Impact assessment in operation

The requirement, in our words

Carry out impact assessments on the planned basis at scheduled intervals and whenever a significant change is proposed, and keep the documented results of every assessment.

What it means for human oversight

The assessment must be refreshed when the system, the data, the population or the use changes. An assessment done once at design does not describe the system now operating.

How to evidence it

Attach the artefacts above to the Impact assessment in operation row with the system name, the owner and the date. The first one is the anchor: A schedule of impact assessments. The OH-12 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for The results of each assessment. If that artefact for OH-12 cannot be produced, the row is a gap, whatever the policy says.

OH-12 carries 3 evidence items and 2 common gaps. For impact assessment in operation, link the row to the assessment page that names the harm, because an overseer cannot watch for a consequence the file never describes. The OH-12 statement above is ours, written from ISO/IEC 42001:2023, 8.4, not a reproduction of the licensed text.

Common gaps

• Assessment done at design only
• A significant change made without a reassessment

Related units

• Impact assessment at planning
• The impact assessment process
• Context and the role you play