It says what surprised you, what a builder notices that the course doesn’t stress, and why it matters for smaller organisations. Each reflection is a short preview of a later post. It closes with the readiness assessment offer.

Reader

Founders, CTOs and NfP leaders who are hearing about ISO 42001 from buyers, funders or boards, plus assurance peers.

Opening

Why a builder took audit training: after years of having to defend systems to the people they landed on, the author wanted to see the standard from the auditor’s side of the table.

Reflections (one paragraph each, each pointing to a later post)

  1. It starts with context, and everything flows from there. A checklist detached from context makes no sense. (There is no checklist)
  2. The structure is inherited. Many apparent gaps are the price of the Harmonized Structure. (Know the skeleton)
  3. Auditors certify conformity, not the quality of judgement. Thin processes pass once and struggle over cycles. (Impact assessment isn’t a vibe check)
  4. Proportionality comes from risk, not headcount. (Size doesn’t excuse you)
  5. Honest scope beats impressive scope. (The documentation trap)
  6. Some things are simply out of scope, cost among them. (Silent on cost)
  7. The question the course doesn’t ask: what do I say to the person this lands on? (What do I say)

Mission line

Smaller organisations can meet this standard well without the big end of town’s resources, because most of what it asks for is thinking about your own context, and right-sizing to your ambitions and your risks.

Honest framing

Trained, not yet registered. A practitioner who builds and assures, not an auditor only.

Close and offer

A readiness assessment: an independent look at whether your context, controls, documents and impact assessment hang together, with a prioritised plan, before a buyer, funder or auditor asks. Link to the offers page. Mention that the posts that follow go deeper on each reflection.

Offers page; series index page.