Assessment results

Review the risks, controls and guardrails an assessment found, add risks it did not find, and move on to configure guardrails.

After you submit, the assessment is In review and its page shows the scope: the risks that apply, the controls that answer them, and the guardrails those controls call for. This is where you check that the scope is right before anything goes live.

Risks

The Risks tab lists each risk with its ID (such as RISK-00001), its category, and its references in the NIST AI RMF and ISO/IEC 42001. Search or filter the list, and select a risk to read about it, its controls and the guardrails it switches on.

Each risk has a source:

Source	Meaning
Found by your assessment	Your answers point to it. It cannot be taken out.
Added by you	Someone added it from the catalogue. It can be taken out.
Always applied	Altrum applies it to every AI system, with controls Altrum enforces. It carries an Every AI system tag and cannot be taken out.

Add a risk

Choose Add a risk to open the catalogue of risks the assessment did not find. Search by name, category, control or a few words, and tick the risks that apply. Before you add them, the dialog names the guardrails they switch on. Added risks bring all their controls, and their guardrails are switched on in your draft until you set them up.

To take out a risk you added, open it and choose Take it out, then confirm. Its guardrails stay on.

Controls

The Controls tab lists each control in the scope once: its ID (such as CTL-00001), name, type, how many risks it covers and the guardrails it maps to. Types are Preventive, Detective, Mitigating and Administrative. Controls come with their risks: to bring in more, add a risk.

Guardrails in scope

The Guardrails tab has one card for each guardrail the scope maps to, marked from your saved guardrail draft:

Mark	Meaning
Configured	It is on, with everything it needs.
Needs your action	Either “Switched off: the risks behind it are not covered.” or “Choose what it checks: it checks nothing until you do.”

When every guardrail is set up, the tab says “Every guardrail in scope is configured.”

A guardrail that is on but checks nothing stops the assessment from completing. One that is switched off does not, but the risks behind it stay uncovered.

Next steps

• Configure guardrails opens the guardrail editor for this AI system, with the assessment still open. See Configure guardrails and Guardrail suggestions.
• Conversation opens the conversation behind the assessment, read only.
• Refresh results, in the menu, reads the risks the assessment found again. The risks you added stay. It never switches guardrails on.

You can move between the results and the guardrail editor as often as you like. The assessment completes when you choose Complete Assessment in the guardrail editor.

Where results appear later

The AI system’s Risk tab shows the risks of the latest submitted assessment and how the live guardrails cover them, with the residual rating. Assessment history lists every assessment: open one to read its results and its conversation.

When the answers change the AI system’s risk profile, its page suggests the change for the owner to accept or reject. See After an assessment.