Module 8: Capstone Project — Ethics Audit of an AI System
Recommendations and prioritization
Description
The findings identified the gaps. The recommendations prescribe the action. Without prioritization, every recommendation looks equal and none gets implemented.
This capsule teaches you how to prioritize systematically and create realistic action plans that stakeholders actually execute.
By the end you'll be able to:
- Prioritize recommendations with a consistent framework (Severity × Likelihood × Cost-to-fix)
- Categorize them into Critical / High / Medium / Low with SLAs
- Build an action plan with owners, timelines, and dependencies
- Communicate the priorities to stakeholders effectively
The prioritization framework
Three dimensions:
Dimension 1: Severity (the impact if it isn't fixed)
| Severity | Description |
|---|---|
| 5 — Catastrophic | Legal liability, the license to operate at risk, major user harm |
| 4 — Critical | Significant compliance/reputational risk, damage to user trust |
| 3 — High | Moderate risk, it may affect specific users |
| 2 — Medium | Limited impact, mitigations exist |
| 1 — Low | A minor inconvenience, cosmetic |
Dimension 2: Likelihood (the probability the problem materializes)
| Likelihood | Description |
|---|---|
| 5 — Certain | It will happen soon if it isn't fixed |
| 4 — Likely | High probability |
| 3 — Possible | Moderate probability |
| 2 — Unlikely | Low probability |
| 1 — Rare | Very low but possible |
Dimension 3: Cost-to-fix (the effort needed)
| Cost | Description |
|---|---|
| 5 — Trivial | < 1 day of work |
| 4 — Small | 1-5 days |
| 3 — Medium | 1-2 weeks |
| 2 — Large | 3-6 weeks |
| 1 — Major | > 6 weeks |
The priority score
Priority Score = Severity × Likelihood
Quick win = Score × Cost (higher = a better quick win)
Categorize:
- Critical: Score ≥ 20 (anything with Severity 5)
- High: Score 12-19
- Medium: Score 6-11
- Low: Score < 6
Examples
Example 1: International transfer safeguards (SCCs)
- Severity: 5 (Catastrophic) — a GDPR violation, a fine of up to 4% of revenue
- Likelihood: 5 (Certain) — already non-compliant
- Cost: 5 (Trivial) — sign the documents
- Priority Score: 25 → CRITICAL
- Quick win: 25 × 5 = 125 → Top priority
Example 2: Production bias monitoring
- Severity: 3 (High) — bias could go undetected
- Likelihood: 3 (Possible) — drift can happen
- Cost: 3 (Medium) — 2 weeks of engineering
- Priority Score: 9 → MEDIUM (close to HIGH)
- Wait — but Severity could be Critical depending on the use case. Adjust.
Example 3: CEO sign-off on the AI policy
- Severity: 1 (Low) — administrative
- Likelihood: 1 — it won't cause problems directly
- Cost: 5 (Trivial) — 1 hour
- Priority Score: 1 → LOW but Quick win = 5 → do it quickly anyway
Categorization with SLAs
Define SLAs by priority:
| Priority | SLA (target resolution) | Approach |
|---|---|---|
| Critical | Within 2 weeks | Immediate action, stop other work if needed |
| High | Within 1 quarter | Current sprint allocations |
| Medium | Within 6 months | Planned sprints |
| Low | Within 12 months | Background work, when there's capacity |
Action plan structure
For each recommendation, document:
## Recommendation R-XX: [Title]
**Priority**: Critical / High / Medium / Low
**Originating finding**: Item X.Y from Section Z
**Priority Score**: [calc]
**Action**: [What specifically needs to be done]
**Owner**: [Role + named person]
**Target date**: YYYY-MM-DD
**Dependencies**: [Other recommendations or external factors]
**Effort estimate**: [hours / days / weeks]
**Resources needed**: [people, budget, tools]
**Success criteria**: [How to verify it's done correctly]
**Risks**: [What could go wrong with the implementation]An example complete action plan section
# Action Plan
## Critical (must be addressed by 2026-06-15)
### R-001: Implement Standard Contractual Clauses
**Priority Score**: 25 (Catastrophic × Certain)
**Action**: Sign SCCs with OpenAI and Pinecone. Update the privacy policy.
**Owner**: Legal Counsel (Sarah) + DPO consult
**Target**: 2026-05-31 (takes priority over routine work)
**Effort**: 1 week (legal review + signing)
**Resources**: Legal Counsel; the OpenAI legal contact
**Success**: SCCs on file, the privacy policy updated, evidenced in the compliance
folder
**Risks**: OpenAI's legal response time; mitigated by initiating ASAP
### R-002: Update the DPIA for the current system state
**Priority Score**: 20 (Critical × Likely)
**Action**: Refresh the DPIA covering the current capabilities, processors, and risks
**Owner**: Tech Lead + DPO
**Target**: 2026-06-15
**Effort**: 1 week
**Dependencies**: None
**Success**: A DPIA dated and signed within the last 30 days
## High (must be addressed by 2026-Q3)
### R-003: Production bias monitoring
**Priority Score**: 12 (High × Possible × meaningful cost)
**Action**: Implement segmented metrics + dashboards + alerts
**Owner**: ML Engineer (Maria) + DevOps
**Target**: 2026-07-15 (2 sprints)
**Effort**: 15-20 hours
**Success**: The dashboard shows per-group metrics; the alerts fire correctly
in simulation; 2 weeks of validation data collected
### R-004: Bias audit refresh (all protected attributes)
**Priority Score**: 12
**Action**: Run a comprehensive bias audit covering all 4 protected attributes
**Owner**: ML Engineer (Maria)
**Target**: 2026-05-25 (2 weeks)
**Dependencies**: None
**Effort**: 8-10 hours
**Success**: An audit report covering gender, age, language, role; all
DPRs computed; gaps identified
**Risks**: Discovering critical bias gaps that require further mitigation work
### R-005: Implement retention enforcement
**Priority Score**: 12
**Action**: Add TTL on the records; a scheduled deletion job
**Owner**: Backend Engineer
**Target**: 2026-07-31
**Effort**: 2-3 weeks
**Success**: Old records are auto-deleted; the logs verify it
### R-006: Document the data subject rights processes
**Priority Score**: 12
**Action**: Formalize and operationalize all 6 GDPR rights
**Owner**: Tech Lead + DPO + Customer Success
**Target**: End of 2026-Q3
**Effort**: 3-4 weeks
**Success**: An SOP for each right; admin tooling; the team trained
## Medium (within 6 months)
[A similar structure for the medium items]
## Low (within 12 months)
[A similar structure]Communicating the priorities
Different stakeholders need different views:
To the engineering team (full detail)
- All the recommendations with effort estimates
- Dependencies mapped
- A sprint planning view
To the CTO (a priority summary)
- A categorized list (Critical/High/Medium/Low)
- A status overview
- The resource asks
To the CEO (an executive summary)
- "We found 4 critical, 6 high, 8 medium, and 2 low issues"
- "$X of budget is needed for the critical/high items"
- "The top 3 risks if we don't act: [list]"
To the Board (a one-pager)
- "An AI Ethics Audit was conducted; the findings are under management"
- "The critical findings will be remediated by [date]"
- "Next audit: [date]"
Common traps
Trap 1 — Every recommendation is High priority. "It's all important" → meaningless. Force yourself to distinguish.
Trap 2 — Ignoring Cost-to-fix. Critical issues with a $1M cost may get deprioritized vs. a Medium one with a $1K cost. Quick wins are valid prioritization.
Trap 3 — Recommendations with no owners. "We should fix this" → who? With no owner, nothing happens.
Trap 4 — No success criteria. "Fixed" — but how do we verify it? Each recommendation needs a measurable completion criterion.
Trap 5 — No tracking after the audit. You list the recommendations, archive the report. 6 months later, nothing is done. Track to closure.
Exercise
For your Capstone:
- Take all your findings from M8-03 through M8-05
- Apply the priority framework (Severity × Likelihood × Cost)
- Categorize them into Critical / High / Medium / Low
- Build the complete Action Plan section
- Schedule the first progress review (e.g., 1 month from now)
Summary
You learned:
- ✅ The priority framework: Severity × Likelihood × Cost
- ✅ Categorization (Critical/High/Medium/Low) with SLAs
- ✅ The action plan template (Recommendation, Owner, Target, Effort, Success)
- ✅ The stakeholder communication levels
- ✅ The traps: all-high priority, no owners, no tracking
Checkpoint: if your recommendations are prioritized, owned, and scheduled, you're set.
Next capsule
07 — Dual-audience reporting. How to produce reports that serve both technical and executive audiences.
Resources
- Risk Management Frameworks — ISO 31000.
- Atlassian — Risk & Issue Management.
- PMI Risk Management Process — the methodology.