ISO/IEC 42001 Stage 2 Audit Lab
A certification auditor is on site for three days to test whether your AI management system actually works. Each day she samples evidence: the AI policy, risk and impact assessments, the Statement of Applicability, operational and supplier controls, internal audit and management review. You choose what to show, answer her questions and decide which findings to accept, contest or fix. The closing meeting tells you whether you would be recommended, and why.
This is a simulation for practice. The company and the certification body are fictional, and the outcome is not certification advice from any certification body.
The real job. More noise, a tighter clock.
Simulation briefing
You are the AIMS lead at Kestrel Mobility (fictional). Mira Okafor, lead auditor from Aldermoor Assurance (fictional certification body) is here for the Stage 2 certification audit. Over three days she will sample 8 areas, with RouteSense, the demand-forecasting and driver-dispatch model as the AI system in focus. For each sample: pick up to 3 documents to show, answer her follow-up question, then decide how to handle the finding she proposes.
- Rookie: 6 samples, document status shown, feedback after every sample.
- Pro: all 8 samples, document status shown, feedback after every sample.
- Elite: 8 samples, 2 documents per request, more decoys, no status labels, feedback only at the end.
A training simulation with a fictional organisation and certification body. It is not certification advice and does not reflect any real certification body's scheme or grading.
TL;DRWhat this lab is
5 points
- A free scenario game: you are the AIMS lead at a fictional company facing a certification auditor over three Stage 2 audit days.
- The auditor samples eight areas: AI policy, risk assessment, impact assessment, Statement of Applicability, operational controls for an AI system, supplier controls, internal audit and management review.
- For each sample you choose which documents to show, answer a follow-up question, and handle a proposed finding: accept it, push back with evidence, or raise a correction or a corrective action.
- The closing meeting gives a simulated recommendation (recommended, recommended subject to corrective action for minors, or not recommended) with the reasons, every finding and a score for each decision.
- Seeded runs you can replay, rookie / pro / elite difficulty. A simulation, not certification advice.
Three habits that decide a Stage 2 audit
Show the current, approved record. Auditors sample records, not intentions. A superseded risk register or an unapproved policy draft handed over as if it were current damages trust in everything that follows, and on a core requirement it can turn a missing record into a major. Bring the document that answers the question, and only that.
Answer with facts you can prove. Follow-up questions test whether the system is used: a decision the policy changed, a drift alert and what happened next, a supplier notice of a model change. "We would notice" and "it is basically done" invite the auditor to sample further, and in this lab they lower the auditor's confidence.
Handle findings on the evidence. Push back only with the record that disproves the finding. Accept valid findings and offer a correction plus a root cause and corrective action, which is what clause 10.2 asks for. Treat observations as free advice. Then log every finding in the nonconformity tracker.
For a shorter, single-system rehearsal with your own organisation's details, see the mock certification audit; to get the evidence ready in the first place, use the evidence binder.
Frequently asked questions
What happens in an ISO/IEC 42001 Stage 2 audit?
Stage 1 reviews whether your AI management system is designed and documented well enough to proceed. Stage 2 tests whether it is implemented and working: the auditor interviews people, samples records across the clauses (context, leadership, planning, support, operation, performance evaluation and improvement) and the Annex A controls you declared applicable, and raises findings where evidence does not show a requirement is met. It ends with a closing meeting and a recommendation to the certification body.
What do major and minor nonconformities mean for the recommendation?
Each certification body sets its own rules, so treat this as common practice rather than a rule. A major nonconformity usually has to be resolved, and often verified, before certification is recommended. Minors are typically handled through a corrective action plan that the certification body accepts. Observations are not nonconformities. Several minors against the same requirement can be graded together as a major. The lab models these patterns so you can practise the decisions, not to predict a real outcome.
When should I push back on an audit finding?
When you hold a current, approved record that shows the requirement is met and the auditor has not seen it. Push back with that record, calmly. Arguing a valid finding without evidence costs credibility and the finding stands; accepting a finding you could have disproved adds a nonconformity you did not need. The lab scores both mistakes.
Why does the lab separate a correction from a corrective action?
Because ISO/IEC 42001 clause 10.2 does. A correction fixes the instance; a corrective action removes the cause so it does not recur. Offering only a correction for a minor nonconformity leaves the auditor expecting it to come back. The nonconformity tracker on this site keeps the two apart for the same reason.
Is this real certification advice?
No. It is a training simulation. The organisation, its AI systems, the auditor and the certification body are fictional, the scenarios are written in our own words, and the scoring and recommendation logic are a teaching model. Nothing here comes from, or is endorsed by, any certification body, and only an accredited certification body can recommend or grant certification.
Is the lab free?
Yes. The lab is free to play. Your best grade per difficulty is saved in your browser.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.