Direct answer: an auditor follows one line: what risks and impacts this AI system has → which controls were chosen, why, and which do not apply → who is responsible and where the evidence is → who accepts the remaining risk, and on what conditions. Copying all Annex A controls without reasons, or looking only at company revenue and reputation without assessing impact on individuals and groups, breaks the line. A pricing or eligibility system may cost the company little yet disadvantage a particular group of customers over time, which is exactly what a company-loss-only risk matrix misses.
One traceable line
| Step | What to keep |
|---|---|
| Risks and impacts | AI risk assessment (for the organisation) plus AI system impact assessment (for individuals, groups, society), each with method and date |
| Control choices | Reasons each control applies or not; how contracts or tests cover what you cannot control in a purchased model |
| Owners and evidence | Owner, frequency and evidence location for each control |
| Residual risk acceptance | Written acceptance by the responsible manager, with conditions, duration and triggers for stopping use and re-assessment |
What a consultant should deliver
- The missing impact dimension: affected groups, possible harms, long-term cumulative effects
- An applicability statement giving reasons for each control applied or excluded
- A risk treatment plan: measures, owners, deadlines and how they are verified
- Record formats for risk acceptance and decisions to stop use, with re-assessment triggers
How to accept the work
For any risk, you can go from the assessment to the control, owner, evidence and acceptance record in ten minutes; for any excluded control, you can give the reason; the impact assessment has fields for individuals and groups, not only company loss.
What cannot be guaranteed
The line lets an auditor find the basis, but whether a risk is acceptable remains a management decision; a consultant cannot sign off for, or make the acceptance decision on behalf of, management.
Winners Consulting's approach
The following describes Winners Consulting's own approach. Please test us with the same questions above, and test other consultants too.
- Who leads: VP- and director-level consultants guide the whole engagement, without outsourcing
- Project rhythm (as listed on our service page): scope and inventory 2–4 weeks, risk and impact assessment 3–5 weeks, system build 6–10 weeks, audit and certification 4–8 weeks; organisations that already hold ISO 27001 usually reach certification in 4–6 months, from scratch about 6–9 months
- Division of roles: we build the system and the evidence chain; legal opinions come from partner lawyers; certification is carried out by a certification body accredited under ISO/IEC 42006, which we accompany but do not stand in for
- Completed work (anonymous, under a non-disclosure agreement): an industrial automation manufacturer built an AI system inventory, completed AI risk classification, established algorithm review and human oversight for high-risk uses, and obtained ISO 42001 certification
Related questions
- Must every ISO 42001 Annex A control be implemented? Not wholesale: decide applicability control by control and give reasons; excluded controls need a basis and applied controls need an owner and evidence. ISO 42001 implementation
- Can the consultant decide on risk acceptance? No. Residual risk must be accepted in writing by the responsible manager; the consultant makes sure the decision has a basis and a record. How to choose an ISO 42001 consultant in Taiwan
Request a free mechanism diagnosis
Compliance needs all three; a consultant's value is integration
CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.
| Dimension | The question it answers | Typical gap when only this part is done |
|---|---|---|
| Process (management system) | Who is responsible, what is done, when, where the evidence is, how it improves | Tools are in place but nobody runs them on schedule, so there are no records at audit time |
| Security technology | How controls are designed and how their effectiveness is verified | Documents are complete but the systems do not actually do what they describe |
| Legal compliance | Which regulation applies, which role you hold, the deadlines and penalties | Controls are built against the wrong regulation or role, so obligations are not covered |
Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.