COMP 3270 / Assignment 5

AI Governance and Risk Management Plan · 15% · Module 5

Assignment 5

Develop an operational governance and risk plan for one bounded AI-supported use case, including controls, monitoring, incidents, remedy, adaptation, and stop authority.

Assessment
Assignment 5
Title
AI Governance and Risk Management Plan
Weight
15%
Primary module
Module 5
Relevant units
Units 14–17
Core lens
Governance and risk
Target length
3,000–3,800 words
Submission
End of Module 5

Assignment overview

Develop an AI Governance and Risk Management Plan for one bounded organizational or professional use case. Translate responsible AI principles into decision rights, controls, evidence requirements, monitoring, incident response, contestability, remedy, change management, and stopping.

Governance principle: A policy statement is not an operational control. Effective governance identifies who acts, what evidence is required, when review occurs, how failure is detected, and who can correct, suspend, or stop the system.

Risk-based

Classify inherent and residual risk using purpose, people, information, capability, scale, and consequence.

Operational

Connect controls to owners, evidence, thresholds, review cycles, incidents, and remedies.

Adaptive

Define material-change triggers, revalidation, rollback, suspension, retirement, and stop authority.

What the plan should demonstrate

  1. Define the use case, purpose, scope, system boundary, decision, and alternatives.
  2. Identify stakeholders, affected non-users, information subjects, risk bearers, and accountable authorities.
  3. Map the lifecycle from proposal and procurement through use, monitoring, incidents, and retirement.
  4. Classify inherent risk and explain risk appetite and prohibited uses.
  5. Design preventive, detective, corrective, and recovery controls.
  6. Assign decision, review, approval, escalation, correction, remedy, and stop authority.
  7. Specify evidence, documentation, records, auditability, and traceability.
  8. Design monitoring indicators, thresholds, review cadence, and revalidation.
  9. Provide incident response, notification, contestability, correction, redress, and remedy.
  10. Address vendor, model, data, integration, legal, policy, and contextual changes.
  11. Compare governance options and identify implementation dependencies.
  12. State residual risk and make a qualified go, conditional-go, redesign, defer, or stop recommendation.

Required plan components

1. Governance brief

Purpose, scope, lifecycle, stakeholders, authority, alternatives, assumptions, and exclusions.

2. Risk classification

Inherent risk, risk factors, prohibited uses, risk appetite, evidence, and residual risk method.

3. Control framework

Preventive, detective, corrective, and recovery controls with owners and evidence.

4. Oversight and monitoring

Approval gates, documentation, indicators, thresholds, audits, review cadence, and revalidation.

5. Incidents and remedy

Detection, containment, notification, investigation, correction, contestability, redress, and stopping.

6. Implementation recommendation

Roadmap, dependencies, responsibilities, adaptive safeguards, residual risk, and conclusion.

Recommended process

  1. Scope
    Purpose, lifecycle, people, information, alternatives, constraints, and authority.
  2. Assess
    Inherent risk, failure modes, affected groups, evidence gaps, and prohibited uses.
  3. Control
    Owners, gates, safeguards, monitoring, incidents, remedy, and stopping.
  4. Adapt
    Implementation, material change, revalidation, residual risk, and recommendation.

Assignment 5 resources

Official Moodle due date and time: ____________________

InstructionsGrading rubricSubmission page
👤