| Organisation | Quillmarrow Supplies Pte. Ltd. (fictional) |
|---|
| Document | A5-3 · AI impact assessment AIA-03: CV screening and candidate ranking |
|---|
| Version | 1.0 |
|---|
| Date | 30 October 2026 (illustrative) |
|---|
| Prepared by | Alex Lew, reviewer and sign-off |
|---|
| Client approver (role) | Managing Director |
|---|
| Label | Fictional organisation, illustrative only, not a client case study |
|---|
1. Summary
| Item |
Assessment |
| AI use |
AI-04: CV screening and candidate ranking |
| Proposed vendor |
Fictional Talent Screen (V-03) |
| Use owner |
HR Manager |
| Working tier |
Tier 3 High |
| Current status |
On hold; recommended not to proceed in its current form |
| Proposal |
Parse CVs and rank applicants for warehouse, customer service and sales roles. HR wanted to automatically reject the bottom half. |
| People affected |
Job applicants and hiring managers |
| Proposed oversight |
No candidate screening or ranking until the hold is reconsidered and controls are approved. Any redesigned use should include human review of every application. |
| Evidence status |
Partial: AIA-03 is identified, but vendor due diligence, data details and assessment findings have not been supplied. |
| Recommendation |
Hold. Do not proceed in the current form. Revisit only if the redesign conditions in section 7 are met and the MD approves a revised High-tier use. |
| Assessment limitation |
The workflow and risks below are based on the proposal and the agreed register. Vendor claims and technical controls have not been evidenced or tested. |
The tier is a working category for Quillmarrow, not a statutory classification. This assessment does not establish that an applicant has been affected or that the proposed vendor has used any CVs.
2. The proposal as HR described it
HR described a service from Fictional Talent Screen that would parse CVs and rank candidates for warehouse, customer service and sales roles. HR wanted to use the ranking to automatically reject the bottom half of applicants. The precise ranking criteria, data flow, decision rules and intended connection to Quillmarrow's recruitment process have not been supplied.
The proposed automatic rejection is the decisive concern. A ranking would influence who receives further consideration, while an automatic rejection would remove the opportunity for a person to review every affected application before a decision. An apparently efficient process could therefore exclude a suitable candidate because of a parsing error, an unsuitable criterion or an unexplained score.
The proposal is on hold. The agreed register does not authorise an interim screening or ranking pilot. The MD's approval of a redesigned High-tier use would be needed before any reconsidered use begins.
3. Who is affected and what data may be involved
Job applicants are directly affected because the service would process information they submit and could influence whether they progress. A mistaken or unexplained rejection could affect an applicant's opportunity to be considered.
Hiring managers would receive or rely on parsed information or rankings. They could overlook qualified applicants if they treat the vendor's output as complete or objective. The HR Manager would need to oversee the process, respond to questions and retain appropriate recruitment records.
CVs may contain names, contact information, education and employment history. They may also contain NRIC numbers, age or date of birth, nationality, photographs and employment gaps. These categories are possible, not a confirmed inventory of data supplied to V-03. The proposed inputs, any additional information collected, storage locations and retention periods remain unconfirmed.
Quillmarrow should not provide live CVs to establish how the service works. The review and any initial design discussion should use descriptions and made-up or de-identified samples only.
4. What could go wrong
The risks are potential outcomes, not findings that V-03 has caused them. Their likelihood and severity cannot be reliably assessed until the missing evidence is obtained.
| Risk |
How it could arise |
Possible consequence or required question |
| Unfair outcomes |
Ranking criteria or proxy characteristics may disadvantage applicants because of characteristics such as age, nationality or other personal attributes. Employment gaps or educational history could also act as unsuitable proxies. |
Suitable applicants may be screened out. Obtain role-relevant criteria and evidence of fairness testing; a vendor assertion alone is insufficient. |
| Unexplainable ranking |
The vendor may not be able to explain the factors behind a ranking or identify an error in parsed information. |
HR may be unable to challenge an output or explain its role in a decision. |
| Excess personal data |
Applicants may include NRIC numbers, photographs or other information not needed for an initial review. |
Unnecessary information could be exposed or influence the process. Define and minimise the fields used. |
| Applicants not informed |
Recruitment notices may not describe the proposed processing or the vendor's role. |
Applicants may not understand how their information is used. Review the proposed notice and confirm legal requirements with a Singapore-qualified lawyer. |
| No human review before rejection |
The bottom half of a ranked list could be rejected automatically. |
An individual may be excluded without a person examining the application or correcting an error. This proposal should not proceed. |
| CVs used for vendor model training |
Vendor terms or settings might allow submitted CVs to be used beyond the agreed recruitment service. |
Applicants' information could be used for an additional purpose. V-03 said data may be used to improve the service, subject to settings, but supplied no definition or setting (A8 Q01). |
| Data held outside Singapore |
The vendor or a subprocessor may store, access or process information in another country. |
Quillmarrow would need to assess the transfer arrangements and safeguards. V-03 said only that data is hosted in "a regional cloud environment" and named no subprocessors (A8 Q06, Q07). |
| Unable to answer an applicant's request |
The vendor may not support locating, correcting, exporting or deleting relevant information and outputs. |
HR may be unable to respond effectively to an applicant's request. Obtain the procedure and confirm the legal position with a Singapore-qualified lawyer. |
| Incorrect parsing |
A CV format, language, employment gap or job title may be misread or omitted. |
A hiring manager may receive an incomplete account of an applicant's experience. Compare parsed fields with the original application. |
| Unauthorised access or excessive retention |
Access, deletion and retention arrangements may be unclear. |
Applicant information could remain available longer or to more people than intended. Obtain the relevant settings and vendor documentation. |
Singapore's fair employment guidance and any workplace fairness legislation relevant to the proposed process should be confirmed with a Singapore-qualified lawyer. This assessment does not make a legal finding about any applicant group, vendor or recruitment practice.
5. Why the reviewer recommends a hold
First, the proposed automatic rejection would give the system a decisive role in an outcome for individuals without a prior human review of every application. A person reviewing only the highest-ranked candidates would not correct errors affecting those already rejected. The proposal therefore needs a different decision process, not merely a warning that AI can make mistakes.
Second, essential vendor evidence is missing. The reviewer has not been supplied with fairness-testing results, ranking criteria, data-use terms, training settings, processing locations or a demonstrated route to correct errors. Without those materials, Quillmarrow cannot assess whether the proposed use is suitable or whether any stated safeguards would operate.
Third, the case for adding this risk has not been established. If hiring volumes are low, a manual review of every application may be proportionate and may remove the proposed need for automatic rejection. Hiring volume and the practical benefit of the service have not been evidenced; the HR Manager should confirm them rather than assume either.
The recommended hold is not a finding that every use of CV parsing is unsuitable. It means the current proposal lacks a defensible basis to proceed.
6. Vendor evidence status: V-03
V-03 Fictional Talent Screen answered the 30-question vendor questionnaire (A8). Across all 30 questions it provided supporting evidence for none, a statement without adequate evidence for 13, nothing for 15, and 2 did not apply because the service does not send messages or take actions. The rows below are the ones that matter most for this decision.
| A8 ref |
Evidence requested |
V-03 status |
What V-03 said or supplied |
Why it is needed |
| Q21 |
Intended purpose, system description and limits |
Not provided |
Says the service parses CVs and ranks applicants against employer criteria. Supplied no detailed intended-use or limitations document. |
To establish what is parsed or ranked and whether criteria relate to the role. |
| Q02 |
Data-flow diagram and full list of inputs and outputs |
Partial |
Says it processes CVs and applicant details. Supplied no field-level inventory or data-flow diagram. |
To identify where applicant information goes and what HR receives. |
| Q25 |
Fairness-testing method, results and limitations |
Not provided |
Says customers should review rankings for fairness. Supplied no fairness assessment, test method or results. |
To assess whether material differences or proxy effects have been considered. |
| Q24 |
Explanation of how rankings are produced |
Not provided |
Says ranking reflects the employer’s criteria and service configuration. Supplied no explanation guide or model documentation. |
To determine whether HR can understand and challenge an output. |
| Q01 |
Terms on use of CVs for model training or improvement |
Not provided |
Says data may be used to improve the service, subject to customer settings. Supplied no definition of improvement use or setting evidence. |
To determine whether applicant data may be used beyond the service. |
| Q06 |
Hosting locations, backups and service logs |
Partial |
Says data is hosted in a regional cloud environment. Supplied no country-level location or processing schedule. |
To assess the handling chain and any cross-border transfer. |
| Q07 |
Subprocessor list with locations |
Not provided |
Says selected infrastructure providers may support the service. Supplied no named list or locations. |
To know who else can handle applicant data. |
| Q03 |
Retention and deletion controls |
Not provided |
Says retention depends on the customer agreement. Supplied no retention schedule, deletion procedure or setting evidence. |
To establish how records can be found, managed and removed. |
| Q12 |
Vendor staff access review and logging |
Not provided |
Says support staff can access accounts to resolve issues. Supplied no approval, review or logging procedure. |
To assess who can access applicant information and how that is checked. |
| Q16 |
Data-processing terms |
Not provided |
Says its standard terms cover service operation. Supplied no DPA or processing schedule. |
To confirm the vendor acts only on Quillmarrow's instructions. |
| Q29 |
Logs of ranking inputs and outputs |
Not provided |
Says user activity is recorded for account administration. Supplied no sample log or evidence that ranking inputs and outputs are captured. |
To reconstruct how a candidate was ranked if challenged. |
Statements without evidence are recorded as Partial and are not treated as assurance. Obtaining documents would be the start of due diligence, not automatic approval.
7. If Quillmarrow wants to revisit
The HR Manager should submit a revised proposal to the COO and Head of Operations before seeking the MD's decision. Reconsideration requires all of the following conditions:
- Limit the design to parsing only. Remove candidate ranking from the proposed AI use. Define the fields to be extracted and check them against the original application.
- No automatic rejection. Disable or remove any capability to reject, advance or otherwise decide an application without an authorised person.
- Human review of every application. A hiring manager or authorised HR user must review the application before a rejection or progression decision and be able to correct parsing errors.
- Obtain fairness evidence. Request the vendor's testing method, results, limitations and evidence relevant to parsing errors across appropriate CV formats and applicant groups. Agree how concerns will be investigated.
- Inform applicants. Prepare a clear notice explaining the proposed processing and vendor involvement. Confirm its content and timing with a Singapore-qualified lawyer.
- Minimise data. Define necessary fields, avoid collecting or submitting unnecessary identifiers and photographs, and confirm access, retention and deletion arrangements.
- Consult the DPO. The Head of Operations should review the proposed data flow, vendor terms, locations, safeguards and applicant-request process, seeking legal input where needed.
- Document and approve the revised workflow. Record the human decision points, responsible roles, error escalation, vendor evidence and remaining gaps. Obtain MD approval before starting the revised High-tier use.
If a condition cannot be met, retain the hold. Any assessment using samples must follow the engagement boundary: descriptions and made-up or de-identified samples only, with no client personal data put into AI tools.
8. Framework mapping
| Reference or principle |
Relevance to this proposal |
Evidence or action needed |
| Model AI Governance Framework, Second Edition (PDPC and IMDA, January 2020) — human involvement |
The significance of rejection calls for meaningful human involvement before an individual decision. |
Document human review of every application and authority to correct or reject an output. |
| PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems (March 2024) |
The proposal would involve personal data in a recruitment-related process. |
Establish data flows, purposes and safeguards; confirm legal questions with a Singapore-qualified lawyer. |
| AI Verify testing framework (AI Verify Foundation) — fairness |
Parsing errors or unsuitable criteria could affect applicants differently. |
Obtain relevant vendor testing evidence and document its limitations. |
| AI Verify — explainability |
HR needs to understand and challenge material outputs. |
Obtain field-level explanations and a correction route. |
| AI Verify — transparency |
Applicants and hiring managers should understand the proposed use. |
Prepare applicant notice and internal instructions. |
| AI Verify — human agency and oversight |
People must retain a meaningful role in decisions. |
Demonstrate review of every application before a decision. |
| AI Verify — accountability |
A named owner must be responsible for decisions and follow-up. |
Record the HR Manager's ownership, escalation and MD approval. |
This mapping covers principles and process checks only. No AI Verify technical tests were run, and the mapping does not certify the service.
9. Decision needed from the MD
| Option |
Decision |
Consequence |
| A — Hold, as recommended |
Keep AI-04 on hold and do not proceed in its current form. |
HR continues without the proposed screening or ranking service. The team may gather evidence and prepare a revised proposal. |
| B — Proceed with redesign conditions |
Direct HR to develop a parsing-only proposal meeting section 7. |
This is not permission to begin using the service. The hold remains until the conditions are met, evidence is reviewed and the MD approves the revised High-tier use. |
| C — Decline |
Decide not to pursue the proposed vendor and use. |
Close the proposal and retain an appropriate human-led recruitment process; a future proposal would need a new assessment. |
10. Sign-off
| Role |
Decision or acknowledgement |
Signature |
Date |
| HR Manager |
|
|
|
| Head of Operations and DPO |
|
|
|
| COO |
|
|
|
| Reviewer |
|
|
|
| Managing Director |
|
|
|
About this sample
Fictional organisation, illustrative only, not a client case study. Quillmarrow Supplies Pte. Ltd., its people, vendors, findings and dates are invented. Nothing in this document reports a client result.
I personally review and sign off every deliverable. You appoint your own DPO. I support them.
This is practical compliance support, not legal advice. For legal advice, use a Singapore-qualified lawyer.
What's not included
- Legal advice, legal opinions on vendor terms or regulatory representation.
- AI Verify technical testing, model benchmarking, penetration testing or security engineering, unless the relevant work is separately scoped.
- Building an AI system, implementing integrations or changing live permissions and configurations.
- Certification, a compliance guarantee or an assurance that a model cannot fail.
- An organisation-wide ISO/IEC 42001 readiness engagement unless expressly included in the quote.
- Healthcare-sector work or on-site delivery.
ISO/IEC 42001 work is a readiness check only, never certification. Questions about this sample: DM @alewyl1 on X, or ask for a free intro call (coffee chat).