Academy learning group 2 · Academy module (not an ISO clause) M03 · Chapter 3 of 8
Separate AI risk assessment from impact assessment
About 6 minutes · ISO/IEC 42001:2023
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Risk asks what could go wrong; impact asks who or what is affected.
Explore the anchors
Analyze scenarios uncertainty and treatment needs.
Concept matching activity
Match this task or description to its concept:
Examine effects on people groups and wider context.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and distinctions
- Apply the process and collect evidence
- Risk-based planning and technology-dependent audit scope
Concepts and distinctions
AI risk assessment and AI-system impact assessment are related but answer different questions. Risk analysis examines uncertain scenarios and consequences relevant to objectives. Impact work examines potential effects on people, groups or broader settings in the intended operating context. A project can appear financially attractive while creating unacceptable effects for affected people.
Do not reduce these assessments to a single undocumented score. Consider intended purpose, foreseeable misuse, data characteristics, who may be excluded, human review and how decisions can be questioned or corrected. The relevant obligations and affected parties depend on jurisdiction and use. This course teaches assessment reasoning, not a legal determination that a particular deployment is permitted.
Apply the process and collect evidence
Document assumptions, evidence, participants and unresolved issues. Connect identified concerns to treatment, operating restrictions and authorized decisions. Reassess when purpose, data, users, capabilities or deployment conditions change. Obtain appropriate specialist input for consequential uses and describe limitations honestly; a positive internal review does not guarantee absence of adverse effects.
Risk-based planning and technology-dependent audit scope
Prioritize audit effort using intended use, affected people, potential consequences, uncertainty, previous findings and major changes. Risk-based auditing determines where deeper testing is warranted; evidence-based auditing determines what conclusions the observations support. Neither method allows unsupported claims about systems outside the sample. Record scope, objectives, applicable criteria, locations, supplier interfaces, competence needs and time allocation in the audit plan.
Connected devices can introduce sensor provenance, clock accuracy, update and physical-environment dependencies. A blockchain record may help detect later alteration but does not prove that an original sensor reading or label was correct. Cloud services introduce contractual access and responsibility boundaries. Emerging technologies change the evidence needed; they do not make every organization subject to the same controls. Review changes periodically rather than treating a trend list as a mandatory AIMS checklist.
| Concept | What to remember |
|---|---|
| Risk assessment | Analyze scenarios uncertainty and treatment needs |
| Impact assessment | Examine effects on people groups and wider context |
| Decision | Combine evidence when approving or changing use |
Worked example
A prioritization model saves administrative time but consistently delays service for a smaller user group. The project team says the overall financial benefit settles the assessment. Assess the distribution and consequences of delays, not only aggregate savings. Involve appropriate owners and affected-party perspectives, investigate the evidence and consider changes or restrictions. Business benefit is relevant but does not resolve every impact or obligation.
Check your understanding
Why is aggregate financial benefit insufficient for an AI impact assessment?
Show explanation
Adverse effects can be concentrated on particular people or groups. Effects and their distribution require attention beyond one organizational benefit measure.
Source and study boundary
Official standard overview. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.