4 lessons learned during our ISO 42001 audit

Vanta is proud to be one of the first companies to achieve ISO 42001 compliance with our audit partner Schellman, an ANSI-accredited ISO 42001 auditor. 

‍

To prepare for and pass our audit, our team worked diligently to assess our specific business needs, communicate clearly with stakeholders and AI leadership, and complete formal training to learn how to develop, integrate, and deploy trustworthy AI systems in line with emerging laws and policies. 

‍

Equipped with this real-world experience—and our powerful trust management platform to streamline ISO 42001 compliance—Vanta has the knowledge and tools to make ISO 42001 attainable for any organization. 

‍

Here are some of the biggest lessons we learned during our audit process and tips for you to consider as you begin your journey to ISO 42001. 

‍

1. Educate and inform your team and key stakeholders

Prior to our audit, we spent a lot of time educating our team and key stakeholders about the “why” and “how” of ISO 42001. This helped create a shared sense of responsibility when cross-functional support was needed and inspired more collaboration to guide how we plan for new changes. 

‍

Collaboration allowed us to ask questions about how certain processes were completed (before the audit), explain potential changes we would need to make, and brainstorm recommendations for how to move forward. Importantly, this brought our engineering or product teams in as partners in the control design process.

‍

During the prep and audit process, key stakeholders received updates via bi-weekly status calls and ad hoc Slack messages. Dedicated communication channels helped streamline the process and keep everything on track. 

‍

2. Consider additional AI training 

Although it wasn’t required for ISO 42001 certification, one of our team members completed AIGP training from IAPP prior to our audit. The training helped our team lead understand AI risk at a deeper level and contextualize those risks against the requirements of ISO 42001. AIGP training went beyond just the history of AI and ML systems—it provided a formal structure to make decisions about managing AI systems and how to make their impacts predictable and repeatable. It stripped away much of the FUD surrounding the technology and framed managing it as an opportunity when rooted in good governance.

‍

As an added benefit, the certification proved to be useful during our audit—specifically when asked about “training and expertise of stakeholders.” Auditors felt at ease knowing that a member of our team was certified by IAPP. 

‍

3. Focus on integrating ISO 42001 into existing processes

Where able, our team integrated ISO 42001 into existing processes versus creating net new processes. For example, we have an existing process for developing new functions that uses product resource documents (PRDs), requests for comments, and engineering specifications as part of the planning process. These documents cover customer asks, implementation plans, cost-benefit analysis work, feature analysis, and more. Rather than create a new bespoke document or process, we simply adjusted our PRD template so that it satisfied any ISO 42001 requirements. That way, teams could continue using that familiar document and process, with limited disruption to their existing workflows.

‍

Throughout our audit prep, we also focused on the intent of requirements to ensure our solutions were relevant to the root of the requirement instead of just something that checked a box. 

‍

4. Do a stress test prior to the official audit

Our team conducted an internal audit with a secondary audit firm as a stress test before the official audit with Schellman. This was particularly useful as ISO 42001 was still new at the time of our assessment—there was a lot to be learned from collaborating with our internal audit firm. 

‍

Our internal audit helped us find gaps and areas for improvement, like tightening up our roles and responsibilities within our org chart and providing more specificity about the methodology used within our AI Impact Assessment, which explains the use cases for the Vanta AI product and specifically evaluates its expected positive or negative impact to individuals, groups of individuals, and even society.

‍

These changes made a huge difference before our official audit.

‍

Raising the bar for AI security

As an early adopter, we learned a lot during our ISO 42001 audit experience. As others in the industry look to achieve ISO 42001 certification and raise the bar for AI security, we’re happy to provide additional insights and consultation.

‍

And for anyone who is curious to learn more—you can find our official ISO 42001 certification on our Trust Center. 

‍