Módulo 8: Proyecto Integrador — Ethics Audit of an AI System
Recommendations y prioritization
Descripción
Findings identificaron gaps. Recommendations prescriben action. Sin priorization, todas las recommendations parecen iguales y ninguna se implementa.
Esta cápsula te enseña cómo priorizar systematically y crear action plans realistic que stakeholders actually execute.
Al terminar vas a poder:
- Priorizar recommendations con framework consistent (Severity × Likelihood × Cost-to-fix)
- Categorizar en Critical / High / Medium / Low con SLAs
- Construir action plan con owners, timelines, dependencies
- Comunicar priorities a stakeholders effectivamente
El framework de priorización
Three dimensions:
Dimension 1: Severity (impacto si no se arregla)
| Severity | Description |
|---|---|
| 5 — Catastrophic | Legal liability, license to operate at risk, major user harm |
| 4 — Critical | Significant compliance/reputational risk, user trust damage |
| 3 — High | Moderate risk, may affect specific users |
| 2 — Medium | Limited impact, mitigations exist |
| 1 — Low | Minor inconvenience, cosmetic |
Dimension 2: Likelihood (probability el problema materialice)
| Likelihood | Description |
|---|---|
| 5 — Certain | Will happen soon if not fixed |
| 4 — Likely | High probability |
| 3 — Possible | Moderate probability |
| 2 — Unlikely | Low probability |
| 1 — Rare | Very low but possible |
Dimension 3: Cost-to-fix (effort needed)
| Cost | Description |
|---|---|
| 5 — Trivial | < 1 day work |
| 4 — Small | 1-5 days |
| 3 — Medium | 1-2 weeks |
| 2 — Large | 3-6 weeks |
| 1 — Major | > 6 weeks |
The priority score
Priority Score = Severity × Likelihood
Quick win = Score × Cost (higher = better quick win)
Categorize:
- Critical: Score ≥ 20 (anything Severity 5)
- High: Score 12-19
- Medium: Score 6-11
- Low: Score < 6
Examples
Example 1: International transfers safeguards (SCCs)
- Severity: 5 (Catastrophic) — GDPR violation, up to 4% revenue fine
- Likelihood: 5 (Certain) — already non-compliant
- Cost: 5 (Trivial) — sign documents
- Priority Score: 25 → CRITICAL
- Quick win: 25 × 5 = 125 → Top priority
Example 2: Production bias monitoring
- Severity: 3 (High) — bias could go undetected
- Likelihood: 3 (Possible) — drift can happen
- Cost: 3 (Medium) — 2 weeks engineering
- Priority Score: 9 → MEDIUM (close to HIGH)
- Wait — but Severity could be Critical depending on use case. Adjust.
Example 3: CEO sign-off on AI policy
- Severity: 1 (Low) — administrative
- Likelihood: 1 — won't cause problems directly
- Cost: 5 (Trivial) — 1 hour
- Priority Score: 1 → LOW but Quick win = 5 → do it quickly anyway
Categorización con SLAs
Define SLAs por priority:
| Priority | SLA (target resolution) | Approach |
|---|---|---|
| Critical | Within 2 weeks | Immediate action, stop other work if needed |
| High | Within 1 quarter | Current sprint allocations |
| Medium | Within 6 months | Planned sprints |
| Low | Within 12 months | Background work, when capacity |
Action plan structure
For each recommendation, document:
## Recommendation R-XX: [Title]
**Priority**: Critical / High / Medium / Low
**Originating finding**: Item X.Y from Section Z
**Priority Score**: [calc]
**Action**: [What needs to be done specifically]
**Owner**: [Role + named person]
**Target date**: YYYY-MM-DD
**Dependencies**: [Other recommendations or external factors]
**Effort estimate**: [hours / days / weeks]
**Resources needed**: [people, budget, tools]
**Success criteria**: [How to verify it's done correctly]
**Risks**: [What could go wrong with implementation]Example complete action plan section
# Action Plan
## Critical (must address by 2026-06-15)
### R-001: Implement Standard Contractual Clauses
**Priority Score**: 25 (Catastrophic × Certain)
**Action**: Sign SCCs with OpenAI and Pinecone. Update privacy policy.
**Owner**: Legal Counsel (Sarah) + DPO consult
**Target**: 2026-05-31 (priority over routine work)
**Effort**: 1 week (legal review + sign)
**Resources**: Legal Counsel; OpenAI legal contact
**Success**: SCCs filed, privacy policy updated, evidenced in compliance
folder
**Risks**: OpenAI legal response time; mitigation by initiating ASAP
### R-002: Update DPIA for current system state
**Priority Score**: 20 (Critical × Likely)
**Action**: Refresh DPIA covering current capabilities, processors, risks
**Owner**: Tech Lead + DPO
**Target**: 2026-06-15
**Effort**: 1 week
**Dependencies**: None
**Success**: DPIA dated and signed within last 30 days
## High (must address by 2026-Q3)
### R-003: Production bias monitoring
**Priority Score**: 12 (High × Possible × meaningful cost)
**Action**: Implement segmented metrics + dashboards + alerts
**Owner**: ML Engineer (Maria) + DevOps
**Target**: 2026-07-15 (2 sprints)
**Effort**: 15-20 hours
**Success**: Dashboard shows per-group metrics; alerts fire correctly
in simulation; 2 weeks of validation data collected
### R-004: Bias audit refresh (all protected attrs)
**Priority Score**: 12
**Action**: Run comprehensive bias audit covering all 4 protected attrs
**Owner**: ML Engineer (Maria)
**Target**: 2026-05-25 (2 weeks)
**Dependencies**: None
**Effort**: 8-10 hours
**Success**: Audit report covering gender, age, language, role; all
DPRs computed; gaps identified
**Risks**: Discovering critical bias gaps requiring further mitigation work
### R-005: Implement retention enforcement
**Priority Score**: 12
**Action**: Add TTL on records; scheduled deletion job
**Owner**: Backend Engineer
**Target**: 2026-07-31
**Effort**: 2-3 weeks
**Success**: Old records auto-deleted; logs verify
### R-006: Document data subject rights processes
**Priority Score**: 12
**Action**: Formalize and operationalize all 6 GDPR rights
**Owner**: Tech Lead + DPO + Customer Success
**Target**: 2026-Q3 end
**Effort**: 3-4 weeks
**Success**: SOP for each right; admin tooling; team trained
## Medium (within 6 months)
[Similar structure for medium items]
## Low (within 12 months)
[Similar structure]Communicating priorities
Different stakeholders need different views:
To engineering team (full detail)
- All recommendations with effort estimates
- Dependencies mapped
- Sprint planning view
To CTO (priority summary)
- Categorized list (Critical/High/Medium/Low)
- Status overview
- Resource asks
To CEO (executive summary)
- "We found 4 critical, 6 high, 8 medium, 2 low issues"
- "$X budget needed for critical/high items"
- "Top 3 risks if we don't act: [list]"
To Board (one-pager)
- "AI Ethics Audit conducted; findings under management"
- "Critical findings remediated by [date]"
- "Next audit: [date]"
Trampas comunes
Trampa 1 — All recommendations High priority. "It's all important" → meaningless. Force yourself to distinguish.
Trampa 2 — Ignoring Cost-to-fix. Critical issues with $1M cost may be deprioritized vs Medium with $1K. Quick wins valid prioritization.
Trampa 3 — Recommendations without owners. "Should fix this" → who? Without owner, nothing happens.
Trampa 4 — Sin success criteria. "Fixed" — but how do we verify? Each recommendation needs measurable completion criterion.
Trampa 5 — No tracking after audit. List recommendations, archive report. 6 months later, nothing done. Track to closure.
Ejercicio
Para tu Capstone:
- Take all your findings from M8-03 a M8-05
- Apply priority framework (Severity × Likelihood × Cost)
- Categorize en Critical / High / Medium / Low
- Build complete Action Plan section
- Schedule first review of progress (e.g., 1 month from now)
Resumen
Aprendiste:
- ✅ Priority framework: Severity × Likelihood × Cost
- ✅ Categorization (Critical/High/Medium/Low) con SLAs
- ✅ Action plan template (Recommendation, Owner, Target, Effort, Success)
- ✅ Stakeholder communication levels
- ✅ Trampas: all-high priority, no owners, no tracking
Checkpoint: si tus recommendations son prioritized, owned, scheduled, listo.
Siguiente cápsula
07 — Dual-audience reporting. Cómo producir reports que sirven both technical y executive audiences.
Recursos
- Risk Management Frameworks — ISO 31000.
- Atlassian — Risk & Issue Management.
- PMI Risk Management Process — methodology.