While you can engage external experts to assist with risk assessments, the ultimate responsibility for compliance with Clause 8.2 remains with your organization. Ensure you maintain oversight and ownership of the process.