Auditors Guidance Document STAR for AI Certification

The purpose of this document is to provide assessment guidance to certification bodies and associated organizations performing audits aligned with ISO/IEC 27001 and/or ISO/IEC 42001 that support STAR for AI certification. STAR for AI certification is considered an extension to the scope of an ISO/IEC 27001-compliant Information Security Management System (ISMS) and an ISO/IEC 42001-compliant Artificial Intelligence Management System (AIMS), enabling organizations to extend their governance frameworks to address artificial intelligence risks and controls. 

This document also introduces a management capability maturity model used to evaluate how effectively organizations implement and manage controls defined in the AI Controls Matrix (AICM). The model provides auditors with guidance on scoring control areas, identifying improvement opportunities, and supporting organizations in strengthening their AI governance, risk management, and operational assurance practices.