aims-audit

原文涵盖的主题

• /compliance-os:aims-audit — AIMS ISO 42001 Forcing Questions
• When to Run
• The Six AIMS Questions
• 1. Does the AIMS scope statement name every AI system?
• 2. Does the AI policy commit to lawful use AND beneficial purpose AND human oversight AND continual improvement?
• 3. What's the risk register coverage, and which Annex A controls treat each risk?
• 4. Has the AI risk assessment been re-run since the last material model change?
• 5. What's the Clause 9.2 internal audit plan, and is auditor independence respected?

Command: /compliance-os:aims-audit The ISO 42001 AIMS specialist pressure-tests any AI Management System work. Six questions before any certification commitment, internal audit cycle, or new-system onboarding. Before stage 1 ISO 42001 certification audit Before annual internal audit cycle (Clause 9.2) When onboarding a new AI system into existing AIMS scope When AI risk register hasn't been refreshed in > 6 months After material model change (re-evaluate risks per Clause 6.1.2) When audit findings hint at AIMS / ISMS / QMS duplication Scope omission = certification finding. Including: embedded models, third-party AI services, "experimental" production systems Run aimsgapanalyzer.py to verify Clause 4.3 evidence "AI features added by SaaS vendors we use" = in scope if they affect the company's services Missing any of the four = critical nonconformity at stage 1. AI policy is NOT info-sec policy — it has separate substantive content Reference ISO 42001 Annex A.2.2 + Clause 5.2 Marketing-copy "AI ethics" doesn't pass Risk identification without control mapping = Clause 6.1.3 fails. Run airiskregisterbuilder.py per ISO 23894 methodology Every high/critical risk must link to ≥ 1 Annex A

这里只展示节选，请以完整原文和当前要求为准。