Monitoring and review of the assessment

The requirement, in our words

Set and document how assessments are monitored and revised: frequency, trigger events, the responsible person and what the review covers, with outputs that decide changes to the process, the risk treatment, the objectives or the thresholds.

What it means for human oversight

Review is where the oversight learns. A change in the system, the population or the law should reopen the assessment and the oversight design together.

How to evidence it

Attach the artefacts above to the Monitoring and review of the assessment row with the system name, the owner and the date. The first one is the anchor: A monitoring and review procedure with frequency, triggers and owners. The OH-37 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Review outputs deciding changes. If that artefact for OH-37 cannot be produced, the row is a gap, whatever the policy says.

OH-37 carries 3 evidence items and 2 common gaps. For monitoring and review of the assessment, observe one live decision rather than reading the procedure, because the question is whether the person can use the control without asking permission. The OH-37 statement above is ours, written from ISO/IEC 42005:2025, 5.12, not a reproduction of the licensed text.

Common gaps

• Assessment treated as a one-off deliverable
• Thresholds never revisited

Related units

• Competence of the overseer
• Responsible use
• Context and the role you play