The certification project

Lesson 5 of 5 in Lead Implementer Track: Building an AIMS from Mandate to Certificate.

Certification is a project you run, with the CB as counterparty — not an exam you sit. Choosing the CB starts from the trust-chain checks the certification module armed you with: accreditation for 42001 under ISO/IEC 42006 verified on the accreditation body’s public register (registers, not logos), audit-team AI competence you can question, audit-day quotes that trace to the 42006 drivers, and a scope statement you have read verbatim. The implementer adds the project layer: engage the CB months early — good CBs book out, and Stage 1/Stage 2 dates must land where your evidence arithmetic says they can; get the certificate scope wording agreed in the contract, because it is what your customers will read; and pin down the technical-expert arrangements if your AI is exotic.

Stage 1 realities. Stage 1 will read your scope, policy, risk methodology, and SoA, and check the clause 9 machinery has actually run. Treat its output as free consulting delivered under audit rules: every ‘area of concern’ is a Stage 2 finding with the serial number filed off. The weeks between stages exist to be used — triage every concern into fix-now, evidence-gap, or explain-better, and work the list.

Handling Stage 2 findings is where implementers earn reputations. In the room: clarify the evidence, ask questions, and get the finding’s wording precise — but do not argue classification with the auditor mid-audit; disputes have an appeals channel, and reflexive rebuttal reads as a culture finding. Afterwards: root-cause every nonconformity properly (the lesson 4 discipline), submit correction plus corrective action plus a scheduled effectiveness check, and respect the clock — majors typically demand verified closure within roughly 90 days, minors an accepted plan. A crisp corrective-action response to a major has salvaged many certifications; a defensive one has sunk several.

The three-year cycle becomes business-as-usual or it becomes a crisis. Put the surveillance themes on the annual operating calendar now: internal audit and management review keep their rhythm because the system needs them, not because an auditor is due; the change log stays current; the CB is notified of significant changes (scope, ownership, major incidents) per the contract. Budget year 3’s full recertification before finance forgets why. The organisations that scramble before each surveillance audit are re-implementing annually and calling it maintenance.

And the implementer’s endgame is the one nobody puts on the project plan: make yourself unnecessary. Named process owners who can defend their own artifacts, a trained deputy, decision records that explain why — the system must survive your promotion, your resignation, your bus. That is also the honest test of everything this track taught: an AIMS that still works without its implementer was implemented; one that does not was performed.

Interactive sorting exercise: Diagnose the implementation: match each observed symptom to the failure pattern producing it.

Key terms: certification body, stage 1 audit, stage 2 audit, surveillance audit

Interactive checkpoint quiz (1 questions) — open this page in a browser to take it.