Skip to content

Commit b292c8d

Browse files
Ankit-UniyalAnkit-Uniyal
authored
Revise README for Clause 9 and improve clarity
Updated the README to clarify the purpose of Clause 9 and reorganized the files section for better readability. Enhanced the monitoring, measurement, analysis, and evaluation sections with clearer instructions and added a documents checklist.
1 parent ef92074 commit b292c8d

File tree

1 file changed

+25
-175
lines changed

1 file changed

+25
-175
lines changed

‎08-CLAUSE9-PERFORMANCE/README.md‎

Lines changed: 25 additions & 175 deletions
Original file line numberDiff line numberDiff line change
@@ -1,200 +1,50 @@
11
# Clause 9 — Performance Evaluation
22
## ISO/IEC 42001:2023 | Implementation Guide
33

4-
> **Purpose:** You cannot manage what you do not measure. Clause 9 ensures you systematically monitor, measure, analyse, and evaluate your AIMS — and report results to management so they can drive improvement.
4+
Purpose: Monitor, measure, analyse, and evaluate the AIMS and AI system performance.
55

66
---
77

8-
## Files in This Folder
8+
## Files in This Folder — Read in This Order
99

10-
| File | Contents |
11-
|------|---------|
12-
| README.md | This clause guide |
13-
| INTERNAL-AUDIT-PROCEDURE.md | How to plan and conduct AIMS internal audits |
14-
| MANAGEMENT-REVIEW-TEMPLATE.md | Agenda and template for management review meetings |
15-
| ISO42001-INTERNAL-AUDIT-GUIDE.md | Detailed guide for auditing each clause |
10+
| # | File | What It Is | ISO Ref |
11+
|---|------|-----------|---------|
12+
| 1 | [AI-PERFORMANCE-MONITORING-PLAN.md](AI-PERFORMANCE-MONITORING-PLAN.md) | What to monitor, how, how often, and who reviews | 9.1 |
13+
| 2 | [ISO42001-INTERNAL-AUDIT-GUIDE.md](ISO42001-INTERNAL-AUDIT-GUIDE.md) | Comprehensive guide to conducting AIMS internal audits | 9.2 |
14+
| 3 | [INTERNAL-AUDIT-PROCEDURE.md](INTERNAL-AUDIT-PROCEDURE.md) | Procedure for planning and executing audits | 9.2 |
15+
| 4 | [ANNUAL-AUDIT-PROGRAMME.md](ANNUAL-AUDIT-PROGRAMME.md) | 12-month rolling audit schedule | 9.2 |
16+
| 5 | [INDIVIDUAL-AUDIT-PLAN-TEMPLATE.md](INDIVIDUAL-AUDIT-PLAN-TEMPLATE.md) | Per-audit plan template (scope, criteria, team, schedule) | 9.2 |
17+
| 6 | [MANAGEMENT-REVIEW-TEMPLATE.md](MANAGEMENT-REVIEW-TEMPLATE.md) | Structured agenda and record for management reviews | 9.3 |
18+
19+
Read order: 1 > 2 > 3 > 4 > 5 > 6
1620

1721
---
1822

1923
## 9.1 — Monitoring, Measurement, Analysis and Evaluation
2024

21-
### What it requires
22-
Determine what to monitor and measure, how to do it, when to analyse results, and who is responsible. Then actually do it and keep records.
23-
24-
### AI Performance Metrics Framework
25-
26-
**Technical Performance Metrics (per AI System)**
27-
28-
| Metric | Description | Target | Frequency |
29-
|--------|-------------|--------|-----------|
30-
| Model Accuracy | Overall prediction accuracy | As per system spec | Monthly |
31-
| Precision / Recall / F1 | Quality of positive predictions | As per system spec | Monthly |
32-
| Model Drift | Degradation in performance over time | < 5% drift from baseline | Monthly |
33-
| Fairness Score | Disparate impact ratio across protected groups | < 0.8 or > 1.25 triggers review | Monthly |
34-
| Explainability Coverage | % of decisions that can be explained on request | 100% for high-risk decisions | Per decision |
35-
| System Uptime | AI system availability | As per SLA | Continuous |
36-
37-
**AIMS Process Metrics (system-wide)**
38-
39-
| Metric | Description | Target | Frequency |
40-
|--------|-------------|--------|-----------|
41-
| Impact Assessments Completed | % of in-scope AI systems with current impact assessment | 100% | Quarterly |
42-
| Training Completion | % of in-scope staff who completed AI awareness training | 90% | Annual |
43-
| Audit Programme Progress | % of planned audits completed on schedule | 100% | Annual |
44-
| Open Risk Treatments | Number of overdue risk treatment actions | 0 | Monthly |
45-
| AI Incidents | Number of AI-related incidents per quarter | Target: decreasing trend | Quarterly |
46-
| Supplier Assessments Current | % of Tier 1 AI suppliers with current assessment | 100% | Annual |
47-
| Objectives Achievement | % of AI objectives on track | > 80% | Quarterly |
48-
49-
### Monitoring Process
50-
1. Define metrics and targets (link to Clause 6.2 AI Objectives)
51-
2. Assign monitoring owners for each metric
52-
3. Collect data (automated dashboards, manual reports, audit results)
53-
4. Analyse results — trends, anomalies, root causes
54-
5. Evaluate against targets — is performance acceptable?
55-
6. Report to management at defined intervals
56-
7. Take corrective action when targets are not met (feeds into Clause 10)
57-
58-
### Documents Required
59-
- AI Performance Monitoring Plan (what, how, when, who)
60-
- AI Performance Dashboard / Report (actual measurement results)
61-
- AIMS Metrics and KPIs Register
62-
63-
---
25+
Determine what to monitor and measure, the methods used, when performed, and when results are analysed. See AI-PERFORMANCE-MONITORING-PLAN.md.
6426

6527
## 9.2 — Internal Audit
6628

67-
### What it requires
68-
Conduct internal audits at planned intervals to determine whether the AIMS:
69-
- Conforms to the organisation's own requirements for AIMS
70-
- Conforms to ISO 42001 requirements
71-
- Is effectively implemented and maintained
72-
73-
### Audit Programme
74-
The audit programme must cover:
75-
- The scope of each audit
76-
- Frequency (typically annual for full AIMS; more frequent for high-risk areas)
77-
- Methods (interviews, document review, process observation, system testing)
78-
- Responsibilities (who conducts, who reviews, who receives report)
79-
- Reporting requirements
80-
81-
### Annual AIMS Audit Plan Template
82-
83-
| Audit Area | Clauses | Month | Lead Auditor | Status |
84-
|-----------|---------|-------|-------------|--------|
85-
| Context and Scope | 4.1–4.4 | March | [Name] | Planned |
86-
| Leadership and Policy | 5.1–5.3 | March | [Name] | Planned |
87-
| Planning and Risk | 6.1–6.3 | April | [Name] | Planned |
88-
| Support | 7.1–7.5 | April | [Name] | Planned |
89-
| Operations | 8.1–8.4 | May | [Name] | Planned |
90-
| AI Impact Assessments | 8.2 | May | [Name] | Planned |
91-
| Supplier Management | 8.4 | June | [Name] | Planned |
92-
| Performance Evaluation | 9.1–9.3 | June | [Name] | Planned |
93-
| Continual Improvement | 10.1–10.2 | June | [Name] | Planned |
94-
95-
### Auditor Independence
96-
Auditors must be independent of the areas they audit — they cannot audit their own work.
97-
98-
### Audit Process
99-
1. Plan: Define scope, criteria, methods, schedule
100-
2. Notify: Inform auditees in advance
101-
3. Gather Evidence: Review documents, conduct interviews, observe processes
102-
4. Evaluate: Compare evidence against requirements
103-
5. Report: Issue findings — conformances, nonconformances, observations
104-
6. Follow Up: Verify corrective actions are implemented
105-
106-
> Full procedure: see INTERNAL-AUDIT-PROCEDURE.md in this folder
107-
> Detailed audit guide: see ISO42001-INTERNAL-AUDIT-GUIDE.md in this folder
108-
109-
### Documents Required
110-
- Annual Audit Programme
111-
- Individual Audit Plans (per audit)
112-
- Audit Reports (findings, nonconformances, observations)
113-
- Audit Evidence Records
114-
- Corrective Action Tracking Log (links to Clause 10)
115-
116-
---
29+
Conduct audits at planned intervals to verify AIMS conformity and effectiveness. See ISO42001-INTERNAL-AUDIT-GUIDE.md, INTERNAL-AUDIT-PROCEDURE.md, ANNUAL-AUDIT-PROGRAMME.md, and INDIVIDUAL-AUDIT-PLAN-TEMPLATE.md.
11730

11831
## 9.3 — Management Review
11932

120-
### What it requires
121-
Top management must review the AIMS at planned intervals to ensure it remains suitable, adequate, and effective — and to drive continual improvement.
122-
123-
### Management Review Frequency
124-
At minimum: annually. Best practice: quarterly or semi-annually for active AI programmes.
125-
126-
### Management Review Inputs (what you must bring to the meeting)
127-
128-
| Input | Source | Owner |
129-
|-------|--------|-------|
130-
| Status of actions from previous management reviews | Previous minutes | AI Gov Lead |
131-
| Changes in external and internal issues relevant to the AIMS | Context analysis update | AI Gov Lead |
132-
| AI performance and trend information | Monitoring dashboard | Risk Manager |
133-
| Audit results (internal and external) | Audit reports | Internal Auditor |
134-
| Nonconformities and corrective actions | NCR log | AI Gov Lead |
135-
| Monitoring and measurement results | KPI report | AI Gov Lead |
136-
| Interested party feedback | Stakeholder feedback log | AI Gov Lead |
137-
| Risk treatment effectiveness | Risk register | Risk Manager |
138-
| Opportunities for continual improvement | Improvement log | AI Gov Lead |
139-
| AI Objectives achievement | Objectives tracker | AI Gov Lead |
140-
141-
### Management Review Outputs (what must come out)
142-
- Decisions and actions on opportunities for continual improvement
143-
- Any needed changes to the AIMS (policy, objectives, controls)
144-
- Resource needs
145-
146-
### Management Review Agenda Template
147-
148-
AIMS MANAGEMENT REVIEW AGENDA
149-
Date: [Date] | Attendees: [Names and Roles] | Chair: [AI Governance Lead / CEO]
150-
151-
1. Review of actions from last meeting (10 min)
152-
2. AIMS performance dashboard review (15 min)
153-
3. AI incidents review and trend analysis (10 min)
154-
4. Internal audit results and open findings (10 min)
155-
5. Risk register review — new/changed risks, overdue treatments (15 min)
156-
6. AI objectives achievement (10 min)
157-
7. Stakeholder feedback and interested party requirements changes (5 min)
158-
8. Regulatory and standards updates (5 min)
159-
9. Continual improvement opportunities (10 min)
160-
10. Resource needs and decisions (5 min)
161-
11. Actions, owners, and deadlines (10 min)
162-
163-
> Full template: see MANAGEMENT-REVIEW-TEMPLATE.md in this folder
164-
165-
### Documents Required
166-
- Management Review Meeting Minutes (with decisions and actions)
167-
- Management Review Input Reports
168-
- Action Register from Management Review
33+
Top management must review the AIMS at planned intervals to ensure continuing suitability, adequacy, and effectiveness. See MANAGEMENT-REVIEW-TEMPLATE.md.
16934

17035
---
17136

172-
## Clause 9 — Documents Checklist
173-
174-
| # | Document | ISO Ref | Location | Status |
175-
|---|----------|---------|----------|--------|
176-
| 1 | AI Performance Monitoring Plan | 9.1 | This folder | To Do |
177-
| 2 | AI Performance Dashboard / Report | 9.1 | This folder | To Do |
178-
| 3 | Annual Audit Programme | 9.2 | This folder | To Do |
179-
| 4 | Individual Audit Plans | 9.2 | This folder | Per audit |
180-
| 5 | Audit Reports | 9.2 | This folder | Per audit |
181-
| 6 | Internal Audit Procedure | 9.2 | INTERNAL-AUDIT-PROCEDURE.md | Available |
182-
| 7 | ISO 42001 Audit Guide | 9.2 | ISO42001-INTERNAL-AUDIT-GUIDE.md | Available |
183-
| 8 | Management Review Minutes | 9.3 | This folder | Per review |
184-
| 9 | Management Review Template | 9.3 | MANAGEMENT-REVIEW-TEMPLATE.md | Available |
185-
186-
---
37+
## Documents Checklist
18738

188-
## What Auditors Check in Clause 9
189-
- Are there defined metrics with targets — not just data collection?
190-
- Is monitoring actually happening — are there records of measurements?
191-
- Is the audit programme documented and followed?
192-
- Are auditors independent of the areas they audit?
193-
- Are audit reports issued with findings and corrective actions?
194-
- Are management reviews held at defined intervals — with records?
195-
- Do management review records show real decisions and actions?
196-
- Is there evidence that management review inputs were actually reviewed?
39+
| # | Document | ISO Ref | File |
40+
|---|----------|---------|------|
41+
| 1 | AI Performance Monitoring Plan | 9.1 | [AI-PERFORMANCE-MONITORING-PLAN.md](AI-PERFORMANCE-MONITORING-PLAN.md) |
42+
| 2 | Internal Audit Guide | 9.2 | [ISO42001-INTERNAL-AUDIT-GUIDE.md](ISO42001-INTERNAL-AUDIT-GUIDE.md) |
43+
| 3 | Internal Audit Procedure | 9.2 | [INTERNAL-AUDIT-PROCEDURE.md](INTERNAL-AUDIT-PROCEDURE.md) |
44+
| 4 | Annual Audit Programme | 9.2 | [ANNUAL-AUDIT-PROGRAMME.md](ANNUAL-AUDIT-PROGRAMME.md) |
45+
| 5 | Individual Audit Plan Template | 9.2 | [INDIVIDUAL-AUDIT-PLAN-TEMPLATE.md](INDIVIDUAL-AUDIT-PLAN-TEMPLATE.md) |
46+
| 6 | Management Review Template | 9.3 | [MANAGEMENT-REVIEW-TEMPLATE.md](MANAGEMENT-REVIEW-TEMPLATE.md) |
19747

19848
---
19949

200-
*ISO/IEC 42001:2023 AI Governance Toolkit — Clause 9 | See root README.md for full index*
50+
*ISO/IEC 42001:2023 AI Governance Toolkit | Clause 9 of 10 | See root README.md for full index*

0 commit comments

Comments
 (0)