Home / Requirement record / 6.4.3.2
6.4.3.2
Assessment of consequences
The organization assesses what each identified risk would do: how critical the impact would be, the tangible and intangible effects on the organization, on individuals and on society, and the basis used to judge the overall impact. The artefact behind the answer is consequence assessment with criticality and tangible and intangible impacts. The step before 6.4.3.2 supplies its input, so run both together.
- What it asks
- The organization assesses what each identified risk would do: how critical the impact would be, the tangible and intangible effects on the organization, on individuals and on society, and the basis used to judge the overall impact.
- Where generative AI changes the answer
- Consequences are easiest to understate when the output is only advisory, and that is exactly when a reviewer stops checking it.
- Who it binds
- The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.4.3.2 the named role is the owner of consequence assessment with criticality and tangible and intangible impacts.
- Evidence an auditor normally samples
- Consequence assessment with criticality and tangible and intangible impacts
- The test you can run
- Ask for consequence assessment with criticality and tangible and intangible impacts and for its last review date; an artefact nobody can date is paperwork rather than a control.
- Common failures
- Intangible impacts such as loss of trust ignored
- Before the draft publishes
- For 6.4.3.2, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is consequence assessment with criticality and tangible and intangible impacts.
- Where this sits against the draft
- 6.4.3.2 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.4.3.2 (assessment of consequences) with this record and note the change in the register.