Governance – Endurisk Advisory – Risk, Ethics and Sustainability Consultants

From Principles to Practice: Conducting Your First AI System Impact Assessment Under ISO 42001

From Principles to Practice: Conducting Your First AI System Impact Assessment Under ISO 42001 Many organisations declare a commitment to ethical and responsible AI. Far fewer have the documented, structured processes to demonstrate that commitment when it is tested — by regulators, by incidents, or by stakeholders demanding accountability. The AI System Impact Assessment (AISIA) under ISO/IEC 42001 is the mechanism that bridges that gap. ISO 42001’s Clause 8.4, supported by the governance controls in Annex A.5, requires organisations to conduct formal, documented assessments of the consequences their AI systems may have on individuals, groups, and society. This is not a box-ticking exercise. It is a structured enquiry into externalities — the harms and risks that AI systems create beyond their intended function. This post sets out what the assessment involves, why it matters, and how organisations can approach it in a rigorous and audit-ready way. Why Impact Assessment Matters: The Governance Rationale Most organisations assess their AI systems for technical performance — accuracy, latency, reliability. Fewer systematically assess what happens when those systems interact with real people in complex contexts. An AI system that performs well on technical metrics can still cause harm. A recruitment model with high predictive accuracy may systematically disadvantage certain demographic groups. A credit scoring algorithm may produce outcomes that cannot be explained to the individuals affected. A content moderation system may disproportionately suppress speech from minority communities. The AI System Impact Assessment under ISO 42001 requires organisations to look beyond the model to the consequences it produces — for individuals, for groups, and for society more broadly. It is the mechanism through which abstract commitments to fairness, transparency, and human dignity become operational. Critically, the assessment is also a forward-looking risk tool. By requiring organisations to consider not only intended use but also foreseeable misuse, ISO 42001 pushes governance upstream — identifying potential harms before they materialise rather than responding to them after the fact. The Five Stages of a Rigorous AI System Impact Assessment Stage 1 Define the Scope and Establish Assessment Triggers The first requirement is clarity about when an assessment is required. ISO 42001 identifies several conditions that should trigger the process: Establishing clear triggers and embedding them into the AI development lifecycle is itself a governance control. Organisations that assess AI systems only after deployment — or only when problems emerge — are operating reactively rather than responsibly. Stage 2 Identify Potential Impacts The scope of impact identification under ISO 42001 is deliberately broad. The assessment must go beyond technical performance to examine the externalities of the system across three primary dimensions: This breadth of scope reflects a mature understanding of AI risk. Harms from AI systems rarely announce themselves in technically obvious ways. They emerge through complex interactions between model behaviour, deployment context, and the social and institutional structures in which they operate. Stage 3 Analyse and Evaluate the Results Once potential impacts have been identified, they must be systematically analysed across three interconnected activities: Stage 4 Link Impact Findings to Risk Management The impact assessment does not stand alone. ISO 42001 requires that its findings be integrated into the organisation’s broader AI risk assessment process, governed under Clause 6.1.2. High-impact consequences identified during the assessment should trigger specific risk treatment plans. In mature governance structures, impact thresholds are linked to automatic review triggers — if an assessment identifies impacts above a defined severity threshold, a cross-functional governance forum convenes to determine the appropriate response before deployment proceeds. This integration is what transforms the impact assessment from a document into a governance mechanism. Without it, assessments produce insights that sit in files rather than shaping decisions. The link to risk management also ensures proportionality. Not every AI system requires the same level of scrutiny. By connecting impact findings to risk treatment, organisations can allocate governance resources where they are most needed. Stage 5 Document, Retain, and Build Audit Readiness Documentation is a mandatory control under Annex A.5.3. The final impact assessment report should include: Records must be retained for a defined period informed by legal requirements and organisational retention schedules. This retention requirement reflects the fact that the consequences of AI systems may take time to become visible — and that accountability must extend across the system’s lifecycle, not just its initial deployment. Well-maintained impact assessment documentation also constitutes audit-ready evidence of responsibility. When regulators, investors, or partners ask how an organisation governs its AI systems, the impact assessment record is a direct answer. The Broader Regulatory Context Organisations that establish rigorous AI impact assessment processes under ISO 42001 are building directly towards compliance with the EU AI Act, which requires mandatory conformity assessments for high-risk AI systems. The frameworks are complementary, and the documentation produced under ISO 42001 can serve as foundational evidence for EU AI Act compliance purposes. In the UAE and wider GCC region, regulatory expectations around accountability for automated decision-making are evolving rapidly. Organisations operating in these markets should treat ISO 42001 compliance not as a future requirement but as a present competitive and risk management priority. Building a Culture of Assessed, Accountable AI The AI System Impact Assessment is ultimately a cultural practice as much as a procedural one. Organisations that conduct these assessments rigorously — that bring diverse perspectives to the table, that genuinely interrogate the consequences of their AI systems before deployment, and that link findings to meaningful governance decisions — are building a culture in which responsible AI is embedded in how work gets done. This culture does not emerge from policy statements. It emerges from practice: from cross-functional teams convening to assess impact, from concerns being raised and acted upon, from documentation that reflects genuine analysis rather than compliance theatre. ISO 42001 provides the structure. The governance work of building accountability rests with leadership. How Endurisk Advisory Can Help Endurisk Advisory supports organisations at every stage of the AI impact assessment process — from designing the assessment framework and establishing triggers aligned with ISO 42001, to facilitating cross-functional assessments

From Principles to Practice: Conducting Your First AI System Impact Assessment Under ISO 42001 Read More »

bridge, silhouette, sunset, dusk, structure, architecture, nature, road bridge, arch bridge, suspension bridge, silver jubilee bridge, river mersey, manchester ship canal, england, united kingdom

Why AI Governance Is Not Optional: Building Accountability Before Crisis Strikes

AI, Governance, Risk / Admin

Why AI Governance Is Not Optional: Building Accountability Before Crisis Strikes Artificial intelligence is no longer a technology experiment. It is a business function — embedded in hiring decisions, customer interactions, financial models, and operational workflows. Yet for most organisations, the governance frameworks that should oversee these systems remain absent or superficial. The consequences of ungoverned AI are not theoretical. Across industries, we are seeing the results: discriminatory hiring algorithms, opaque credit scoring, regulatory sanctions, and reputational damage from models that nobody inside the organisation truly understands or controls. What began as innovation gaps have become governance failures. ISO/IEC 42001:2023 — the international standard for AI Management Systems — provides a structured answer to this challenge. It is not a technical specification. It is a governance framework. And understanding why that distinction matters is the first step for any leadership team serious about responsible AI. The Governance Gap: What Most Organisations Are Missing The majority of organisations deploying AI have invested heavily in capability but far less in accountability. They have data scientists, engineers, and product teams building and running AI systems. What they frequently lack are the structures that should surround those systems: clear ownership, documented decision rights, defined risk thresholds, and meaningful human oversight. This creates a dangerous pattern. AI systems are deployed rapidly, often without a formal assessment of their potential consequences. When something goes wrong — a model produces biased outputs, a decision cannot be explained to a regulator, or a system behaves unexpectedly at scale — there is no clear chain of accountability. No one can point to a document that says who approved this, what risks were considered, and how oversight was structured. ISO 42001 is designed to close precisely this gap. Its governance requirements are not about slowing down AI development. They are about ensuring that organisations have the foundational structures in place to develop and deploy AI responsibly — and to demonstrate that responsibility to regulators, investors, and the public. What Governance Actually Means Under ISO 42001 1. Leadership Commitment and AI Policy Governance begins at the top. ISO 42001 requires top management to establish a formal AI Policy — a documented statement of the organisation’s principles for responsible AI that provides a framework for setting objectives and aligning AI initiatives with broader business strategy. This is not a communications exercise. The policy must be operationally meaningful. It should define what the organisation considers acceptable and unacceptable use of AI, how AI-related risks are to be managed, and how the organisation’s approach aligns with existing frameworks in cybersecurity, privacy, and ethics. Without this commitment from leadership, AI governance remains a middle-management concern. It does not change the decisions that matter. 2. Clear Roles, Responsibilities, and Authorities One of the most consistent findings in AI governance failures is what practitioners call diffused accountability — the absence of any individual or function with clear responsibility for ensuring that AI systems behave appropriately and that concerns are acted upon. ISO 42001 requires organisations to formally designate AI-related roles and define responsibilities across departments including Legal, Risk, Engineering, and Product. Effective structures typically include a cross-functional AI governance forum with defined decision rights at critical intervention points: model approval, deployment authorisation, and decommissioning. The standard also requires that staff have clear mechanisms for reporting concerns about AI systems — with appropriate confidentiality protections. This matters because the people closest to AI systems often observe risks that leadership does not see. 3. The AI Use-Case Inventory A foundational control that many organisations overlook is the AI use-case inventory — a consolidated register of every AI system being developed, deployed, or used within the organisation, including its intended purpose, data sources, owner, and lifecycle state. This is not bureaucracy. It is the minimum condition for meaningful oversight. Organisations that cannot enumerate their AI systems cannot govern them. The inventory becomes the starting point for risk assessment, impact assessment, and audit readiness. Why Governance Failures Are Accelerating The regulatory environment is tightening rapidly. The EU AI Act — now in force — introduces risk-based obligations for AI systems that mirror the ISO 42001 framework: classification of AI by risk level, mandatory impact assessments for high-risk systems, transparency requirements, and human oversight obligations. In the UAE, Federal Decree-Law No. 11 of 2024 on the Reduction of Climate Change Effects came into force on 30 May 2025, signalling the broader regional shift toward mandatory accountability frameworks that extend well beyond environmental compliance. Regulatory bodies are paying closer attention to how organisations manage consequential automated decisions. Organisations that have established foundational AI governance under ISO 42001 find it significantly easier to demonstrate compliance with new regulatory requirements — because the management systems, documentation, and accountability structures are already in place. For organisations without that foundation, each new regulatory requirement becomes a crisis response rather than a structured adaptation. The cost differential — in time, resources, and reputational exposure — is substantial. The Risk of Inaction Leadership teams sometimes frame AI governance as a cost or a constraint on innovation. This framing misunderstands the actual risk profile. Ungoverned AI creates exposure across multiple dimensions simultaneously: These risks compound. A governance failure that begins as a technical issue rapidly becomes a legal, regulatory, and reputational event. The absence of documentation — of who approved what, what risks were considered, and how oversight was structured — transforms manageable incidents into existential ones. ISO 42001 governance structures are not primarily about compliance. They are about organisational resilience. They create the conditions under which AI systems can be trusted — by leadership, by regulators, and by the people they affect. Starting the Governance Journey Establishing AI governance under ISO 42001 follows a structured, phased approach: This is a continuous journey, not a one-time project. But organisations that begin it systematically — with clear structures and documented accountability — are building a foundation that protects them as the AI landscape continues to develop. How Endurisk Advisory Can Help At Endurisk Advisory, we work with organisations across the

Why AI Governance Is Not Optional: Building Accountability Before Crisis Strikes Read More »

meeting, workplace, chairs, table, room, workspace, meeting, meeting, meeting, workplace, workplace, workplace, workplace, workplace

Corporate Governance and Ethics

Decision Making, Ethics, Fraud Risk, Governance, Risk / Admin

Ethics begins with moral guidance – the simple but profound idea of treating others as we wish to be treated ourselves. In an organizational context, this translates into fairness, respect, and integrity in every interaction – with employees, investors, communities, and society at large.

Corporate Governance and Ethics Read More »

beard, business, business people, cafe, coffee shop, communication, connection, corporate, internet, laptop, man, online, person, suit, table, typing, working, business, business, business, business, business, corporate, corporate, corporate, corporate, typing

The Missing Link in Investment Decisions: Forensic Due Diligence

Due Diligence, Forensics, Forensics, Governance, Investigation, Risk / Tauwfiq Wahidi

The Missing Link in Investment Decisions: Forensic Due Diligence In the world of investments, due diligence is often seen as a box to tick—legal, financial, commercial, and tax reviews are conducted routinely. Yet, amid these critical checks, one dimension often remains overlooked: forensic due diligence. As investor expectations evolve and the reputational stakes rise, it is no longer sufficient to assess only what is documented or declared. Forensic due diligence fills a crucial gap—it uncovers hidden risks that could affect not only the valuation of a potential investment but also its long-term stability and public credibility. What Is Forensic Due Diligence? Forensic due diligence is a deeper form of investigation that looks beyond numbers and contracts. It examines the background, behaviour, and track record of key individuals, identifies potential conflicts of interest, analyses past and ongoing disputes, and detects patterns of misconduct or governance failures. Unlike conventional due diligence, which focuses on validating assets, liabilities, and growth assumptions, forensic reviews aim to uncover undisclosed liabilities, ethical breaches, reputational risks, and governance vulnerabilities. The Hidden Risks Behind the Scenes Every investment is fundamentally a bet on people. No matter how attractive the financials, a weak or opaque leadership team can derail growth, invite regulatory scrutiny, or spark cultural dysfunction within an organisation. Some of the risks that forensic due diligence helps uncover include: These are not mere footnotes. In many cases, such risks have translated into operational failures, compliance violations, or reputation damage—resulting in value erosion after the deal is closed. Why Traditional Due Diligence Falls Short Standard legal and financial diligence typically relies on information provided by the company itself—disclosures, statements, and interviews with leadership. But what if the real issues are not disclosed? Or if the leadership is unaware, or worse, complicit? Forensic due diligence brings an independent, investigative lens. It involves structured background checks, discreet stakeholder interviews, media and litigation database scans, conflict mapping, and integrity reviews of management and founders. It is both preventive and diagnostic—designed to catch problems early or assess their materiality before the investment is committed. Aligning With ESG and Reputation Standards With growing focus on Environmental, Social, and Governance (ESG) factors, investors are held accountable not only for returns but also for the ethical footprint of their portfolio. Reputational failures—be it a toxic work culture, a non-compliant supply chain, or integrity issues at the leadership level—can impact investor credibility and trigger regulatory or media backlash. Forensic due diligence helps ensure that governance is not just a checkbox but a lived value. It allows investors to validate ESG claims, identify potential social or ethical red flags, and assess whether an organisation’s internal culture aligns with its external commitments. Making It a Standard Practice Integrating forensic due diligence into the investment process does not mean treating every deal with suspicion. Rather, it signals a commitment to responsible investing. The depth of the review can be proportionate to the investment size, sector sensitivity, or early-stage signals. But what matters is consistency—ensuring every transaction goes through a basic level of integrity screening. In sectors like fintech, healthcare, infrastructure, education, or consumer brands—where trust, compliance, and employee well-being are central—the absence of forensic insights can leave investors vulnerable to surprises post-investment. In today’s environment, risk is no longer just about capital exposure or market volatility—it is equally about ethics, transparency, and conduct. Forensic due diligence equips investors with the tools to see around corners, identify soft risks, and make more confident, informed decisions. As the deal landscape becomes more complex, and as regulators and stakeholders demand higher accountability, the case for forensic due diligence is not just compelling—it is essential. How Endurisk Advisory Can Help At Endurisk Advisory, we specialise in bringing a forensic lens to investment decisions. Our services are designed to uncover integrity, governance, and reputational risks that often go unnoticed in traditional due diligence processes. We offer comprehensive forensic background checks on promoters and key management, conflict of interest assessments, litigation and regulatory reviews, digital footprint and media analysis, and culture and ethics diagnostics through discreet stakeholder interviews. Our approach is discreet, independent, and tailored to the context of each investment. Whether you’re evaluating a high-growth startup, a mature acquisition target, or conducting portfolio reviews, Endurisk equips you with clear, actionable insights—so you invest with confidence, foresight, and integrity. Contact our team to learn more

The Missing Link in Investment Decisions: Forensic Due Diligence Read More »

Embedding Sustainability into Corporate Strategy: Leveraging the BRSR Framework

ESG, Governance, Sustainability / Tauwfiq Wahidi

The BRSR framework represents a pivotal moment in the evolution of corporate governance. It challenges boards and leadership teams to embrace a holistic perspective that goes beyond short-term profit-making. Instead, it focuses on long-term value creation by embedding sustainability across strategic and operational frameworks.

This paradigm shift acknowledges that companies are not isolated economic entities but interconnected participants in the broader ecosystem, holding significant responsibilities toward society and the environment.

Embedding Sustainability into Corporate Strategy: Leveraging the BRSR Framework Read More »

Insights Why ESG is Everyone’s Business

ESG, Governance, Sustainability / Tauwfiq Wahidi

As Environmental, Social, and Governance (ESG) considerations take center stage, they’re becoming essential not just for investors, but for management teams and society as a whole. Investors are diving into ESG because it helps them gauge long-term resilience and value. But what does this mean for how you run your business, and why should it matter beyond the balance sheet?

Investors are honing in on ESG to evaluate how well companies manage future risks and create sustainable value. Strong ESG practices often lead to better financial performance and lower risks.

Management teams need to weave ESG into their core strategies. This isn’t just about setting targets; it’s about embedding sustainability into every decision, increasing transparency, and building a responsible culture.

For society, ESG matters because it tackles pressing issues like climate change and social inequality. Businesses have a crucial role in driving meaningful change and building a better world.

Insights Why ESG is Everyone’s Business Read More »

India’s Commitment to Green Finance: Developing a Climate Finance Taxonomy

ESG, Governance, Risk, Sustainability / Tauwfiq Wahidi

Around the world, ESG regulations are expanding rapidly, with countries implementing a mix of mandatory and voluntary measures to foster transparency and sustainable practices. From carbon pricing to corporate disclosure mandates, these frameworks are reshaping how businesses address environmental, social, and governance issues across diverse sectors.

India’s Commitment to Green Finance: Developing a Climate Finance Taxonomy Read More »