How the plan is evaluated
High achievement requires operational governance, not generic principles. Risks must connect to controls, controls to owners and evidence, monitoring to thresholds, incidents to response and remedy, and residual risk to the final recommendation.
Criteria and weighting
| Criterion | Points | Focus |
|---|---|---|
| Use case, purpose, scope, lifecycle, and alternatives | 10 | Boundaries, legitimate purpose, system lifecycle, people, information, assumptions, exclusions, and non-AI options |
| Stakeholders, authority, and governance model | 15 | Affected people, decision rights, ownership, approval, segregation of duties, qualified review, escalation, and stopping |
| Risk identification and classification | 15 | Harms, likelihood, severity, reversibility, distribution, inherent risk, appetite, prohibited uses, and evidence gaps |
| Control and evidence register | 15 | Preventive, detective, corrective, and recovery controls; owners; evidence; frequency; dependencies; and residual risk |
| Monitoring, assurance, and revalidation | 15 | Indicators, baselines, thresholds, cadence, tests, audits, drift, documentation, reporting, and material change |
| Incidents, contestability, correction, and remedy | 15 | Reporting, triage, containment, notification, investigation, challenge, correction, redress, remedy, rollback, suspension, and retirement |
| Implementation, adaptive safeguards, and recommendation | 10 | Roadmap, resources, training, vendor dependencies, fallback, conditions, residual risk, and qualified conclusion |
| Communication, accessibility, citations, authorship, and disclosure | 5 | Clarity, organization, source integrity, accessible presentation, student authorship, and accurate disclosure |
| Total | 100 |
Performance levels
| Level | Descriptor |
|---|---|
| Excellent, 85–100% | Operational, precise, evidence-rich, risk-based, auditable, adaptive, and convincingly accountable. |
| Proficient, 70–84% | Complete and well reasoned, with effective risk classification, controls, monitoring, incidents, remedy, and recommendation; minor gaps remain. |
| Developing, 55–69% | Meets many requirements, but risk, authority, controls, evidence, thresholds, remedy, or adaptation is uneven. |
| Limited, 40–54% | Primarily aspirational, generic, or incomplete; controls lack owners or evidence and the recommendation is weakly connected to residual risk. |
| Insufficient, below 40% | Does not demonstrate an operational governance plan, or serious evidence, information-handling, or authorship concerns prevent assessment. |
Assessment guidance
Indicators of excellent work
- Governance roles have real decision and stop authority.
- Inherent and residual risk are clearly distinguished.
- Controls specify owners, evidence, frequency, dependencies, and failure responses.
- Monitoring uses observable indicators and thresholds.
- Affected people can report, challenge, obtain correction, and receive remedy.
- Material changes trigger revalidation, rollback, suspension, or retirement.
Common reasons for deductions
- Governance principles without operational procedures
- Risk lists without classification or prioritization
- Controls without owners or evidence
- Monitoring without baselines or thresholds
- Incident response without contestability or remedy
- No non-AI alternative, fallback, or stop authority
- Unverified citations, inaccessible records, or incomplete disclosure
Grade calculation
The rubric score is converted to the assignment's 15% course weight.
Example: 80/100 contributes 12 percentage points to the course grade.