ISO 30401
Evidence request list. 42 controls, 42 carrying auditor artefact guidance. Generated from the compliance knowledge graph on 11 September 2026. Published by The Art of Service.
Audit
Conduct internal audits of the KMS at planned intervals.
- Audit programme
- Reports
- CAPA
- Auditors not independent
Awareness
Ensure persons under control are aware of the KM policy and their contribution.
- Awareness campaigns
- Intranet content
- Quiz results
- Awareness limited to launch
CAPA
React to nonconformities, evaluate causes, and take corrective action.
- NCR register
- RCA reports
- Effectiveness checks
- Recurring NCRs
Communication
Determine internal and external communications relevant to the KMS.
- Comms plan
- Channels list
- Feedback log
- One way communication only
Competence
Ensure persons doing KM work are competent through education, training, or experience.
- Competence matrix
- Training records
- Certifications
- No KM competencies defined
Context
Determine internal and external issues relevant to the knowledge management system.
- PESTLE analysis
- SWOT
- Stakeholder map
- Context not refreshed
- No link to strategy
Culture
Cultivate a culture that values learning, sharing, collaboration, and innovation.
- Values statement
- Recognition program
- Engagement scores
- No recognition for sharing
Documentation
Create, control, and retain documented information for the KMS.
- Document control SOP
- Version log
- Retention schedule
- Versioning not enforced
Enablers
Address human capital, processes, technology, governance, and KM culture as enablers.
- Enabler matrix
- Culture survey
- Tech inventory
- Technology heavy, culture light
Governance
Top management reviews the KMS for suitability, adequacy, and effectiveness.
- Review minutes
- Input pack
- Action log
- Review tokenistic
ISO 30401: Improvement
Continual improvement methodology. Control from ISO 30401 framework, domain: ISO 30401: Improvement.
- Continual improvement plan
- Corrective action register
- Innovation pipeline
- Change management plan
- Improvement not data-driven
- Corrective actions reactive
- Innovation pipeline empty
Corrective and preventive actions. Control from ISO 30401 framework, domain: ISO 30401: Improvement.
- Continual improvement plan
- Corrective action register
- Innovation pipeline
- Change management plan
- Improvement not data-driven
- Corrective actions reactive
- Innovation pipeline empty
Innovation and change management. Control from ISO 30401 framework, domain: ISO 30401: Improvement.
- Continual improvement plan
- Corrective action register
- Innovation pipeline
- Change management plan
- Improvement not data-driven
- Corrective actions reactive
- Innovation pipeline empty
ISO 30401: Leadership & Planning
Quality policy and objectives. Control from ISO 30401 framework, domain: ISO 30401: Leadership & Planning.
- KM policy
- KM objectives matrix
- Resource allocation plan
- Risk-based KM plan
- KM objectives not measurable
- Leadership commitment not visible
- Roles not staffed
Leadership commitment to quality. Control from ISO 30401 framework, domain: ISO 30401: Leadership & Planning.
- KM policy
- KM objectives matrix
- Resource allocation plan
- Risk-based KM plan
- KM objectives not measurable
- Leadership commitment not visible
- Roles not staffed
Risk-based thinking and planning. Control from ISO 30401 framework, domain: ISO 30401: Leadership & Planning.
- KM policy
- KM objectives matrix
- Resource allocation plan
- Risk-based KM plan
- KM objectives not measurable
- Leadership commitment not visible
- Roles not staffed
Resource management for quality. Control from ISO 30401 framework, domain: ISO 30401: Leadership & Planning.
- KM policy
- KM objectives matrix
- Resource allocation plan
- Risk-based KM plan
- KM objectives not measurable
- Leadership commitment not visible
- Roles not staffed
Organizational roles and responsibilities. Control from ISO 30401 framework, domain: ISO 30401: Leadership & Planning.
- KM policy
- KM objectives matrix
- Resource allocation plan
- Risk-based KM plan
- KM objectives not measurable
- Leadership commitment not visible
- Roles not staffed
ISO 30401: Operational Controls
Operational planning and control. Control from ISO 30401 framework, domain: ISO 30401: Operational Controls.
- Operational KM plan
- Knowledge content lifecycle
- External provider register
- Service delivery log
- Lifecycle stages not enforced
- Provider oversight light
- Service delivery metrics missing
Requirements for products and services. Control from ISO 30401 framework, domain: ISO 30401: Operational Controls.
- Operational KM plan
- Knowledge content lifecycle
- External provider register
- Service delivery log
- Lifecycle stages not enforced
- Provider oversight light
- Service delivery metrics missing
Design and development controls. Control from ISO 30401 framework, domain: ISO 30401: Operational Controls.
- Operational KM plan
- Knowledge content lifecycle
- External provider register
- Service delivery log
- Lifecycle stages not enforced
- Provider oversight light
- Service delivery metrics missing
Control of externally provided processes. Control from ISO 30401 framework, domain: ISO 30401: Operational Controls.
- Operational KM plan
- Knowledge content lifecycle
- External provider register
- Service delivery log
- Lifecycle stages not enforced
- Provider oversight light
- Service delivery metrics missing
Production and service provision controls. Control from ISO 30401 framework, domain: ISO 30401: Operational Controls.
- Operational KM plan
- Knowledge content lifecycle
- External provider register
- Service delivery log
- Lifecycle stages not enforced
- Provider oversight light
- Service delivery metrics missing
ISO 30401: Performance Evaluation
Monitoring, measurement, and analysis. Control from ISO 30401 framework, domain: ISO 30401: Performance Evaluation.
- KM metrics dashboard
- Internal audit plan
- Management review minutes
- Nonconformity log
- Metrics not tied to outcomes
- Audits skip KM scope
- Nonconformities not closed
Internal audit program. Control from ISO 30401 framework, domain: ISO 30401: Performance Evaluation.
- KM metrics dashboard
- Internal audit plan
- Management review minutes
- Nonconformity log
- Metrics not tied to outcomes
- Audits skip KM scope
- Nonconformities not closed
Management review process. Control from ISO 30401 framework, domain: ISO 30401: Performance Evaluation.
- KM metrics dashboard
- Internal audit plan
- Management review minutes
- Nonconformity log
- Metrics not tied to outcomes
- Audits skip KM scope
- Nonconformities not closed
Customer satisfaction measurement. Control from ISO 30401 framework, domain: ISO 30401: Performance Evaluation.
- KM metrics dashboard
- Internal audit plan
- Management review minutes
- Nonconformity log
- Metrics not tied to outcomes
- Audits skip KM scope
- Nonconformities not closed
Nonconformity and corrective action. Control from ISO 30401 framework, domain: ISO 30401: Performance Evaluation.
- KM metrics dashboard
- Internal audit plan
- Management review minutes
- Nonconformity log
- Metrics not tied to outcomes
- Audits skip KM scope
- Nonconformities not closed
Improvement
Continually improve suitability, adequacy, and effectiveness of the KMS.
- Improvement backlog
- Lessons learned register
- Trend analysis
- Lessons not actioned
Knowledge lifecycle
Address acquiring, applying, retaining, handling outdated, and developing new knowledge.
- Knowledge lifecycle SOP
- Capture templates
- Retirement log
- No retirement step
- Hoarding
Leadership
Top management demonstrates leadership and commitment to the KMS.
- Leadership communications
- KM sponsor charter
- Board minutes
- Sponsor in name only
Monitoring
Monitor and evaluate KM performance and effectiveness.
- KPI dashboard
- Evaluation reports
- Outcome metrics absent
Objectives
Establish measurable KM objectives at relevant functions and levels.
- Objectives register
- KPI scorecard
- Review minutes
- Vanity metrics only
Operations
Plan, implement, and control processes needed to meet KM requirements.
- KM process docs
- Operational plans
- Change records
- Ad hoc execution
Planning
Identify and address risks and opportunities for the KMS.
- Risk register
- Opportunity log
- Treatment plan
- No KM specific risks
Policy
Establish and communicate a knowledge management policy.
- KM policy
- Communication evidence
- Review record
- Policy not communicated
Resources
Determine and provide resources for the KMS.
- Budget
- Headcount plan
- Tool licences
- Underfunded KM program
Roles
Assign and communicate KM roles, responsibilities, and authorities.
- RACI
- Role descriptions
- Org chart
- No KM lead
Scope
Define the boundaries and applicability of the knowledge management system.
- Scope statement
- Exclusions register
- Subsidiaries excluded without rationale
Stakeholders
Identify stakeholders and their knowledge needs and expectations.
- Stakeholder register
- Needs analysis
- Survey results
- Field staff omitted
System
Establish, implement, maintain, and improve the knowledge management system.
- KMS framework
- Process map
- Governance charter
- No process owner
Transfer
Enable interactions, representations, and integrations that transform knowledge.
- Communities of practice charter
- Mentoring program
- Repository taxonomy
- Tacit knowledge not captured
Assembled from the framework’s own control set, so this list is regenerated rather than written and stays current as the graph does. See the ISO 30401 framework page.