What evidence does a statistical robustness assessment need?

At minimum: the system and its boundary, the robustness property claimed, the sampling frame and perturbation set, the draws and seeds, the metric and threshold, the uncertainty, the result with its limits, and the reviewer. The standard states no sample size or threshold, so the plan has to justify them.

What goes in the plan?

The frame, the strata, the perturbation catalogue with generator versions, the number of draws, the random seeds and the decision rule. It is signed before the first run, because a plan written after the result is a rationalisation.

What does an auditor test?

They pick a claim and follow it to a run, then follow the run to a record. If any step needs a question to the team, the pack is not finished.

What should be mapped to ISO/IEC 42001?

The impact assessment at A.5.2, verification and validation at A.6.2.4, and data quality at A.7.4 are the rows the pack most often supports. The risk treatment and monitoring rows come from ISO/IEC 23894 at 6.5.2 and 6.6.