Question 690
Following a proposed change in a cross-team productivity initiative at Dunhill Commerce, the business transformation team reports that it addressed the following need under an upcoming readiness review: A pilot uses internal employee communications without checking collection purpose or permitted use. Which observation provides the STRONGEST evidence that the change worked?
Explanation
Correct Answer
A privacy assessment documents approved purposes, retention, and any required consents. This is the direct observable test of the intended response: Verify lawful basis, consent where applicable, notices, and access permissions for intended data use. In the context of Dunhill Commerce's a cross-team productivity initiative, it checks an actual outcome instead of treating completion of a project ticket or an untested assertion as evidence.
Incorrect Answers
An incident exercise identifies a real owner and documented correction path. This would instead validate the different situation: An AI initiative has no named party responsible when the output harms a customer. It would ordinarily follow the action: Assign accountable ownership for model selection, monitoring, decisions, and remediation. It does not establish that Dunhill Commerce solved the need specified in this scenario; the relevant check is: A privacy assessment documents approved purposes, retention, and any required consents.
A sample review reconstructs the sources and responsible approver for each recommendation. This would instead validate the different situation: A lending team cannot explain what evidence informed an AI recommendation to reviewers. It would ordinarily follow the action: Maintain traceable input evidence, explainable decision support, and accountable human review. It does not establish that Dunhill Commerce solved the need specified in this scenario; the relevant check is: A privacy assessment documents approved purposes, retention, and any required consents.
Privacy testing confirms unnecessary direct identifiers are absent from the workflow. This would instead validate the different situation: A marketing assistant ingests customer contact details that are not needed to generate a generic campaign. It would ordinarily follow the action: Use data minimization and appropriate anonymization or pseudonymization before model processing. It does not establish that Dunhill Commerce solved the need specified in this scenario; the relevant check is: A privacy assessment documents approved purposes, retention, and any required consents.