career bridge

One assessment, done properly

Start from who gets hurt, not from a checklist, and record every absence of evidence as a finding.

You have an inventory ranked by consequence. Assessing all of it would take a year you do not have and would be shallow everywhere. Take the top entry and do that one properly instead, because a single real assessment teaches more, and persuades more, than twenty thin ones.

What you do

Assess the top system against harm rather than against a checklist. Start by naming who could be hurt and how, concretely: this person is refused, delayed, overcharged, wrongly flagged. Vague harms produce vague controls. For each one, ask what evidence exists today that it is not happening, and write none when that is the answer, because the gap is the finding. Look for the failure modes generic checklists miss. Does it behave differently for groups it sees less often, and has anyone measured that rather than assumed it? What happens when the input is unusual? Can the person affected discover that a decision was automated, and contest it? Who can override it, and is that route real or theoretical? Then gather evidence you can actually obtain. Sample real outputs rather than reasoning about them. Read the logs, and record it as a finding if there are none. Ask the vendor direct questions in writing and keep the answers, including the non-answers, because a vendor who will not answer in writing is itself evidence. Write it so a regulator, an executive and the owning engineer can each read it unaided.

Done when

  • Concrete harms are named with the person who bears each, not abstract risk categories.
  • Every claim that a harm is controlled points to evidence, and every absence is recorded as a gap.
  • Real outputs have been sampled rather than reasoned about.
  • Vendor questions were asked in writing, with the answers and the non-answers kept.
  • A regulator, an executive and an engineer can each read it without a translator.

What you end up with

One completed assessment of a real system: named harms, evidence where it exists, gaps stated plainly, and the vendor correspondence attached.

If you get stuck

The most common failure is completing a checklist and mistaking it for an assessment. A checklist tells you only what somebody else thought to ask. Start from who gets hurt and work backwards. The second failure is softening the gaps because the owning team will read it. The gaps are the entire value of the document, and a governance report that reads comfortably has usually stopped being one.