Independent educational case study · Not affiliated with Rite Aid
AI Governance & Risk Management
Rite Aid Historical Facial Recognition Case Study
An independent portfolio demonstrating how an organization could assess AI risks, establish governance controls, evaluate third-party technology, create human oversight mechanisms, and implement responsible AI monitoring.
The business challenge
Publicly documented history
In December 2023 the U.S. Federal Trade Commission announced that Rite Aid was banned from using AI facial recognition, following its use of the technology in stores.
FTC press releaseGovernance questions analyzed (proposed)
- · Risk assessment
- · Privacy
- · Accuracy and bias
- · Human oversight
- · Third-party responsibility
- · Incident response
Recommendations are my proposed educational analysis, not findings from an internal audit.
Proposed Governance Model
A proposed lifecycle, not a deployed program.
- 1AI Inventory
- 2Risk Assessment
- 3Approval and Oversight
- 4Control Design
- 5Monitoring
- 6Incident Response
- 7Governance Review
Nine deliverables
Each card opens its folder on GitHub in a new tab.
- 01AI Governance Gap AssessmentIdentifies governance gaps raised by the public case.
- 02AI Risk RegisterIllustrative register of AI risks and owners.
- 03Governance CharterProposed oversight structure and accountability.
- 04AI Inventory and IntakeProcess for cataloguing and intaking AI use cases.
- 05AI Risk Assessment and ScoringIllustrative risk prioritization and treatment design.
- 06Third-Party AI Vendor ReviewStructured due diligence for AI vendors.
- 07Controls and Human OversightProposed controls, testing and oversight criteria.
- 08Monitoring and Incident ResponseProposed monitoring and escalation process.
- 09Governance Implementation RoadmapStaged governance adoption plan and tracker.
Featured work
AI Risk Scoring Workbook
Risk prioritization and treatment design.
AI Vendor Assessment Workbook
Third-party due diligence.
AI Controls Testing Matrix
Testing design and oversight evidence criteria.
AI Monitoring and Incident Tracker
Monitoring, escalation and incident handling.
Implementation Roadmap
Staged program planning.
Educational models with illustrative data; no measured outcomes are claimed.
Methodology
- 01 Study the historical public case
- 02 Identify governance gaps
- 03 Assess illustrative AI risks
- 04 Design proposed controls and oversight
- 05 Define monitoring and response
- 06 Develop an implementation roadmap
Limitations
- · All artifacts are independently created educational work.
- · Not affiliated with Rite Aid; no internal audit was conducted.
- · No live Rite Aid systems were accessed or tested; no private information used.
- · No proposed controls were implemented or independently validated.
- · No compliance certification or control effectiveness is claimed.