Actions
The actions start the assessment at the business case, update it at changes, build two inventories, assign accountability and record the signature.
What clause 8.4 asks
Six tasks shape the review. Begin when the business case is written, and choose the risk and impact measures with a stated reason. Review and update the work whenever the profile changes or the system, its setting or its surroundings change, looking for new risks and checking whether earlier treatments and accepted limits still hold. Build the review team so its makeup reflects the affected people, and consult outside parties where that helps. Keep two lists: one for risks to the organization and its influential parties, one for effects on outside and affected parties. Sign the review and every later change, naming the position that controls the system. Where risk remains, the relevant accountable party also accepts responsibility for the legal, regulatory or other harm that may follow.
Why it matters
The two inventories are the heart of the clause. They keep the organization's own risk separate from the harm to people outside it, which prevents a single register from hiding an external impact behind an internal cost. The signature and the acceptance are the governance teeth: a named position takes responsibility, including for the residual risk. The team diversity and consultation actions improve the quality of the judgement, but they do not replace the signature.
What good looks like
Build the two inventories as separate tables with their own owners. Use the current stakeholder set to populate them. At each update, record which trigger fired and what changed. Put the signature block on the assessment itself, not in a covering email, and record the accepted tolerance beside it. Where residual risk remains, obtain the explicit acceptance from the relevant accountable entity before the system proceeds.
Evidence an assessor asks for
The assessor will ask who signed and what they accepted. A signature without a stated tolerance is a signature to an unknown risk.
- Two inventories Internal or influencing risks and external or impacted effects, each with an owner
- Metrics and rationale The risk and impact metrics and the reason for each
- Update record The trigger, the change and the effect on mitigations and tolerance
- Signed assessment The signature of the position that controls the system, with the date
- Residual acceptance The accountable entity's acceptance of unmitigated risk and its consequences
Where it commonly fails
- One inventory covers both internal and external effects
- The signature is the programme manager's, not the position that controls the system
- Residual risk is accepted verbally
What to do before publication
Design the signature block and the acceptance wording before the first assessment. The governance is easier to get right at the start.