Worked Assessment Report Example

Scope of Audit

This Stage 2 certification audit evaluates Verdant Health Technologies' AI Management System (AIMS) against ISO/IEC 42001:2023 requirements (Clauses 4-10) and applicable Annex A controls. ClinAssist v2.0 is a clinical pathway recommendation engine deployed across 8 hospital networks in Germany and Switzerland, providing treatment pathway suggestions to clinical staff.

Evidence Sources

1. Cryptographic witness evidence (SWT3): 25 SWT3 witness anchors covering 16 procedures, assessed via the audit portal over the 122-day evidence review period. Each anchor was independently verified.
2. Document review: AI management system manual, AI policy, Statement of Applicability (SoA), risk assessment methodology, data management procedures, supplier evaluation records, and management review minutes.
3. Interviews: 5 sessions with the AIMS Manager, Chief Medical Officer, Data Protection Officer, AI Development Lead, and Head of Clinical Operations. Interview notes on file (ref: IACS-INT-4192-01 through 05).
4. On-site observation: Clinical deployment environment, model monitoring dashboards, and incident response procedures observed during 3-day on-site audit (2026-09-24 through 2026-09-26).

Audit Outcome

CONDITIONAL CERTIFICATION RECOMMENDED. 6 of 7 clause groups are conforming. One minor nonconformity identified in Clause 9 (management review overdue). Two observations recorded. Annex A: 28 of 31 applicable controls conforming.

Audit Framework

This audit was conducted per IACS documented procedure IACS-AP-012 "Stage 2 Certification Audit with Cryptographic Evidence" (Rev 1.0), within the scope of CB-4192's ISO/IEC 17021-1 accreditation. Audit planning followed ISO 19011:2018 guidelines.

SWT3 Evidence Verification Method

1. Portal verification: All 25 anchors checked via sovereign.tenova.io/verify. All returned VALID.
2. Independent recomputation (5 anchors): One anchor per clause group plus one Annex A control, recomputed using OpenSSL 3.x. All matched.

Temporal Scope

The evidence review period (122 days) covers operational evidence from 2026-06-01 through 2026-09-30. The on-site audit (3 days, 2026-09-24 through 2026-09-26) focused on interviews, observation of operational controls, and verification of document review findings. Of 16 procedures assessed via SWT3, 14 had continuous anchor coverage. Two procedures (AI-DPIA.1 and Clause 9.3 management review) showed gaps documented in the findings below.

Evidence Sufficiency

SWT3 anchors were accepted as objective evidence for operational controls (Clause 8) and performance evaluation (Clause 9.1). Leadership commitment (Clause 5), context analysis (Clause 4), and planning (Clause 6) were assessed through document review and interviews per ISO 19011 methodology.

Of the 39 Annex A controls in ISO/IEC 42001:2023, 31 were determined applicable per the organization's Statement of Applicability (SoA). 8 controls were excluded with documented justification (controls related to autonomous decision-making, which ClinAssist does not perform -- all outputs are recommendations requiring clinical confirmation).

Audit Outcome: CONDITIONAL CERTIFICATION RECOMMENDED

Verdant Health Technologies' AIMS demonstrates substantial conformity with ISO/IEC 42001:2023. One minor nonconformity (NC-001, management review overdue) was identified. Two observations were recorded for continual improvement.

The certification body recommends:

1. Issue certification conditional on resolution of NC-001 within 45 days
2. Submission of management review evidence for verification (no re-audit required for minor nonconformity)
3. First surveillance audit scheduled for October 2027, with priority review of OBS-001 (competence framework) and OBS-002 (DPIA refresh cycle)

SWT3 cryptographic witness evidence provided continuous operational assurance over the 122-day audit period, complementing traditional audit methods (document review, interviews, on-site observation) with tamper-evident, independently verifiable records of control effectiveness.

SWT3 witness anchors cited in this report follow the format:

Any anchor can be independently verified at sovereign.tenova.io/verify with no account or authentication. The SHA-256 fingerprint formula is published in the SWT3 Protocol Specification.