Outcomes
The team identifies risk levels and treatment tasks, uses them continuously, and the owner formally accepts the assessment.
What clause 8.5 asks
The team ends with a view of how serious the bias risk and the effects are, and with the treatment tasks that follow. Those tasks are used continuously to check whether the risk is being reduced. The system's owner formally accepts the review. If ownership, surroundings or both change, the review is done again in full and accepted again.
Why it matters
Formal acceptance is the moment the organization decides to proceed with the risk it knows about. It is not a rubber stamp on a completed document. The requirement to repeat the full assessment when ownership or environment changes is a recognition that the acceptance belongs to a particular owner in a particular context. A new owner inherits the system but not the previous owner's acceptance.
What good looks like
Record the acceptance in the assessment and in the governance minutes. Name the owner and the scope of what was accepted. When ownership or environment changes, open a new assessment rather than transferring the old acceptance. Then use the risk levels to drive the treatment plan, and review the plan at each iteration.
Evidence an assessor asks for
The assessor will ask what the owner accepted and when. An acceptance that predates a change of ownership or environment is not valid for the new situation.
- Acceptance record The owner's formal acceptance, with the date and the scope
- Treatment plan The tasks that follow from the risk levels, with owners and dates
- Change trigger record The ownership or environment change that required a new assessment
- Governance minute The decision to proceed, with the residual risk stated
Where it commonly fails
- Acceptance is a signature on a document no one reads
- A new owner inherits the old acceptance
- The treatment plan has no owners or dates
What to do before publication
Treat acceptance as a governance decision, not a document control step.