Guidance for Risk and Impact Assessment
Annex C is informative. It offers tasks for the assessment and points to additional resources.
This annex is informative. It explains and illustrates; it does not create a requirement. A finding cannot rest on it alone. The normative clauses are 4 to 9.
What annex C asks
Annex C is an informative annex on the risk and impact assessment. It sets out tasks for the assessment and points to additional resources. It supports clause 8, which requires the assessment and its two inventories, but it does not add a requirement. The tasks are a way to organise the work, not a substitute for the clause.
Why it matters
The annex is most useful when the team has the two inventories but is unsure how to populate them. Its task structure can prompt the questions that a blank table does not. The additional resources can help with method, but they are not normative and they may not fit the context of use. The team still has to decide what a risk is for this system and who accepts it.
What good looks like
Use the annex tasks to structure the first assessment, then map each task to the clause 8 action it serves. Record the additional resources the team used and why. Where the annex suggests a method that does not fit the context, record the alternative and the reason. Keep the annex out of the signature block, which belongs to the clause 8 assessment.
Evidence an assessor asks for
The assessor will ask whether the assessment followed the clause or the annex. The clause is the requirement; the annex is the aid.
- Task map Each annex task mapped to the clause 8 action it supports
- Resource record The additional resources used, with the reason
- Alternative methods Any method chosen instead of the annex suggestion, with the reason
- Assessment structure The structure used for the signed assessment
Where it commonly fails
- The annex tasks are presented as the requirement
- An external resource is treated as normative
- The assessment structure is copied without a context decision
What to do before publication
Map the annex tasks to clause 8 before the first assessment. The map keeps the requirement visible.