Purpose
The risk and impact assessment starts at the business case, runs across the life cycle and is updated at every change.
What clause 8.1 asks
This clause sets out how to find and study a system's bias-related risks and its effects. The work begins with the business case, continues through the life of the system and restarts when the setting changes. After each evaluation, the team reviews it and updates the risks and effects. Findings go into the profile, and earlier treatments are checked and revised. Reviewing at every step is what keeps systemic bias and slow growth in bias from going unnoticed.
Why it matters
The clause makes risk assessment a continuous activity with a fixed starting point. Starting at the business case means the assessment can influence the design, the data and the deployment rather than only the release decision. Updating at each step means a mitigation is not assumed to keep working. The mention of systemic bias is a warning that a system can become more biased as the environment changes even when its code does not.
What good looks like
Put the first assessment in the business case pack, not in the release checklist. At each life cycle step, record the trigger, the update and the effect on the mitigations. Keep the previous assessments so the trend is visible. When the context changes, for example a new market or a new user group, treat it as a new assessment rather than an amendment.
Evidence an assessor asks for
The assessor will ask for the assessment made at the business case stage. If the first assessment is dated after the design was fixed, the clause was not followed.
- Initial assessment The assessment made with the business case, dated and signed
- Update log Each life cycle trigger, the update and the effect on the mitigations
- Trend record The previous assessments, so an increase in bias is visible
- Context change record Each new market, user group or use that triggered a reassessment
Where it commonly fails
- The assessment starts at release
- Mitigations are assumed to keep working without review
- A new market is treated as a communications change, not a reassessment
What to do before publication
Start the assessment with the business case and keep every version. The trend is part of the evidence.