Risk and impact assessment in the life cycle

What clause 5.2.4 asks

The risk work needs funding and people for the whole life of the system, not a single workshop. It also depends on the two earlier steps: the stakeholder set and the data record become its inputs. What the organization learned about affected people and about representation shapes the questions the risk work asks.

Why it matters

Resourcing is the practical test of whether an assessment is real. A one-time workshop will not cover a system that changes, drifts or moves into a new market. The input relationship is the other half: the risk assessment cannot invent its own stakeholder list or data description, because those were established under clauses 6 and 7. A risk register that uses a different set of affected groups from the data map is not connected to the rest of the work.

What good looks like

Put the assessment on the life cycle budget with named effort at each stage. At every iteration, confirm that the current stakeholder reference set and data map are the inputs. If they have changed, update the assessment before it is signed. If the assessment needs a stakeholder or data fact that does not exist, send it back to clause 6 or 7 rather than filling the gap with an assumption.

Evidence an assessor asks for

The assessor will ask which stakeholder and data versions the assessment used. An assessment that cannot name them is disconnected from the record.

• Resourcing plan The effort and budget for the assessment at each life cycle stage
• Input confirmation The stakeholder and data versions used for the current assessment
• Return log Questions sent back to clauses 6 or 7, with the answer and date
• Assessment versions The initial and updated assessments, linked to the profile

Where it commonly fails

• The assessment is funded once, at design
• The risk register uses a different stakeholder list from the data map
• Missing facts are filled with assumptions instead of being sent back

What to do before publication

Budget the assessment at the same time as the clause 6 and 7 work, so the inputs arrive when they are needed.

Read across

• 5.2 The bias profile and the system life cycle
• 5.2.2 Stakeholder identification in the life cycle
• 5.2.3 Data representation in the life cycle
• 8.1 Purpose
• 8.2 Inputs

← 5.2.3 Data representation in the life cycle5.2.5 Evaluation in the life cycle →

Full register / The dates / Free scope check