Checklist for Clause 8.2 of ISO/IEC 42001 (AIMS): AI Risk Assessment

1. Introduction

Below is a certification-grade, auditor-ready tabular checklist for Clause 8.2 of ISO/IEC 42001 - AI Risk Assessment, developed directly from the PECB auditing slides provided and aligned with PECB / IAS-accredited audit practice.

This checklist ensures AI risk assessments are performed at the right times, triggered by change, compliant with Clause 6.1.2, and fully documented for operational assurance.

2. ISO/IEC 42001 - Clause 8.2: AI Risk Assessment

Audit Checklist (Intervals, Change Triggers, Compliance & Records)


#

Clause 8.2 Requirement Area

Audit Objective

Audit Questions (Checklist)

Expected Evidence

Conformance (Y/N/Partial)

Findings / Gaps

Risk Rating

Improvement Actions

8.2-1

Defined Assessment Intervals

Confirm scheduling

Has the organization defined planned intervals for conducting AI risk assessments?

Risk assessment schedule

8.2-2

Interval Appropriateness

Validate adequacy

Are assessment intervals appropriate to AI risk level, criticality, and lifecycle stage?

Risk-based interval rationale

8.2-3

Change-Triggered Assessments

Ensure responsiveness

Are AI risk assessments performed when significant changes are proposed or occur?

Change triggers; reassessment records

8.2-4

Significant Change Definition

Prevent ambiguity

Are significant changes clearly defined (model updates, data changes, deployment context, suppliers)?

Change classification criteria

8.2-5

Change Detection Mechanism

Ensure detection

Does the organization have mechanisms to identify when changes trigger a new risk assessment?

Change logs; monitoring alerts

8.2-6

Adherence to Clause 6.1.2

Confirm compliance

Are AI risk assessments performed in accordance with Clause 6.1.2 requirements?

Methodology alignment

8.2-7

Policy & Objective Alignment

Maintain consistency

Are operational risk assessments aligned with AI policy and AI objectives?

Policy-risk mapping

8.2-8

Comprehensive Risk Coverage

Ensure completeness

Do assessments identify risks comprehensively, including ethical, legal, societal, and operational risks?

Risk registers

8.2-9

Risk Analysis & Evaluation

Validate rigor

Are risks analysed, evaluated, and prioritised using defined criteria?

Risk scoring; prioritisation

8.2-10

Use of Results

Enable action

Are AI risk assessment results used to inform operational controls and treatment actions?

Treatment plans; control updates

8.2-11

Retention of Results

Confirm record keeping

Does the organization retain documented information of all AI risk assessment results?

Stored assessments

8.2-12

Content of Records

Ensure sufficiency

Do records include identified risks, consequences, likelihood, risk levels, and prioritisation outcomes?

Completed assessment templates

8.2-13

Traceability

Support audit

Can risk assessment results be traced to specific AI systems, versions, and dates?

Traceability links

8.2-14

Version Control

Prevent confusion

Are risk assessment records version-controlled to reflect updates over time?

Version history

8.2-15

Accessibility

Enable use

Are AI risk assessment records accessible to authorized personnel when needed?

Access permissions

8.2-16

Protection of Records

Ensure integrity

Are records protected against loss, unauthorised access, or alteration?

Security controls; backups

8.2-17

Review & Update

Maintain currency

Are AI risk assessments reviewed and updated following incidents, performance issues, or new risks?

Review logs

8.2-18

Management Oversight

Confirm accountability

Does management review AI risk assessment outcomes as part of operational oversight?

Management review minutes


3. Auditor's Conclusion - Clause 8.2

Assessment Area

Conclusion

Overall Conformance Status

☐ Conform ☐ Minor NC ☐ Major NC

Timeliness of AI Risk Assessments

☐ Timely ☐ Inconsistent ☐ Reactive

Alignment with Clause 6.1.2

☐ Strong ☐ Partial ☐ Weak

Risk of Undetected AI Changes

☐ Low ☐ Medium ☐ High

4. Common Auditor Findings (Clause 8.2)

Auditors commonly raise findings where:

· Risk assessments are performed only annually, ignoring change triggers

· Model or data changes occur without reassessment

· Records exist but lack prioritisation or consequence detail

· Assessments are done but not linked to controls or treatment

· Management is not aware of updated AI risk profiles

This checklist explicitly closes those gaps.

5. ISOLTX Operational Alignment

Clause 8.2 is operationalised through:

· ERMS → Scheduled & change-triggered AI risk assessments

· I²MAS → Incident-driven reassessments

· DMS → Controlled risk assessment records

· AUDIT → Verification of reassessment triggers

· PERFORMANCE → Risk trend indicators

It ensures AI risk assessment is continuous, event-driven, and operationally embedded.

6. Contact Us Today

Are you looking to grow into an Artificial Intelligence (AI) trusted company?

Contact Crest Advisory Africa today for expert guidance on implementing ISO 42001 frameworks tailored to your organization's needs.

Start your journey today. Visit crestadvisoryafrica.com or contact us at +27 (0) 764034307 or nico@crestadvisoryafrica.com.

Let's make 2026 the year of your professional breakthrough!