In the AI Compliance Assistant you set up the effectiveness review of the AI management system in the chapter Evaluation & Improvement. Across five pages you define per AI objective how it is measured and evaluated, compose the internal audits from blocks and schedule them, plan the management reviews, and set up the CAPA process for corrective and preventive action or adopt the existing pool. At the end, the measurement plan, audit programme, review dates and the ticket process for findings are in Cenedril and feed the management review.
Open the chapter
Start Evaluation & Improvement
In the sidebar open Wizards, choose the Artificial Intelligence card and click the row Evaluation & Improvement in the chapter list of the overview. The entry page Performance evaluation explains in five cards what the chapter produces: Monitoring & measurement, Audit scope, Audit programme, Management review and Improvement. Next takes you to the first working page.
Set up monitoring and measurement per AI objective
Expand an objective card
The page Set up monitoring & measurement lists every AI objective from the Leadership chapter as a card under Monitoring per AI objective. The header shows the title, a badge with the measurement type (Binary or KPI) and the Objective owner. Click a card to open it. Objectives are still created on the AI Objectives page; here you plan how they are measured.
Define monitoring
Choose the Monitoring method (Internal Peer Review, Automated Monitoring, Self-Assessment, External Audit or Other), the Monitoring frequency, the Monitoring start date and the Monitoring responsible. The measurement type in the card header is the best guide for the method: a metric that is produced by a system anyway suits automated monitoring; binary objectives are checked through a self-assessment or a peer review.
Assign the analysis
The checkbox Monitoring and analysis by the same person is preset. Remove it and the field Analysis responsible appears, where you pick a second person. Below it you set the Analysis frequency and the First analysis date. The analysis date cannot lie before the monitoring start date; Cenedril moves it forward if needed. Separating the two pays off wherever the evaluation involves judgement, for example samples on fairness.
Fill in the measurement plan
In the Measurement plan section you record what the objective is measured against. The toggle between Performance and Effectiveness says whether the metric shows implementation or impact. The Information need names the question the objective should answer; Data source, Implementation evidence and Reporting format follow from it. For the Measurement type choose Binary (yes/no) for initiatives with a clear completion or KPI (measurable target) for a share or quantity over time. For KPI enter Target value, Unit and the Scale direction, and set the thresholds Green from (objective achieved) and Yellow from (narrowly missed). If the objective comes from a template, the measurement plan is prefilled; adjust target value and thresholds to your starting position.
Record a measurement and flag the management review
Below the measurement plan sits the Attainment section. With Record measurement you enter one value per period, together with the As at date and a Note, and confirm with Apply. The table shows the as-at date, the value and the rating calculated from the thresholds. Also tick Include in management review when the result of this objective can trigger a decision at leadership level; such objectives are listed first in the management review.
Set a reminder per objective
As soon as a monitoring frequency is chosen, a reminder panel appears below the card. Check Reminder date & time and Recipients and click Set reminder. The monitoring and analysing persons are preselected if a user account is linked to them; without that link, your own account is in the field. If monitoring and analysis frequencies differ, two panels appear. With continuous monitoring there is no panel.
Set the risk re-assessment cycle
In the Risk Re-Assessment Cycle section choose the Planned interval for risk re-evaluation (Quarterly, Semi-annually or Annually) and the Start date. These two entries are the page’s required fields. Under Trigger for unplanned re-evaluation tick the events that trigger a re-assessment before the next date, such as an AI incident or a change of model or provider; Other opens a free-text field. The reminder panel Risk re-assessment reminder follows the chosen interval.
Save the monitoring setup
Click Save & Continue. Cenedril checks interval and start date of the re-assessment, saves the page and opens Compose internal audits. Save as Draft also saves without the required fields. Half-filled objective cards do not trip the check; go through the cards once so that each carries a frequency, a start date and a responsible person.
Compose internal audits
Check the starting position
The grey strip above the working area shows what Cenedril derives from the organisation profile and the scope: sites in scope, entities in scope, combinations (site × entity) and the number of audits. If the number of combinations is zero, the organisation profile lacks the mapping of which entity sits at which site. An amber banner then leads via Open organization profile → to the organisation profile, where you add the mapping.
Create an audit and set its scope
Click Add first audit or Add another audit. Give the card a name via Name this audit …. First choose the entity via Entity (row for), then the site via Site (row at). The site list stays locked until an entity is chosen and only shows sites that belong to the chosen entities according to the profile.
Assign blocks
On the left is the Catalog with the audit blocks: the main clauses of ISO/IEC 42001 under ISO 42001 clauses and the Annex A controls, grouped by themes such as Governance & organisation, Life cycle, Data or Use of AI systems. Drag a block or a whole group row onto an audit card, or open the Assign to audit menu via the plus icon on the block; its last entry New audit with this topic creates an audit directly with this block. A block may appear in several audits as long as their site and entity combinations do not overlap. The percentage at the top of the catalog shows overall coverage.
Close gaps or mark them N/A
Below the audit list, the gap area counts the combinations not yet assigned to an audit. Expand it; the open combinations are grouped by entity and site. If a combination does not apply, mark it with Mark N/A, or set a whole site at once with Mark all n as N/A; Undo N/A removes the mark. If the open combinations should be audited, Audit for all remaining (n) creates an audit named Rest audit across all remaining combinations. Once every combination is assigned or marked N/A, the header reads all covered · n N/A.
Save the scope
Save & Continue only becomes active once every audit carries an entity, a site and at least one block and no combination is still open; otherwise an amber note above the footer names the reason. You can save an interim state at any time with Save as Draft. After saving, the Internal Audit page opens.
Plan the audit programme
Review the summary and set cycle parameters
At the top the page summarises the audits from the scope (This scope produces n audits:). Under Cycle Parameters choose between Fixed audit cycle with a Cycle length and Fixed audit capacity with Audits per year; the resulting calculation is shown under each field. Set the Plan horizon, the Start date and the Ordering: Sequential, Randomized or Risk-based, where the risk-based ordering brings forward controls with open findings or a high-risk connection. With Allowed weekdays and Date jitter you control which days the appointments fall on. The Audit methods apply to all audits of the programme; document review and interview are preset. The row Audit programme owner is derived from the “AIMS Operation” role on Roles & Responsibilities.
Generate the plan
Click Generate Plan. Cenedril spreads the appointments across the plan horizon and shows them under Generated Audit Plan in a table with date, scope, controls, Lead Auditor and alert. Move individual appointments in the date field of the row, Shuffle dates resets all future dates, and Add appointment manually adds an extra appointment for an existing audit.
Assign the Lead Auditor
The Lead Auditor column is empty after generating. In each row pick a person from the asset register; a newly typed name creates the person immediately, which is how you add external auditors as well. If the chosen person holds a responsibility on Roles & Responsibilities that touches the clauses or controls of this appointment, the warning Audits their own area: … appears under the row. It blocks nothing; the decision stays with you.
Set reminders
Via the bell icon of a row, choose recipients for that single appointment and click Set reminder. For all appointments at once use the Reminders section: set Remind days before each audit (fourteen days are preset), choose the Recipients (Compliance Team) and click Set reminders for all events. Only persons with a user account are available as recipients. After later date changes, delete the reminders with Delete all reminders and set them again, because a reminder is calculated on the appointment date at the time it is set.
Save the programme
Click Save & Continue. Cenedril checks planning mode, plan horizon and start date, creates a planned audit session for each appointment in the audit area and returns to the AI overview. You reach the audit execution via the link Go to Internal Audits below the table. To continue with the chapter, open the step Management review from the chapter bar.
Plan the management review
Set the configuration
The page is titled AI Management Review. Under Configuration choose the Interval (Annually, Semi-annually or Quarterly), the First start date and the Planning horizon. Under Standing attendees tick the user accounts that regularly attend the management review; the person from the “Reporting to leadership” role is preselected if they have a user account. In the reminder panel below, one click creates a recurring reminder in the chosen interval; the attendees are preset as recipients.
Check the planned reviews
Under Planned reviews Cenedril calculates the dates from interval, start date and horizon. Each row names the review with its date, its Window and the number of reports that fall into this window: the evaluations of the AI objectives, the risk re-assessment and the audit appointments. Expand a row to see the inputs with date and responsible person. A yellow note counts data sources without a start date; add those dates on Set up monitoring & measurement. Check that at least one review per year follows a completed internal audit.
Save the planning
Click Save & Continue. Cenedril adopts the planning, creates the planned sessions and returns to the AI overview; a draft via Save as Draft creates no sessions yet. You reach the execution via the link To AI management reviews. Open the last step of the chapter from the chapter bar under Improvement.
Set up improvement and the CAPA process
Recognise an existing pool
The page Improvement (PDCA & CAPA) shows the PDCA Cycle at the top and the CAPA Workflow Generator below it. If the ticket pool for corrective and preventive action already exists, because it was configured in the ISMS or created in the workflow administration, a blue note Existing CAPA ticket pool adopted appears with its origin. The phases then show the configuration your organisation already uses.
Check phases, roles and fields
The process runs from Reported through Investigation, Root Cause Analysis, Corrective Action, Implementation and Verification to Closed. Expand a phase to fill the responsible role, such as Implementer or Verifier, and to choose the Form fields for this phase. Fields with a locked checkbox such as Root cause description, Planned corrective action, Due date and Effectiveness review are fixed, because the chain of evidence breaks without them. Under Who can create tickets? decide whether all user accounts or only selected roles may create tickets.
Generate or adopt the workflow
If no pool exists yet, click Generate CAPA Workflow. Cenedril creates the workflow in the tasks area, creates a workflow role for each filled role and approves the version. If the pool was adopted, the page shows CAPA workflow has been generated. with the link Edit in Workflow Editor and the Regenerate button. Leave it at the adoption if you only want to add people, and use Regenerate only after agreeing with the person who looks after the ISMS.
Complete the chapter
Click Save & finish. Cenedril publishes the field and role selection and returns to the AI overview. Save as Draft saves the interim state; Back returns to the management review without saving.
Result: every AI objective carries monitoring, analysis and a measurement plan, the risk re-assessment cycle is set, the internal audits are composed and created as appointments with a Lead Auditor in the audit area, the management reviews are planned with attendees and windows, and findings from incidents, audits, observations and the management review become tickets in the CAPA process. On the AI overview the row Evaluation & Improvement shows the number of planned audits (Planned audits) and the programme’s planning mode (Programme), and the chapter icon reports all steps as published.