AramGRC
Back to case studies
AI AssessBFSIIndia

Bringing a credit-scoring model under ISO/IEC 42001 governance

An NBFC using machine-learning credit scoring had no documented AI management system. We built the inventory, classified risk and produced a certification-ready roadmap.

Client
A mid-size non-banking financial company
Service
AI Assess
Frameworks
ISO/IEC 42001 · ISO/IEC 42005

The challenge

  • Multiple scoring and collections models in production with no central inventory
  • Model risk handled informally by the data science team, with no board-level oversight
  • Auditors and lending partners asking for evidence the models were governed, not just accurate

What we did

  1. 01

    Inventory & classification

    Catalogued every model, dataset and third-party AI service, then risk-tiered each use case.

  2. 02

    Gap assessment

    Assessed the current state against ISO/IEC 42001 clauses and Annex A controls.

  3. 03

    Impact assessment

    Ran an ISO/IEC 42005-aligned impact assessment on the highest-risk lending use case.

  4. 04

    Roadmap

    Sequenced remediation by risk and effort so the highest exposure closed first.

Outcomes

  • A single, maintained AI inventory with risk tiers agreed by risk and technology leadership
  • Documented AI policy, roles and human-oversight points for lending decisions
  • A prioritised path to ISO/IEC 42001 certification readiness
  • Reusable evidence pack for partner and auditor due diligence

Facing something similar?

A short conversation is usually enough to scope the right assurance work.

Book a free consulting

More case studies

Red-teaming a clinical documentation assistant before launch

Healthcare · AI QA

Preparing an AI product company for EU AI Act scrutiny

AI product / SaaS · AI Audit

WhatsApp