Skip to main content
Clause 3.3 requires the risk register to be reviewed and updated at least quarterly, by the staff responsible for making decisions about the firm’s AI use. Three things are being asked for there, and it is worth separating them.
  • At least quarterly. No more than three months should pass between reviews. It is also sensible, though not required by the standard, to review when your AI use changes.
  • Reviewed and updated. Reading the register is not reviewing it. If nothing changed, it helps to say why, although guardbook does not require a note for a risk marked No change.
  • By the right people. Whoever actually decides how your firm uses AI, not whoever has a spare afternoon.
guardbook has a quarterly review built in. Select Start quarterly review on the Risk Register. The button shows when at least one risk is not Closed. The Review record on each risk shows when it was last reviewed, who by, and when the next review is due. It fills in when you sign a quarterly review.
Use Start quarterly review, not the Record review button on a single risk. Only a signed quarterly review of the whole register sets your next due date and counts towards your GUARD score.A signed review cannot be edited afterwards. It appears in your evidence pack under Quarterly Risk Register Reviews. The reviewer must be on your People list, so add them there first.

​
Running a review

1

Fix the dates in advance

guardbook works out when your next review is due: three months after the last signed review. It shows on your dashboard and in reminder emails. About two weeks before, guardbook prepares the review and flags what to look at. Still book the meeting with the people who make the decisions.
2

Work through every risk that is not Closed

That includes Mitigated and Accepted risks, and guardbook asks you to mark each one No change or Updated. For each one, ask whether the scores still hold, whether the controls are actually operating, and whether the status is still accurate. Open a risk from the register to see its full record.
3

Look at what has changed around the register

New tools on the Tool Register usually mean new risks. Rejected outputs in the Oversight Log often point at a risk that is scored too kindly. A near miss that never made it into the register is the most valuable input a review gets.
4

Update the register, do not just discuss it

Change the scores that moved. Move statuses that no longer hold. Add what is missing. Use Edit risk on the review screen first (it opens in a new tab), then mark the risk Updated with a short note of what changed.
5

Sign the review in guardbook

Choose who carried it out, set the date and write a short summary. If others attended, name them in the summary. guardbook does not check who you choose, so pick someone who makes decisions about your firm’s AI use.

​
What an assessor is likely to ask

Not “do you have a register”. They will ask when it was last reviewed, who by, and what changed as a result. A register whose entries were all created on one day and never touched again answers that question badly, however well written the entries are. Four modest updates across a year is a stronger record than one immaculate register written the week before an assessment.