Where: /app/risk and /app/aims/impact-assessments

For each system in your sample, trace to its AI risk assessment and its AI system impact assessment. Stale or missing assessments are the classic nonconformity in a young management system, so check dates against the system's lifecycle state.

What to establish

• Named owners and dates on every assessment.
• A recorded treatment decision, and a named decider for any accepted residual risk.
• Inferred classifications labelled as inferred, and confirmed by a human before they count.

What would be a finding

A high-risk system with no impact assessment; an assessment with no owner; a risk closed with no treatment decision; or a machine-derived classification presented as an organisational determination.