- Assessment
- Assignment 5
- Title
- AI Governance and Risk Management Plan
- Weight
- 15%
- Primary module
- Module 5
- Relevant units
- Units 14–17
- Core lens
- Governance and risk
- Target length
- 3,000–3,800 words
- Submission
- End of Module 5
Your task
Prepare an operational AI Governance and Risk Management Plan for one approved, bounded use case. The
plan must establish decision rights, lifecycle controls, evidence, monitoring, incident response,
contestability, remedy, adaptive safeguards, and stop authority.
Required conclusion: Recommend go, conditional go, redesign, defer,
non-AI alternative, or stop, supported by inherent and residual risk.
Use-case selection and boundaries
Suitable
- One organizational or professional AI-supported workflow
- Identifiable lifecycle, decisions, owners, users, and affected non-users
- Material risk, governance, monitoring, or remedy questions
- Sufficient authoritative evidence and realistic alternatives
- Public, synthetic, supplied, or authorized information
Unsuitable
- Live deployment, procurement, enforcement, or external action
- Confidential or identifying operational records
- Real security testing or incident investigation
- A plan requiring authority you do not possess
- A topic too broad to assign controls and owners
Required deliverables
Assignment 5 plan components
| Section |
Required content |
| Executive summary |
Use case, risk classification, principal controls, recommendation, conditions, and
residual risk |
| Governance brief |
Purpose, scope, lifecycle, system boundary, stakeholders, affected non-users, authority,
alternatives, assumptions, and exclusions |
| Risk assessment |
Risk factors, harms, likelihood, severity, reversibility, distribution, inherent risk,
risk appetite, prohibited uses, and evidence gaps |
| Governance and responsibility model |
Decision rights, ownership, approval gates, segregation of duties, qualified review,
PARTNER roles, escalation, and stop authority |
| Control and evidence register |
Preventive, detective, corrective, and recovery controls; owners; evidence; frequency;
dependencies; and residual risk |
| Monitoring and assurance plan |
Indicators, thresholds, baselines, review cadence, testing, audits, documentation,
drift, revalidation, and reporting |
| Incident, contestability, and remedy plan |
Reporting, triage, containment, notification, investigation, correction, appeal,
redress, remedy, rollback, suspension, and retirement |
| Implementation and adaptive safeguards |
Roadmap, resources, training, vendor dependencies, material-change triggers, fallback,
and qualified recommendation |
| Disclosure and references |
AI-use record and verified references |
Required governance method
- Distinguish policy, standard, procedure, control, evidence, and assurance.
- Separate inherent risk from residual risk after controls.
- Identify control owners and independent reviewers where appropriate.
- Define observable indicators and decision thresholds, not only aspirations.
- Include affected-person reporting, challenge, correction, and remedy pathways.
- Address vendor, model, data, integration, scale, law, policy, and context changes.
- Explain fallback, rollback, suspension, retirement, and stopping.
Framework selection
Lifecycle and governance
DOMAIN and GOVERN
Risk and responsibility
PARTNER, FAIRER, PROTECT, CREATE, and relevant disciplinary frameworks
Change and human accountability
FUTURES and HUMAN
Select only material frameworks and apply the exact course definitions. Frameworks must lead to
operational responsibilities, controls, evidence, and decisions.
Length and format
Target length: 3,000–3,800 words. Title page, references, captions, approved appendices, and disclosure
are excluded. Submit one DOCX or accessible PDF unless Moodle states otherwise.
- Use semantic headings, page numbers, labelled tables, and consistent citations.
- Provide text alternatives for lifecycle, governance, responsibility, and incident diagrams.
- Name the file
LastName_FirstName_COMP327_Assignment5.
Evidence, authorship, and boundaries
- Use peer-reviewed research, official standards, policies, regulatory guidance, professional
requirements, and technical documentation.
- Evaluate authority, currency, jurisdiction, scope, independence, method, and relevance.
- Verify generated references and vendor claims against original sources.
- You must author the risk analysis, control design, governance reasoning, and recommendation.
- Do not fabricate audits, incidents, testing, consultation, approvals, legal interpretations, or
evidence.
- Do not upload protected information or perform live organizational actions.
- Disclose the system, purpose, prompts, information, outputs, verification, corrections, human
decisions, and material incorporated.
Assignment resources
Official Moodle due date and time: ____________________