Módulo 8: Proyecto Integrador — Ethics Audit of an AI System

Dual-audience reporting

Siguiente →

Descripción

Un Ethics Audit Report que solo entienden engineers tiene utilidad limitada. CEOs, board members, regulators no van a leer 25 pages de technical detail. Por eso producís dual-audience versions: technical (deep detail) + executive (decision-oriented summary).

Esta habilidad de comunicar a different audiences es parte del valor profesional del audit.

Al terminar vas a poder:

  • Producir executive summary effective (1-page)
  • Adaptar technical detail for ejecutive audiences
  • Crear presentation deck para verbal communication
  • Anticipate common stakeholder questions

Executive Summary: el 1-page document

El 1-page summary debe contener:

# AI Ethics Audit — Executive Summary
**System**: AI-Powered Knowledge Assistant v1.5
**Date**: 2026-05-11
**Auditor**: Tech Lead

## Bottom Line

The system is **operationally compliant** with most ethical and
regulatory requirements but has **2 critical gaps requiring immediate
attention** and several improvement areas.

## Status at a Glance

| Area | Status |
|------|--------|
| Bias and fairness | ⚠️ Partial — audit overdue, monitoring gaps |
| Privacy and data protection | ⚠️ Partial — retention enforcement missing |
| Transparency | ✅ Good — citations and AI disclosure clear |
| EU AI Act compliance | ✅ Compliant — limited risk classification |
| GDPR compliance | ❌ Gaps — SCCs missing, formal processes needed |
| Documentation | ⚠️ Behind schedule |

## Key Findings

**Critical (must address within 30 days)**:
1. International data transfer safeguards (SCCs) not signed
   → Risk: GDPR violation, up to 4% revenue fine
2. DPIA outdated; needs refresh
   → Risk: regulatory non-compliance

**High Priority (this quarter)**:
1. Production bias monitoring not implemented
   → Risk: undetected drift over time
2. Comprehensive bias audit overdue for all protected attributes
3. Data subject rights processes need formalization
4. Retention policy not enforced automatically

**Medium (next 6 months)**:
- Auxiliary decision explanations
- Documentation update cadence
- Mitigation effectiveness verification

## Recommended Actions

| Action | Cost | Timeline | Owner |
|--------|------|----------|-------|
| Sign SCCs with processors | Low | 2 weeks | Legal |
| Refresh DPIA | Low | 4 weeks | Tech Lead + DPO |
| Implement production bias monitoring | Medium | 6 weeks | ML Engineering |
| Refresh comprehensive bias audit | Low | 2 weeks | ML Engineering |
| Formalize data subject rights processes | Medium | 4 weeks | Customer Success |
| Implement retention enforcement | Medium | 3 weeks | Backend Engineering |

**Total estimated effort**: ~16 person-weeks engineering + 2 weeks legal
**Total estimated cost**: $40K-60K (engineering time + legal review)
**Recommended budget allocation**: Q2-Q3 2026

## Risk if not addressed

If critical items not resolved within 30 days:
- Potential GDPR fine: significant fraction of annual revenue
- Reputational damage
- Customer trust impact (clients beginning to ask compliance questions)

## Decision required

**Approval requested**: Allocate engineering resources Q2-Q3 2026 to
remediate Critical and High priority items per action plan.

## Next Audit
Scheduled: 2026-11-11 (6 months)

Adaptation: technical vs executive

Same finding, two ways:

Technical version (Section 8.3 of report)

### Item 5.4: International transfers — GAP

**Current state**: Data processed by OpenAI (US) and Pinecone (US).
SCCs not signed; or signed but not on file.

**Required state**: SCCs (or other safeguards) signed and documented
for all extra-EU processors.

**Gap**: Documentation of safeguards missing.

[detailed evidence, code paths, etc.]

**Recommendation**:
1. Verify SCCs status
2. Sign with both providers
3. File in compliance folder
4. Update privacy policy

**Priority**: CRITICAL
**Owner**: Legal Counsel + DPO
**Effort**: 1-2 weeks

Executive version (1-page)

Critical Finding: International data transfers
- Data sent to US-based OpenAI/Pinecone
- GDPR safeguards (SCCs) not formally documented
- Risk: GDPR violation = up to 4% revenue fine
- Fix: Sign documents (1-2 weeks, legal team)
- Status: Action plan approved by Legal

Difference:

  • Strip technical detail
  • Quantify business impact
  • Action and timeline only

Common stakeholder questions y how to answer

Q1: "Are we legally at risk?"

Answer template: "Specific to [GDPR / EU AI Act / other]: [Yes/No]. We have [X items requiring attention] which carry [type] risk. Mitigation timeline: [date]."

Don't: "Yes but it's complicated."

Q2: "What's the cost of remediation?"

Answer: "Engineering effort: X weeks. Legal: Y weeks. Tools/services: $Z. Total budget ask: $W."

Don't: "We need more time to scope."

Q3: "What happens if we delay?"

Answer: Quantified risk per critical item:

  • "Delay SCCs 90 days → potential €N fine if investigated"
  • "Delay bias audit 90 days → undetected drift; if discovered later, mitigation more expensive"

Don't: "It would be bad."

Q4: "Are we worse than competitors?"

Answer: Honest. "Based on public disclosures from comparable companies, we are at parity in [areas], ahead in [areas], behind in [areas]."

Don't: Speculate without data.

Q5: "When was the last audit?"

Answer: "Last audit: [date]. Next: [date]. Cadence: [frequency]."

Don't: "This is our first audit." (if true, OK; mention recommitting to cadence)

Presentation: structure of verbal communication

If presenting to leadership:

15-minute version

1. Bottom line (2 min)
   - Overall status
   - 2 critical items

2. Findings summary (5 min)
   - Visual: status by area
   - Critical findings explained
   - High priority findings mentioned

3. Action plan (5 min)
   - Top 5 recommendations
   - Timeline and resources
   - Decision needed

4. Q&A (3 min)

Slide design principles

  • One key idea per slide
  • Visual hierarchy: most important info biggest
  • Color coding: red for critical, yellow for important, green for OK
  • No walls of text: max 5 bullets, brief
  • Speak to it, don't read it

What NOT to include in executive version

  • Code snippets (use line counts instead)
  • Detailed evidence trail (move to appendix)
  • Methodology details (one paragraph max)
  • Item-by-item walkthrough (impossible in 1 page)
  • Technical jargon (use plain language)

Cuándo external audit makes sense

Sometimes internal audit isn't enough. External audit valuable when:

  • Required by RFP or contract
  • Internal team lacks expertise in specific area
  • Need independent verification for stakeholders
  • Pre-investment due diligence
  • Pre-acquisition (M&A)

Cost: external audit $10K-100K+ depending on scope.

When NOT needed:

  • Early stage, no external requirement
  • Internal team has expertise
  • Routine ongoing compliance

Trampas comunes

Trampa 1 — Single document for all audiences. 25-page technical doc to CEO. CEO doesn't read. Fix: produce both.

Trampa 2 — Burying critical findings. Critical issue in Section 8, page 18. Should be front page. Executive summary surface critical first.

Trampa 3 — Sin actionable asks. Report describes problems but no clear "decision needed". Stakeholders unclear next step.

Trampa 4 — Hiding behind metrics. "Our DPR is 0.92." Means nothing to executive. Translate: "We've tested for bias and results are acceptable for [area X] but concerning for [area Y]."

Trampa 5 — Defensive posture. "We did our best; some things could be better." Underwhelming. Be honest about gaps + confident about path forward.

Ejercicio

For your audit report:

  1. Draft 1-page executive summary
  2. Translate 3 critical findings to executive language
  3. Prepare 5-slide deck (or outline) for 15-min presentation
  4. Anticipate 3 likely questions + your answers

Resumen

Aprendiste:

  • ✅ Executive summary structure (1-page)
  • ✅ Technical → executive translation
  • ✅ Common stakeholder questions + answer templates
  • ✅ Presentation structure for verbal communication
  • ✅ What NOT to include in executive version
  • ✅ When external audit valuable
  • ✅ Trampas: single document, burying critical, defensive

Checkpoint: if executive can read 1-page and make informed decision, listo.

Siguiente cápsula

08 — Proyecto: Ethics Audit Report completo. El final final deliverable: integrating all cápsulas en el report definitivo.

Recursos

  1. Edward Tufte — Data presentations — clear visual communication.
  2. HBR — Executive communication — articles on communicating to leadership.
  3. Slide:ology by Nancy Duarte — presentation design.
← AnteriorRecommendations y prioritizationSiguiente →Proyecto: Ethics Audit Report completo