AAISM · ISO/IEC 42001 Clause 6.2
Policy vs Objective vs KPI vs Target
How an AI management system turns a commitment into a measured number
Policy
- Management direction and commitment
- Broad, stable, approved at the top
- Answers: what do we stand for
Example: we will maintain appropriate reliability in every AI system we release
Objective
- Specific result to be achieved
- Derived from the policy
- Owned, resourced, time bound
- Answers: what must be true
Example: every material AI tutor release meets its defined validation requirements
KPI
- How performance is measured
- A ratio, count or rate you can compute
- Same definition every period
- Answers: how do we know
Example: percentage of material releases passing validation before deployment
Target
- Expected level of the KPI
- A number with a deadline
- Reviewed when missed, not moved quietly
- Answers: how good is good enough
Example: 100% for every release in the year
Memory flow
- Policy
- Objective
- KPI
- Target
- Policy
- Gives direction
- Objective
- Defines the result
- KPI
- Measures performance
- Target
- Sets the expected level
What Clause 6.2 asks for
- Objectives consistent with the AI policy
- Measurable where practicable
- Consider applicable requirements and risk results
- Monitored, communicated, updated as needed
- Documented information retained
Planning to achieve an objective
- What
- Will be done
- Resources
- What is required
- Who
- Is responsible
- When
- It will be completed
- How
- Results will be evaluated
Good KPI, bad KPI
Good
- Computed from records you already keep
- Leading where possible, not only lagging
- One owner, one definition
- Moves when the objective is at risk
Bad
- Counts activity, not outcome
- Redefined each quarter to look green
- Measured only after an incident
- Nobody acts when it drops
More worked chains
- Bias
- Policy fairness, objective tested models, KPI share with bias review, target 100%
- Transparency
- Policy explainability, objective documented models, KPI model cards published, target 100%
- Incidents
- Policy safe operation, objective fast response, KPI hours to contain, target under 24
Quick exam traps
- Trap: A policy statement with a number in it is a KPI
- Trap: A KPI without a target tells you whether you succeeded
- Trap: Objectives can be set without reference to the policy
- Trap: Moving the target when it is missed is a corrective action
- Trap: Measuring activity, such as training hours, proves the objective was achieved
cybercertprep.com · original revision sheet written from the public body of knowledge