In preparation for class please read thru the ChatGPT-generated hypo below and begin to consider how you would analyze the "learnings" and what you would tackle in what order:

Hypo: “The Aurora Governance Breakdown”

Background
NovaGen Solutions is a global pharmaceutical and medical device company undergoing an “AI-first transformation.” Its central system, Aurora, is a generative AI model licensed from an external vendor and fine-tuned using NovaGen’s proprietary clinical trial data, quality records, and limited patient information.

Aurora is now embedded in multiple operations, including R&D, quality documentation, and sales support. The Board’s Risk Committee receives high-level dashboards referencing “AI initiatives,” but has not reviewed any detailed governance plans, risk controls, or validation reports.

Triggering Events

1. R&D System Failure and Business Interruption

Aurora generates a draft clinical trial protocol with dosage levels above FDA safety limits.

• The flawed protocol automatically overwrites a validated prior version in NovaGen’s trial-management system.

• The system lacks a manual override. IT cannot immediately reverse the changes.

• R&D loses two weeks of work until the previous protocol is reconstructed manually.

2. Vendor Data Misuse

Internal audit discovers that the AI vendor used NovaGen’s training data to improve its general model, contrary to contract restrictions.

• NovaGen fears that terminating the contract will halt key R&D functions because Aurora has no backup system.

• Vendor lock-in and lack of contingency planning prevent immediate mitigation.

3. Off-Label Messaging Generated by AI

A regional sales VP deploys an Aurora-based “physician outreach generator” without approval.

• Aurora produces emails implying off-label benefits of an oncology drug.

• Sales reps are concerned but cannot identify any internal channel for reporting AI misuse.

• Believing the internal hotline is not intended for AI issues, a rep submits a complaint directly to an external consumer watchdog organization.

4. Public Exposure and Rapid Escalation

The watchdog posts a public report titled “NovaGen’s AI Is Generating Illegal Drug Claims.”

• A tech blogger amplifies the story, and it spreads rapidly.

• NovaGen’s stock drops 9%.

• The FDA requests information about Aurora’s role in clinical protocols and communications.

• Employees express fear that Aurora may be “controlling” systems and refuse to use it.

5. Board-Level Oversight Issues

The Board is caught off guard by the crisis.

• The Risk Committee relied solely on high-level dashboards and did not request details about AI risks, data governance, or controls.

• The Board never reviewed an AI governance framework, validation process, or risk-appetite statement.

• Several Board members express concern that Aurora was “mission-critical” to regulated operations without adequate controls or monitoring.

Assignment

You are the Chief Integrity and Compliance Officer and are part of a cross-functional team brought in after the crisis breaks. Prepare:

1. A root-cause assessment of NovaGen’s failures. Where are the gaps in risk management and controls in this scenario?

2. Create a 90-day and 12-month remediation roadmap to stabilize and govern AI use across NovaGen.