At a glance
- Ref
- OH-14
- Theme
- Assurance
- Held source
- ISO/IEC 42001:2023
- Citation
- ISO/IEC 42001:2023, 9.2
- Evidence
- 3 items
- Gaps
- 2 common
Evidence to keep
- Internal auditAn internal audit procedure and programme
- Internal auditAudit reports covering the oversight controls
- Internal auditCorrective actions raised and closed
Questions before you sign
- Does the programme cover the oversight controls this year?
- Will the auditor observe a live override?
- Are audit findings tracked to closure?
The requirement, in our words
Audit at planned intervals against the organization's own requirements and the standard, through an audit programme that covers the scope, the criteria, the auditors and the reporting.
What it means for human oversight
The audit should sample live oversight decisions, not only the policy. It should test whether the named person can exercise the authority the policy grants.
How to evidence it
Attach the artefacts above to the Internal audit row with the system name, the owner and the date. The first one is the anchor: An internal audit procedure and programme. The OH-14 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.
The reviewer will sample one live decision and ask for Audit reports covering the oversight controls. If that artefact for OH-14 cannot be produced, the row is a gap, whatever the policy says.
OH-14 carries 3 evidence items and 2 common gaps. For internal audit, the evidence is a dated record that the control operated, not a statement that it exists in a policy. The OH-14 statement above is ours, written from ISO/IEC 42001:2023, 9.2, not a reproduction of the licensed text.
Common gaps
- Audit programme missing
- Audit checks documents but never observes a live decision
Related units
Source for this page: ISO/IEC 42001:2023, 9.2. Open ISO/IEC 42001:2023, 9.2 and compare it with the OH-14 statement above. Retrieved 2026-10-21.