ETEEAP | LIVING IN THE IT ERA

Digital Transformation
& Governance Portfolio

From workplace judgment to accountable enterprise leadership

Prepared for: Metchel Oberleitner
Academic context: BSBA - Marketing Management / ETEEAP
Institution: Liceo De Cagayan University / ETEEAP
Prepared: 5 November 2026

An integrated academic case study of cloud information architecture, process automation, cybersecurity readiness, and responsible artificial intelligence in a Philippine recruitment enterprise.

Status: academically developed working draft

The enterprise, operating baselines, financial amounts, and proposed policies in this dossier are illustrative. They do not describe verified operations any other actual business. The biography is a two-page reflection draft requiring personal verification; it is not a record of established employment achievements.

The module artifacts below are newly developed case-study drafts. Academic equivalency remains subject to institutional assessment.

Central proposition

Digital transformation creates sustainable value when faster operations are accompanied by lawful data use, resilient systems, accountable decisions, and demonstrable workforce capability.

READER GUIDE

Structure, scope, and evidence

The case assumes a small Philippine recruitment service that manages applicant records, employer requests, interviews, and placement documentation. Overseas transactions are a scenario, not proof of licensing or legal authority to recruit. Destination-country employment, immigration, and privacy duties require separate assessment before implementation.

Evidence labels distinguish source-based principles, proposed enterprise controls, illustrative calculations, and personal evidence pending. Unless expressly attributed to a law or publication, operational thresholds are recommendations designed for this case.

SECTION I | EXECUTIVE SUMMARY

A business case for governed transformation

Recruitment is an information-intensive service: its quality depends on the accuracy, timeliness, and legitimate use of records about people. Fragmented spreadsheets, uncontrolled attachments, and informal approvals can appear efficient while concealing duplicated work, excessive access, and inconsistent decisions. The strategic problem is therefore broader than software adoption. It concerns the relationship between organizational growth and the institution’s ability to explain, protect, and correct its decisions.

The proposed transformation establishes a controlled applicant and employer information environment before introducing automation. A central system of record, role-based access, supervised integrations, recoverable backups, and documented data ownership create the foundation. Rules-based workflow automation then handles document-completeness checks and task routing. Generative AI is restricted to low-consequence drafting and approved knowledge assistance; consequential employment judgments remain with accountable people.

The financial study estimates an initial automation investment of PHP 240,000 and annual operating expenditure of PHP 96,000. At an illustrative 600 transactions per month, a reduction from 20 to 8 minutes per transaction releases 120 staff hours monthly. Valued at PHP 250 per hour, this represents PHP 360,000 of annual capacity, not guaranteed cash savings. Under full realization, three-year net economic benefit is PHP 552,000 and simple ROI is 104.5%. At 50% realization, ROI falls to 2.3%, revealing the importance of adoption and actual redeployment.

The wider roadmap proposes a PHP 2.50 million base envelope and PHP 250,000 contingency over 36 months. This includes the automation project rather than adding it twice. Year 1 establishes control and pilots the workflow; Year 2 scales proven processes; Year 3 strengthens resilience and permits carefully bounded AI assistance. Each stage has an evidence-based release gate.

The academic contribution is the integration of technical feasibility, financial reasoning, civic responsibility, and reflective leadership. Workplace experience becomes assessable when a candidate identifies a problem, explains the decision taken, produces authentic evidence, evaluates outcomes, and acknowledges limitations. Length of service alone is insufficient to demonstrate the intended competence.

SECTION I | BIOGRAPHY DRAFT - PAGE 1 OF 2

Professional identity and learning through work

My professional development has been shaped by the practical judgment I exercised as a Personal Care Assistant in a private household in Austria from 2019 to 2023. I coordinated appointments with doctors and therapists, maintained medical records, and monitored follow-up care across services. My responsibility was to organize the day-to-day arrangements that helped the person I supported follow the care plan. Doctors and therapists determined the treatment. Within my role, I exercised judgment about how to arrange appointments, which records to prepare, and which follow-up items still needed attention. These decisions affected the person receiving care, whose daily routine depended on the arrangements, and the professionals involved in each visit. I could assess the quality of my work through concrete questions. Were the relevant records available when needed? Did I know which follow-up was due and whom to contact about it? An appointment confirmation showed that I had arranged a visit, while confirming what happened afterward required a separate follow-up. Learning to make that distinction strengthened my understanding of accountability. As a future marketing management professional, I can apply the same judgment when several colleagues share responsibility for a client request and the client is relying on me to explain what happens next.

Between 2019 and 2023, I worked as a Personal Care Assistant for a private household in Austria. A recurring challenge was keeping follow-up care on track when the person I supported received care from several doctors and therapists. Arranging an appointment was only part of the work. I also had to keep the medical records accurate and track what still needed attention after each consultation. My contribution was to coordinate appointments, organize the documents, and monitor follow-up across services. The doctors and therapists made the clinical decisions. I supported continuity by keeping track of the practical steps between visits. This experience taught me to distinguish between scheduling a task and knowing that it has been completed. I carry that lesson into business management, where a commitment to a client also requires follow-through.

The significance of this experience extends beyond successful task completion. It offers an opportunity to examine how I interpreted incomplete information, consulted others, and selected a defensible course of action. A decision that appeared effective in the short term may have created hidden costs through undocumented work, dependency on one employee, or inadequate controls. Academic reflection requires me to examine these consequences rather than presenting every workplace event as an uncomplicated success.

Information technology provides a useful lens for this analysis. In the recruitment case used in this portfolio, digital records connect applicants, employers, operational staff, and management. In my own industry, I should identify the equivalent changes I have directly observed: [verified transition in records, communication, service delivery, or reporting]. The reflection should explain how the change altered responsibility and skill requirements, supported by dated examples rather than general claims about technological progress.

The learning claim I would advance is therefore conditional and testable: I can translate an operational problem into a reasoned improvement proposal, explain its effects on stakeholders, and defend the evidence supporting it. This claim should be assessed through the attached work products, supervisor validation, and oral explanation. It should not depend solely on the number of years I have worked.

SECTION I | BIOGRAPHY DRAFT - PAGE 2 OF 2

From practical experience to critical competence

During my work as an Administrative Assistant and Office Coordinator in Austria from 2018 to 2019, my responsibilities included customer relations and data management. The following is a draft based on those duties.

One challenge was deciding what to tell a customer who wanted an update while I was still checking the status of their request. At first, I assumed that a prompt answer would reassure the customer. When I reviewed the office record, I realized that it confirmed we had received the request, but the next step was still open. I had treated receipt as a sign of progress. From the customer’s perspective, my answer could sound like a commitment and influence their plans. I revised my approach by explaining what the record confirmed, identifying the detail I still needed to check, and agreeing on when I would follow up. I could take responsibility for that follow-up while leaving the underlying decision with the colleague authorized to make it. The experience changed how I understood customer trust. I had focused on how quickly I could reply. I learned to consider what the customer could reasonably conclude from my words and whether I had enough information to support that conclusion.

In reviewing that episode, I would distinguish technical ability from governance responsibility. Knowing how to use a digital tool does not necessarily mean knowing whether information should be collected, who should receive it, or how long it should be retained. Likewise, a faster process is not automatically a better process if it makes errors harder to detect or removes meaningful human review. My evidence should show how I have addressed these questions in practice, or identify them honestly as areas of learning that this portfolio develops.

Leadership also means recognizing who will carry the cost of a decision. As a Personal Care Assistant in a private household in Austria from 2019 to 2023, I coordinated appointments with doctors and therapists and monitored follow-up care. My CV documents those responsibilities, but I have no documented example showing whose views I sought about a proposed change or how their feedback influenced my decision. In a future recruitment role, I would apply that lesson before moving applicant document submissions to an online portal. A portal might save the office time while shifting the work of scanning, uploading, and correcting files to applicants or to employees helping them after hours. Before adopting it, I would invite applicants to try a sample submission on their own phones and ask recruitment staff to record, during paid working time, where assistance was needed. If applicants struggled to upload documents or staff repeatedly had to complete the process for them, I would recommend keeping an assisted submission option and assigning paid time to provide it. I would then tell participants which part of the proposal changed because of their feedback.

My continuing development plan is to strengthen three connected capabilities: interpreting business information, evaluating digital risk, and communicating decisions transparently. For each capability, I will identify a practical assessment. These may include reconciling a process dashboard to source records, explaining a privacy impact assessment, or leading a simulated incident exercise. A training certificate can support participation, but competence requires evidence that I can apply the learning to an unfamiliar problem.

The ETEEAP process offers a disciplined way to connect experience with academic expectations. I understand equivalency as a judgment about demonstrated learning, not automatic recognition of employment duration. The final version of this narrative should therefore connect each claim to an authentic artifact and acknowledge unresolved gaps. It should also explain how the academic concepts in this portfolio have changed the way I would approach future decisions.

My intended professional direction is to advance in strategic business leadership, specializing in Marketing Management, digital transformation, and responsible innovation. I aim to integrate professional experience, academic knowledge, and emerging technologies to drive organizational growth, operational excellence, and global competitiveness. Through continuous learning, ethical leadership, and entrepreneurship, I aspire to create sustainable business opportunities, empower people, and contribute meaningful value to organizations and society. The contribution of this capstone is to connect that goal with a model of leadership that treats efficiency, security, fairness, and accountability as mutually dependent responsibilities. Its value will be demonstrated when the proposed controls can be explained, implemented, evaluated, and improved in a real workplace.

SECTION I | COMPETENCY MATRIX

Evidence-based academic equivalency

CHED Memorandum Order No. 20, series of 2013, provides general education outcomes across intellectual, personal and civic, and practical domains. The matrix below is a proposed interpretation for this capstone, not a verbatim list of nationally prescribed “Living in the IT Era” outcomes. The institution’s approved syllabus and assessor rubric must establish the final course mapping (Commission on Higher Education [CHED], 2013).

SECTION II | MODULE 1 ARTIFACT

Enterprise information architecture

The assumed current state distributes applicant details across email, spreadsheets, messaging, and individual devices. This is a case assumption requiring validation through staff interviews and a data inventory. The proposed design establishes one applicant record identifier, one accountable process owner, and one approved location for each record class. It avoids copying full identity documents into every workflow.

Applicants submit only stage-appropriate information through a secured intake channel. Recruiters review the record in the applicant tracking system (ATS); document files remain in a restricted repository linked by record identifier. Employer-facing staff receive a minimized profile rather than unrestricted repository access. Finance receives the reference and approved transaction fields needed for its work. Aggregated dashboards exclude direct identifiers wherever practicable.

The cloud service model does not remove organizational responsibility. The proposed supplier boundary covers hosting and provider-managed platform operations; the enterprise boundary covers authorized users, device access, sharing settings, data classification, lawful purpose, and retention decisions. Actual responsibilities depend on the chosen service and contract. A signed responsibility matrix must precede migration.

Information flows are recorded as intake → review → controlled sharing → placement or closure → retention review → deletion or justified hold. A transfer log records the recipient, purpose, fields shared, authorization, and delivery channel. Changes to data fields, vendors, or recipients trigger a fresh risk review. Analytics must be traceable to source definitions so that managers do not confuse applicants, applications, transactions, and successful placements.

SECTION II | MODULE 1 ARTIFACT

Privacy framework and compliance plan

The Data Privacy Act establishes transparency, legitimate purpose, and proportionality as governing principles. The enterprise must identify an appropriate lawful basis for each activity; consent is not a universal substitute for analysis. Sensitive personal information requires separate consideration under Section 13. Accountability for transferred or outsourced data remains significant under the Act (Republic Act No. 10173, 2012, secs. 11-14, 21).

For this case, the DPO maintains a processing register listing purpose, fields, data subjects, access roles, recipients, storage locations, retention rule, and justification. Recruitment intake is separated from optional talent-pool reuse. Health or identification records are deferred until justified by the relevant stage and applicable requirements. No fixed statutory retention period is invented: the legal and process owners must approve a documented schedule for each category.

The following controls are proposed implementation measures. Their presence does not by itself certify compliance. Evidence must show both that the design is appropriate and that staff follow it in daily work.

SECTION II | SYNTHESIS REFLECTION

Cloud scalability and accountable privacy

The illustrative enterprise is analyzed as a proposed design, not an audited organization.

Cloud computing changes the economics of recruitment by allowing an enterprise to expand storage, collaboration, and application processing without purchasing physical infrastructure. Yet scalability also multiplies the consequences of weak governance. An incorrectly shared folder can expose records across locations within minutes. The strategic issue is therefore not whether cloud services are inherently trustworthy, but whether the enterprise can demonstrate appropriate control over the information, identities, and decisions that it places within them. In this case study, convenience must be evaluated together with accountability, service continuity, and the rights of applicants whose opportunities depend on accurate handling of information.

The proposed enterprise should begin with purpose limitation rather than product selection. Its recruitment platform requires enough information to evaluate and administer applications, but it does not need unrestricted copies of every document at every stage. Collecting sensitive records prematurely increases exposure without necessarily improving service. The Data Privacy Act establishes principles of transparency, legitimate purpose, and proportionality (Republic Act No. 10173, 2012). Translating these principles into practice requires documented decisions about required fields, authorized recipients, and retention. A privacy notice supports transparency, but it cannot compensate for excessive collection or an operating process that disregards the stated purposes of processing.

Cloud outsourcing also creates a tension between operational delegation and continuing organizational responsibility. A supplier may manage infrastructure, but the enterprise still determines many consequential settings and practices. Employees decide whom to invite, what to download, and whether to create informal duplicates. The proposed response is a responsibility matrix supported by contract review, access testing, and evidence of recovery. Management should evaluate the supplier’s capabilities, while independently testing its own configuration. This approach avoids treating a vendor certificate as proof that organizational use is compliant. It also makes responsibility visible when a failure involves both platform behavior and employee decisions.

Strict compliance can become counterproductive if implemented as disconnected paperwork. Staff facing excessive approval delays may return to personal messaging and uncontrolled spreadsheets. Effective governance must therefore make the authorized route practical: clear permissions, accessible support, manageable forms, and rapid escalation for exceptions. Leaders should investigate why shadow systems emerge rather than attributing every deviation to individual misconduct. At the same time, convenience cannot justify uncontrolled access. Regular reviews, immediate offboarding, and proportionate monitoring help reconcile usability with protection. Their value should be assessed through observed behavior and tested outcomes, not solely through policy publication or completed training attendance sheets.

Ultimately, the balance between scalability and compliance depends on whether governance evolves with the business. Each new integration, overseas recipient, or automated decision can change the risk profile. The enterprise should therefore reassess processing before material changes, monitor control performance, and maintain incident response arrangements. Success means that expansion improves service without making applicants less informed or less protected. My critical conclusion is that privacy is a design discipline and leadership responsibility, not a final administrative checkpoint. Cloud investment becomes defensible when management can explain its purposes, demonstrate its controls, and correct failures transparently while preserving the dignity of individuals.

SECTION III | MODULE 2 ARTIFACT

Automation feasibility and investment logic

The recommended pilot automates document-completeness checks, duplicate task prevention, reminders, and routing to a recruiter. It does not determine applicant suitability, certify document authenticity, or make placement decisions. These boundaries keep the initial project focused on repetitive coordination and create a measurable comparison between current and future work.

The baseline is an illustrative 600 administrative transactions monthly at 20 minutes each. A transaction is a document-handling event, not a unique applicant or successful placement. The proposed future process requires 8 minutes of human effort, including routine review and an allowance for exceptions. A four-week time study must replace these assumptions before procurement. Logs should capture normal cases and difficult cases, avoiding an artificially favorable sample.

Three options were considered. Improving the manual checklist has low implementation cost and should begin immediately, but does not remove repeated data entry. Workflow automation using supported integrations provides structured routing and auditability. Screen-based RPA can bridge an unavoidable legacy interface but is more sensitive to interface changes. Generative AI introduces unnecessary uncertainty for deterministic completeness checks. IoT has no clear connection to this particular administrative problem.

The recommended approach is therefore a supported workflow integration, with RPA limited to a validated legacy step if no reliable interface exists. Feasibility depends on stable data fields, service permissions, available testing facilities, and an operational owner for exceptions. The pilot uses synthetic or properly authorized test data and runs in parallel with manual processing until release criteria are met.

Proposed release criteria are at least 98% agreement with a reviewed completeness checklist, no unauthorized disclosures during testing, an exception queue that meets the agreed service target, and a successful rollback exercise. These are internal acceptance targets rather than external standards. A failed criterion leads to correction and retesting; it does not justify redefining errors as acceptable simply to protect the investment.

SECTION III | PROCESS REDESIGN

Before and after: retain human accountability

Figure 1. Proposed administrative workflow. Both paths retain the recruiter’s authority to advance an application. An incomplete record returns to the applicant through a controlled request; a conflicting or unreadable record goes to the exception queue. The illustration summarizes routing and is not executable system logic.

Controls at the decision points

Every intake receives a unique event identifier. A repeated event must not create a second task or send duplicate messages. Failed transfers enter a queue with an owner and timestamp. A reviewer can override a completeness result only with a recorded reason. No rule may infer qualifications, authenticity, or eligibility from the mere presence of a file.

If the workflow fails, staff use the controlled manual queue and reconcile all pending events after restoration. The process owner checks for missing records, duplicate reminders, and incorrectly closed cases before declaring recovery complete. The proposed time saving must include this reconciliation work when failures occur.

SECTION III | FINANCIAL AND OPERATIONAL IMPACT

ROI, payback, and the value of capacity

All amounts are illustrative Philippine pesos (PHP), expressed without inflation, discounting, or tax effects. They support feasibility screening, not a supplier quotation or an approved budget. The initial PHP 240,000 comprises implementation (120,000), integration and testing (60,000), training (30,000), and project contingency (30,000). Annual operating cost is PHP 96,000.

Hours released: 600 × (20 - 8) ÷ 60 = 120 per month.
Annual capacity value: 120 × PHP 250 × 12 = PHP 360,000.
Annual net economic benefit: 360,000 - 96,000 = PHP 264,000.
Three-year cost: 240,000 + (96,000 × 3) = PHP 528,000.
Three-year simple ROI: (1,080,000 - 528,000) ÷ 528,000 = 104.5%.
Steady-state payback: 240,000 ÷ (264,000 ÷ 12) = 10.9 months.

Payback begins from full-benefit operation in this simplified calculation. If benefits reach only 50% in Year 1 and 100% in Years 2 and 3, total benefit becomes PHP 900,000, ROI becomes 70.5%, and payback occurs around month 19.1 from project start under even monthly realization and full annual operating costs. Actual project timing must replace that assumption.

The three-year break-even realization is 528,000 ÷ 1,080,000 = 48.9%. Capacity becomes cash savings only if overtime, hiring, or other actual expenditure falls. If staff simply have more available time, report service capacity and quality improvements separately. Do not add speculative placement revenue or avoided breach losses to this model without independent evidence.

SECTION III | CHANGE MANAGEMENT

Redesigning work without losing expertise

Automation changes the distribution of attention within the enterprise. Staff who previously copied records may spend more time resolving exceptions, explaining requirements, or checking unusual cases. This is not a minor administrative adjustment: it changes what competent performance looks like. Training must therefore address judgment and escalation as well as software operation.

The pilot begins with a joint workshop involving recruiters, administrative staff, the DPO, IT support, and an employee representative. Participants map hidden work, including calls made to clarify incomplete records and informal checks that prevent mistakes. This work must either be preserved explicitly or replaced by a tested control. Removing an activity from a diagram does not remove the need that created it.

Management should explain how released time will be used and how performance will be evaluated. The proposed pilot does not assume workforce reductions. Staff receive protected practice time and a channel to report unsafe or burdensome behavior without being penalized for slowing the rollout. Adoption is measured through correct use and resolution quality, not simply the number of logins.

A weekly review compares processing time, rework, complaints, and exception backlog with the baseline. If throughput improves while error correction rises, the business case is reconsidered. The process owner signs the benefit report; finance validates actual cost changes. The DPO can stop a workflow that exposes information outside approved boundaries.

SECTION IV | MODULE 3 ARTIFACT

Cybersecurity risk register

The proposed incident program connects business risk to preparation, detection, response, and recovery. NIST CSF 2.0 provides a useful outcome framework, including the Govern function; the controls below are the case enterprise’s design choices rather than controls mandated by NIST (National Institute of Standards and Technology [NIST], 2024).

Likelihood and impact use a proposed five-point scale. A score of 1 represents rare likelihood or limited impact; 5 represents frequent exposure or severe operational and individual harm. Their product ranks attention, but any credible threat to highly sensitive records can be escalated regardless of score. Ratings are illustrative and are highly hypothetical.

Residual scores are targets, not measured results. Risk acceptance requires a named executive, the remaining exposure, compensating controls, and an expiry date. “Zero incidents” is not a sufficient performance indicator because weak detection can also produce a low incident count.

SECTION IV | GOVERNANCE ASSESSMENT

CSIRT authority and incident severity

The Computer Security Incident Response Team (CSIRT) is a standing set of responsibilities, not necessarily a separate department. A small enterprise may combine roles, but technical recovery should receive independent review before closure. Named primary and alternate contacts must be maintained in a controlled contact register and accessible during a cloud outage.

These internal targets do not replace legal notification triggers or deadlines. Reclassify whenever new evidence changes impact, scope, or urgency. Keep a written rationale for severity changes.

SECTION IV | INCIDENT RESPONSE PLAN

First 24 hours, notification, and recovery

Detect and establish command. Open an incident record with discovery time, reporter, affected systems, and known facts. Use a trusted communication channel if corporate accounts may be compromised. The commander appoints technical, privacy, and evidence leads and starts an action log. Treat early conclusions as provisional.

Contain while preserving evidence. Disable compromised accounts, revoke sessions and tokens, block malicious access, and isolate affected devices where appropriate. Preserve relevant logs before their retention windows expire. Do not wipe devices or delete suspicious material as a routine first step. Record why urgent containment may have altered evidence. A trained responder determines whether volatile information should be captured before shutdown.

Assess harm and legal duties. Determine which records were accessible, whether there is evidence of acquisition, and which people may be affected. Under the NPC framework, mandatory notification depends on the applicable conditions, including qualifying information, unauthorized acquisition, and real risk of serious harm. The relevant 72-hour period runs from knowledge or reasonable belief of a notifiable breach, not from completion of a forensic report (National Privacy Commission [NPC], 2016; NPC, n.d.).

Communicate and coordinate. The DPO documents the notification assessment and prepares notices based on available verified information. Counsel advises on contact with competent authorities and preservation requests where suspected cybercrime arises. RA 10175 addresses cybercrime and enforcement; it is not the source of the general NPC 72-hour privacy notification rule (Republic Act No. 10175, 2012).

Eradicate and restore. Remove unauthorized access, correct the root cause, reset affected secrets, and restore from a verified clean state. Reconcile pending transactions before reopening integrations. Proposed targets are an eight-hour recovery time and a 24-hour recovery point for core records; these require business approval and successful testing. They are not statements of current capability.

Learn and close. Within ten business days after stabilization, conduct a review covering root causes, control failures, individual harm, response delays, and recurring risks. Assign corrective owners and due dates. Closure requires technical validation, business acceptance, and a DPO review of remaining obligations. Maintain a separate record of unresolved actions rather than declaring the whole matter complete prematurely.

SECTION IV | EVIDENCE MANAGEMENT

Chain of custody and defensible records

The Rules on Electronic Evidence address matters including authentication, integrity, and evidentiary weight. The published 2001 text identifies civil, quasi-judicial, and administrative proceedings in its scope. The enterprise should not assume that citing this document alone resolves requirements in every criminal proceeding; counsel must confirm the applicable rules and subsequent authorities for the specific case (Supreme Court of the Philippines, 2001).

The proposed protocol supports trustworthy handling without promising admissibility. An authorized collector records the source, acquisition method, tool version, date, time zone, and any limitations. Where technically appropriate, the collector computes a cryptographic hash such as SHA-256 and records it in the evidence log. A matching hash helps demonstrate byte consistency; it does not by itself prove authorship, truth, lawful acquisition, or complete provenance.

Original evidence is preserved in restricted storage. Analysis uses verified working copies. Each handover records the sender, recipient, time, purpose, storage destination, and integrity check. Cloud exports retain available metadata and an explanation of the export method. Screenshots may supplement the record but should not replace original logs or messages when those can lawfully be preserved.

Legal holds suspend ordinary deletion for specified records and have a responsible owner. Access to evidence is logged and limited. Personal information irrelevant to the investigation is minimized in working reports. The evidence custodian escalates missing metadata or a broken custody trail; gaps must be described rather than silently reconstructed.

SECTION V | MODULE 4 ARTIFACT

Responsible AI and digital citizenship charter

This proposed charter applies to employees, contractors, and managers using AI for enterprise work. Its purpose is to preserve human accountability, protect information, and ensure that apparent fluency does not substitute for evidence. It becomes an organizational policy only after approval, role assignment, communication, and implementation testing.

Permitted use. Approved tools may assist with drafting non-sensitive communications, organizing public information, and searching an authorized knowledge base. A named employee checks the output before external use. The employee remains responsible for its accuracy, relevance, tone, and lawful disclosure.

Restricted use. Applicant scoring, ranking, eligibility assessment, and recommendations that materially influence employment require a documented impact assessment and leadership approval. During the initial roadmap, automated rejection and unsupervised placement decisions are prohibited as an internal policy choice. Human review must be meaningful: the reviewer needs evidence, time, competence, and authority to disagree.

Data and intellectual property. Staff must not submit applicant documents, confidential business information, or third-party copyrighted materials to unapproved services. Approved use requires an appropriate basis to process the data, contractual review, and checks on retention, onward use, and training settings. Employees document source permissions and licenses; AI output is not assumed to be original, copyright-free, or safe to publish.

Transparency and correction. Material AI assistance is disclosed where it affects understanding or accountability. Applicants can seek human clarification and correction of relevant errors. Staff report misleading output, suspected disclosure, or discriminatory behavior through the incident channel. The enterprise maintains a register of AI tools, owners, use cases, versions, evaluation results, and retirement decisions.

NIST AI RMF 1.0 organizes AI risk work around Govern, Map, Measure, and Manage. This portfolio applies that structure as a voluntary analytical aid; it does not treat it as Philippine law or certification (NIST, 2023). Policy approval should include a review date and a change trigger for new models, data sources, or decision uses.

SECTION V | ETHICAL AUDIT

Bias, unequal impact, and intellectual property

A recruitment model can reproduce historical preference even when protected characteristics are excluded from direct input. Location, school, language, employment gaps, and writing style may operate as proxies. A professional-looking output can conceal that relationship and encourage reviewers to accept it. The audit must therefore examine the complete decision process, including the conduct of human reviewers.

A proposed evaluation uses a documented sample representing the tasks and applicants for which the tool is intended. Reviewers first establish a defensible task-specific reference assessment. The audit compares error patterns and adverse outcomes across lawfully evaluated groups, records uncertainty, and investigates plausible explanations. Sensitive attributes should not be collected casually for testing; the DPO must assess necessity and appropriate protection.

Group selection rates or error rates are signals for investigation, not proof of fairness or unlawful discrimination on their own. Small samples, overlapping disadvantages, inconsistent labels, and unequal access to application support can distort results. A tool may improve average performance while worsening outcomes for a smaller group. The release decision therefore combines quantitative findings, qualitative review, and a documented right to challenge the outcome.

Audit ownership: compliance and the business owner jointly sign the evaluation; an independent reviewer checks high-consequence uses. Repeat testing after material changes and documented incidents. Passing an initial test does not justify indefinite use without monitoring.

SECTION V | INFORMATION INTEGRITY

SIFT as a managerial verification practice

SIFT asks users to Stop, Investigate the source, Find better coverage, and Trace claims, quotations, and media to their original context (Caulfield, 2020). Its value in this enterprise is to interrupt the movement from plausible content to consequential action. It complements specialist review and does not turn a non-expert into a legal, immigration, or technical authority.

Consider a hypothetical AI-generated statement that an overseas employer has obtained authorization to recruit a particular occupation. The operations team must not convert that statement directly into an advertisement. A plausible employer name, official-looking logo, or repeated online claim is insufficient. The verification record should identify the underlying authority, document date, relevant conditions, and whether the information applies to this specific transaction.

The enterprise’s proposed procedure requires a verification log for claims affecting applicant decisions, fees, placement conditions, compliance, or public reputation. The log contains the claim, source, primary evidence, reviewer, date, limitations, and decision. When verification fails, staff withhold or qualify the claim rather than filling the gap with confidence. Corrections are linked to the original communication so that the audience can understand what changed.

Information integrity is also a citizenship responsibility. Employees should protect private identities, avoid demeaning stereotypes, and distinguish personal opinions from authorized enterprise statements. The organization should correct misinformation without exposing applicants or staff to unnecessary public attention.

SECTION VI | ROADMAP 1 OF 6

Strategic alignment and transformation thesis

The three-year roadmap connects enterprise performance to four outcomes: dependable service, trustworthy information, operational resilience, and fair treatment. These outcomes must be pursued together. A platform that accelerates applications but increases erroneous disclosures fails the strategy, just as a highly restricted system that employees routinely bypass fails in practice.

Year 1 establishes control over identities, records, and process definitions. Year 2 scales the proven workflow and strengthens monitoring. Year 3 improves resilience and introduces limited AI assistance only where evidence supports its use. The schedule is relative to project authorization: Month 1 begins when the sponsor approves the charter and resources. It is not an assumed launch date for an existing company.

The roadmap treats governance as part of delivery. Each project has one accountable business owner, a technical implementation owner, a privacy review, an operational acceptance test, and a defined stop condition. A favorable business case does not override an unresolved critical security defect. Conversely, a control proposal must be examined for its usability and impact on legitimate service access.

These targets are proposed. Month 1-2 baseline work may justify revisions, but revisions must explain the evidence and business consequence. Targets should not be relaxed merely because an implementation has failed to meet them.

SECTION VI | ROADMAP 2 OF 6

A unified governance and assurance model

A Digital Governance Committee, chaired by the executive sponsor, meets monthly during implementation and quarterly after stabilization. It includes operations, finance, IT, the DPO, and a workforce representative; counsel participates when required. The committee approves priorities and risk decisions, while operational owners remain responsible for daily execution. The DPO retains access to leadership for unresolved privacy concerns.

The model brings privacy, cybercrime readiness, and AI ethics into a shared register without confusing their legal functions. Privacy review asks whether processing is justified and controlled. Security review asks how systems resist, detect, and recover from misuse. AI review asks whether assisted decisions are appropriate, explainable, contestable, and supported by evidence. A single project can fail more than one review.

One change request therefore includes purpose, affected people, data flow, access needs, supplier involvement, cost, security risks, decision consequences, and rollback arrangements. The committee records approval, conditions, accountable owners, and expiry dates. Material changes reopen the assessment. High-risk exceptions cannot become permanent through repeated informal extensions.

Assurance uses operating evidence: account reviews, sampled sharing records, restoration results, incident exercises, source verification, and complaints. A policy document is evidence of intent; it becomes evidence of control only when accompanied by credible implementation records. Reports should include failures and unresolved issues, not merely favorable completion percentages.

SECTION VI | ROADMAP 3 OF 6

Year 1: establish control and prove value

The first year addresses the foundational causes of uncontrolled information handling. Procurement should follow discovery rather than substitute for it. During Months 1-3, the enterprise inventories systems and processing, measures transaction volumes, identifies existing licenses, maps access, and records the risks of informal workarounds. The sponsor appoints accountable owners and confirms the boundaries of the pilot.

During Months 4-6, the team configures the approved repository and identity controls, prepares migration rules, and tests permissions using representative roles. Historical records are not copied indiscriminately. The records owner separates active information from material that should be deleted or held for a documented reason. A trial migration reconciles record counts and samples content accuracy.

Months 7-9 introduce the workflow pilot described in Section III. Staff work with the exception queue, compare outputs against the manual process, and test interruption and recovery. The pilot must demonstrate that time savings do not depend on dropping checks or transferring hidden work to applicants. The business owner validates both the calculation and the lived experience of affected staff.

Months 10-12 consolidate the operating model. The team performs a restore exercise and an incident tabletop, closes critical defects, and documents a benefit report. Expansion is authorized only if the process is stable, ownership is clear, and the organization can maintain the controls without relying on one specialist.

Dependency: automation may not enter production before approved access, data definitions, and exception ownership are in place. If the migration or recovery test fails, continue controlled manual operation and defer expansion.

SECTION VI | ROADMAP 4 OF 6

Years 2 and 3: scale, evaluate, and sustain

Year 2 expands only the processes that have demonstrated acceptable quality and cost. The team connects approved employer and finance workflows, consolidates dashboards, and improves monitoring of privileged access and unusual exports. Benefits are reviewed against actual volume and staffing decisions; a larger transaction count does not automatically justify a larger platform if error and support costs rise.

Year 3 focuses on resilience, supplier portability, and limited AI assistance. A knowledge assistant may retrieve approved internal procedures, but its sources, permissions, and output quality must be tested. It must not provide an unauthorized route into applicant documents. AI evaluation includes attempts to induce disclosure, misleading instructions embedded in retrieved content, and unsupported answers. Failed tests lead to restriction or withdrawal.

The organization also conducts an exit exercise: export representative records, verify readability, reconcile metadata, and demonstrate that a supplier change would not destroy essential access. Portability is an operational capability, not simply a contract clause. At Month 36, leadership approves the next strategy using observed performance and residual risk.

SECTION VI | ROADMAP 5 OF 6

Resource, infrastructure, and upskilling matrix

The proposed base budget is PHP 2.50 million over 36 months. A separate 10% program contingency brings the authorization ceiling to PHP 2.75 million. Values are planning allowances requiring quotations and finance review. The automation row includes the complete PHP 528,000 project model on page 12; it is not an additional investment. Program contingency is an unspent reserve, not an assumed expense.

Finance must separate incremental cash costs from internal staff time and confirm that vendor bundles are not charged again in another row. Training here excludes the automation-specific PHP 30,000 already included in its initial cost. Device availability, reliable connectivity, licensed access, exportable logs, and recoverable backups are prerequisites; any uncovered hardware need requires a revised estimate.

SECTION VI | ROADMAP 6 OF 6

Measurement, assurance, and strategic synthesis

The roadmap should be evaluated through a balanced evidence set. Faster processing is relevant only when records remain accurate, applicants receive understandable information, and recovery remains credible. Management should compare performance with a measured baseline and record changes in volume, complexity, staffing, and system scope that affect interpretation.

A monthly dashboard reports median handling time, exception age, sampled error rates, access-review completion, verified leaver revocation, restore performance, and unresolved high-risk findings. Each metric has a defined denominator and an owner. For example, leaver compliance means verified revocation for all people whose access should have ended during the period, not merely the percentage of tickets marked complete.

Benefits governance separates capacity, cash, and quality. Finance confirms avoided expenditure using records such as overtime or hiring plans. Operations confirms whether released hours improved service or reduced backlogs. Compliance monitors complaints and disclosure events. A benefit cannot be counted in two categories without explaining the relationship, and a reduced backlog cannot be attributed entirely to automation if staffing or demand also changed.

The central synthesis is that cloud computing, automation, cybersecurity, and AI ethics form one managerial system. Cloud architecture determines where information can move; automation determines how quickly action follows; cybersecurity determines how misuse is constrained and investigated; AI governance determines which judgments remain accountable and contestable. Weakness in one area can undo the value created by the others.

The roadmap therefore makes a conditional recommendation: authorize foundational work and a bounded pilot, then release later funding only when evidence supports expansion. This approach allows the enterprise to learn without committing prematurely to an unsuitable platform or a misleading benefit forecast. It also provides a defensible explanation to employees and applicants about why particular changes are introduced and what protections accompany them.

For the ETEEAP candidate, the learning outcome is the ability to defend this integrated reasoning. The final oral presentation should explain a tradeoff, reconstruct a calculation, respond to an incident scenario, and identify a limitation in the evidence. The strongest demonstration of leadership is not certainty about every answer, but disciplined judgment about what is known, what must be tested, and who is accountable for the next decision.

SUPPORTING EVIDENCE | SUBMISSION CONTROLS

Authenticity register and completion checklist

This dossier supplies academic analysis and proposed artifacts. It does not establish that the candidate performed the workplace actions described as evidence prompts.

REFERENCES | APA 7

Philippine education, privacy, and evidence

References are alphabetized across pages 28-29. Legal sources retain their act or rule identifiers for precise retrieval. URLs link to the issuing authority or a public legal repository.

Caulfield, M. (2020, February 27). Basic skills wrap-up. Sifting Through the Pandemic.
https://infodemic.blog/2020/02/27/basic-skills-wrap-up/

Commission on Higher Education. (2013). General education curriculum: Holistic understandings, intellectual and civic competencies (CHED Memorandum Order No. 20, series of 2013).
https://ched.gov.ph/wp-content/uploads/2017/10/CMO-No.20-s2013.pdf

National Institute of Standards and Technology. (2023). Artificial intelligence risk management framework (AI RMF 1.0) (NIST AI 100-1). https://doi.org/10.6028/NIST.AI.100-1

National Institute of Standards and Technology. (2024). The NIST cybersecurity framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29

National Privacy Commission. (n.d.). Breach reporting. Retrieved November 5, 2026, from https://privacy.gov.ph/pips-and-pics/breach-reporting/

National Privacy Commission. (2016). Personal data breach management (NPC Circular No. 16-03).
Official NPC Circular 16-03 PDF

Reference verification note

The CHED source was located in official search results, but direct PDF retrieval was unavailable during preparation. The matrix therefore uses general outcome domains and explicitly requires the institution’s approved course syllabus. No exact course-specific outcome wording is attributed to CHED.

REFERENCES | APA 7

Legal authorities and use of sources

Republic Act No. 10173, Data Privacy Act of 2012 (2012) (Phil.).
https://privacy.gov.ph/data-privacy-act/

Republic Act No. 10175, Cybercrime Prevention Act of 2012 (2012) (Phil.).
https://lawphil.net/statutes/repacts/ra2012/ra_10175_2012.html

Supreme Court of the Philippines. (2001). Rules on electronic evidence (A.M. No. 01-7-01-SC).
https://lawphil.net/courts/supreme/am/am_01-7-01_sc_2001.html

How the references support the analysis

CHED provides the general education framework for the provisional competency mapping. RA 10173 and NPC materials support the privacy principles and breach-notification distinction. RA 10175 supports the cybercrime context. The Rules on Electronic Evidence support the discussion of authentication and reliable handling, subject to the applicable proceeding and legal review.

NIST CSF 2.0 and AI RMF 1.0 supply voluntary organizing frameworks. The proposed roles, budgets, thresholds, test criteria, and schedule are original case-study recommendations; they are not represented as requirements prescribed by those publications. SIFT supplies a method for checking information before relying on it in enterprise decisions.

Scope and academic integrity

This portfolio is a design-based academic analysis. It contains no verified company audit, employee interview study, supplier quotation, completed implementation, or measured performance improvement. Financial and operational assumptions are deliberately visible so that they can be replaced and challenged. References should be rechecked before real deployment, especially where later issuances, court rulings, contractual duties, or foreign law may affect implementation.

A submission-ready version must preserve this distinction between evidence and proposal. Authentic workplace artifacts demonstrate prior learning; a well-reasoned case study demonstrates analytical competence. Both can contribute to assessment, but neither should be presented as the other.