ISO 42001 risk assessment: Requirements, process, and audit expectations

Link

An ISO 42001 risk assessment helps organisations understand the potential risks associated with the development, deployment, and use of AI systems. It provides the foundation for informed decision-making, effective governance, and continual improvement.

Key takeaways

ISO 42001 risk assessments help organisations identify, evaluate, and manage AI-specific risks, forming a core requirement of Clause 6.1.2.

Risk assessments and impact assessments are separate ISO 42001 requirements, with both playing an important role in certification readiness.

During audits, assessors review your risk methodology, risk register, treatment decisions, reassessment process, ownership, and supporting evidence.

What is an ISO 42001 risk assessment?

An ISO 42001 risk assessment helps organisations understand the risks that come with developing, deploying, or using AI systems. Under Clause 6.1.2, organisations are expected to identify these risks, assess their potential impact, and decide how they will be managed.

Unlike a traditional IT risk assessment, which tends to focus on areas such as cybersecurity and system availability, an ISO 42001 risk assessment looks at the wider risks AI can introduce. This might include issues around decision-making, transparency, accountability, or unintended outcomes.

Risk assessment vs impact assessment: What ISO 42001 requires

Many organisations assume risk assessments and impact assessments are the same thing, but ISO 42001 treats them as separate requirements. Understanding the difference is essential for audit readiness and certification success.

Risk assessment Clause 6.1.2

Identifies risks that could affect the organisation's AI management system
Assesses the likelihood and potential consequences of identified risks
Results in a risk register and risk treatment plan
Applies to the organisation's AI systems, processes, and governance arrangements
Supports decisions on risk treatment and control implementation
Required for ISO 42001 certification and reviewed during audits

Impact assessment Clause 6.1.4

Evaluates how AI systems could affect people, groups, and society
Considers issues such as fairness, bias, transparency, safety, and human oversight
Results in an AI impact assessment linked to relevant controls
Applies to each AI system developed, deployed, or significantly changed
Supports decisions on safeguards and responsible AI practices
Required for ISO 42001 certification and reviewed during audits

Key takeaway: A risk assessment focuses on risks to the organisation, while an impact assessment focuses on the effects AI may have on people. ISO 42001 requires both.

Key AI risk areas to assess under ISO 42001 (+ Tempo's approach)

AI risks go beyond traditional IT concerns, such as security and availability. ISO 42001 encourages organisations to assess a wider range of risks, including fairness, transparency, human oversight, and the potential impact of AI-driven decisions.

While every organisation's risk profile will be different, the areas below are commonly reviewed when assessing AI systems against ISO 42001 requirements.

1. Fairness and bias

AI systems can unintentionally produce unfair or discriminatory outcomes if the data they are trained on is incomplete, unrepresentative, or biased. This can affect everything from recruitment decisions to customer service interactions and automated approvals.

‍What Tempo reviews: We assess how bias risks are identified, tested, monitored, and mitigated, including training data quality, fairness testing procedures, and documented controls designed to reduce discriminatory outcomes.

2. Transparency and explainability

Users, customers, regulators, and internal stakeholders may need to understand how an AI system reaches its conclusions. A lack of transparency can make it difficult to justify decisions, investigate issues, or build trust in AI-driven processes.

‍What Tempo reviews: We examine whether organisations can explain how AI systems operate, how decisions are documented, and whether affected parties receive appropriate information about AI-assisted outcomes.

3. Human oversight

Not every decision should be left entirely to AI. In some cases, human review and intervention are essential to reduce risk and maintain accountability, particularly when decisions have significant consequences.

‍What Tempo reviews: We assess whether appropriate human oversight mechanisms are in place, including review processes, escalation routes, intervention controls, and documented responsibilities for high-risk AI activities.

4. Safety and reliability

AI systems should perform consistently and safely throughout their lifecycle. Unexpected outputs, model failures, or poorly managed updates can create operational, legal, and reputational risks.

‍What Tempo reviews: We review testing methodologies, validation procedures, incident management processes, and controls designed to ensure AI systems remain reliable, resilient, and fit for purpose.

5. Privacy

Many AI systems rely on large volumes of data, including personal information. Organisations must understand how data is collected, processed, stored, and protected throughout the AI lifecycle.

‍What Tempo reviews: We assess data governance practices, privacy controls, data minimisation measures, consent management processes, and alignment with broader information security requirements where applicable.

6. Accountability

Clear ownership is essential for effective AI governance. Organisations should be able to demonstrate who is responsible for managing AI systems, approving changes, monitoring risks, and responding to issues.

‍What Tempo reviews: We examine governance structures, documented roles and responsibilities, decision-making processes, and audit trails to ensure accountability is embedded throughout the AI management system.

How to conduct an ISO 42001 risk assessment

Most ISO 42001 risk assessments can be completed within a few weeks, depending on the number of AI systems in scope and the maturity of existing governance processes. The outcome is a documented risk register, agreed treatment plan, and evidence that supports certification readiness.

Scoping

Before risks can be assessed, organisations need to establish which AI systems, processes, teams, and data flows fall within the AI Management System. This creates clear boundaries for the assessment and ensures no significant AI activities are overlooked.

Risk identification

Once the scope is defined, organisations identify the risks associated with each AI system. This typically includes areas such as fairness, transparency, privacy, accountability, safety, and human oversight, alongside operational and regulatory risks.

Risk evaluation

Each identified risk is assessed to determine how likely it is to occur and what impact it could have on the organisation, users, or other stakeholders. The results help prioritise which risks require immediate attention and which can be monitored over time.

Risk treatment

For each significant risk, organisations decide how it will be managed. This may involve implementing new controls, strengthening existing processes, increasing oversight, or accepting risks that fall within agreed tolerance levels.

Audit sign-off

The completed risk assessment is reviewed by relevant stakeholders and formally approved. During an ISO 42001 audit, Tempo reviews the risk register, treatment decisions, supporting evidence, and governance records to confirm compliance with Clause 6.1.2.

Evidence auditors expect to see for ISO 42001 risk assessments

A completed risk register alone is rarely enough to demonstrate compliance with Clause 6.1.2. Auditors will look for evidence that risks have been identified, assessed, treated, reviewed, and approved through a documented and repeatable process.

1. A documented risk assessment methodology

A risk assessment should follow a defined process rather than relying on individual judgement. This helps ensure risks are identified and evaluated consistently across different AI systems.