Monitoring and measurement

The requirement, in our words

Decide what to monitor and measure, the methods that give valid results, when monitoring and measurement happen, and when results are analysed and evaluated. Keep evidence of the results and evaluate the performance and effectiveness of the management system.

What it means for human oversight

Measure the oversight itself: how often the overseer overrode the system, how long an alert waited, how many reviews were completed, how often the output was accepted without change. A metric nobody analyses is a dashboard, not a control.

How to evidence it

Attach the artefacts above to the Monitoring and measurement row with the system name, the owner and the date. The first one is the anchor: A monitoring and measurement plan. The OH-13 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Measurement results and the analysis. If that artefact for OH-13 cannot be produced, the row is a gap, whatever the policy says.

OH-13 carries 3 evidence items and 2 common gaps. For monitoring and measurement, the evidence is a dated record that the control operated, not a statement that it exists in a policy. The OH-13 statement above is ours, written from ISO/IEC 42001:2023, 9.1, not a reproduction of the licensed text.

Common gaps

• Metrics collected but never analysed
• No method validity considered

Related units

• Internal audit
• Continual improvement
• Context and the role you play