A risk assessment goes out of date when a law, a policy, a vendor model or the system itself changes. Continuous risk assessment re-scores only what changed and keeps every prior human decision.
The point that an approved assessment describes a system that no longer exists once the model is retrained is the part I'd expect most committees haven't faced yet. With new submissions already outpacing decisions nearly 3 to 2, re-reviewing the old ones by hand was never going to happen.
The new-population case is the one that slips past a calendar review. If the assessment is keyed only to the model name, pointing that same endpoint at another department looks like no change at all. Keying it to the serving route and the population filter puts that config edit in the reassessment queue before the new traffic starts.
The 600 against 36 maths is the clearest version of this problem I've seen. Last year's Joint Commission and CHAI guidance already said monitoring responsibility should be settled during procurement and contracting, and asked for feedback channels so vendors flag model updates. If the contract doesn't oblige a vendor to say when a model version changes, the documentation trigger has nothing to fire on.
The point that an approved assessment describes a system that no longer exists once the model is retrained is the part I'd expect most committees haven't faced yet. With new submissions already outpacing decisions nearly 3 to 2, re-reviewing the old ones by hand was never going to happen.
The new-population case is the one that slips past a calendar review. If the assessment is keyed only to the model name, pointing that same endpoint at another department looks like no change at all. Keying it to the serving route and the population filter puts that config edit in the reassessment queue before the new traffic starts.
The 600 against 36 maths is the clearest version of this problem I've seen. Last year's Joint Commission and CHAI guidance already said monitoring responsibility should be settled during procurement and contracting, and asked for feedback channels so vendors flag model updates. If the contract doesn't oblige a vendor to say when a model version changes, the documentation trigger has nothing to fire on.