Chapter 7 — Dissertation writing and limitations
Lesson map
Lesson 07 published. Map, example, EX039.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Structure"]
N2["7.2 Limitations"]
N3["7.3 Recommendations"]
N4["7.4 Writing for practitioners"]
N5["Ethical reflection"]
N6["Threats to validity summary"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX039"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Structure"]
N2["7.2 Limitations"]
N3["7.3 Recommendations"]
N4["7.4 Writing for practitioners"]
N5["Ethical reflection"]
N6["Threats to validity summary"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX039"]
[Learning outcomes]
|
v
[7.1 Structure]
|
v
[7.2 Limitations]
|
v
[7.3 Recommendations]
|
v
[7.4 Writing for practitioners]
|
v
[Ethical reflection]
|
v
[Threats to validity summary]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX039]
Learning outcomes
You will (1) structure the dissertation; (2) write limitations; (3) make recommendations.
7.1 Structure
The dissertation follows introduction, literature, method, results, competing explanations, discussion and conclusion, with appendices for the change register, scripts and synthetic data.
The dissertation follows a clear structure: introduction and question, literature, method, results, discussion, limitations and recommendations. Each chapter opens by stating its purpose and closes by linking to the next. Readers can then find what they need quickly, and examiners can check that the argument flows from question to evidence to conclusion without gaps.
Signposting helps busy readers.
7.2 Limitations
One organisation, eight weeks, a labelled set of forty events, and a before-after design without randomisation. Labels depend on past incident records, which may miss events nobody noticed. Amara states each limit and its likely effect on results.
Amara states her study's limitations honestly: a single partner, a limited period, synthetic replays that may not capture every real pattern, and a small set of key events. For each, she explains the likely effect on the results and how future work could address it.
7.3 Recommendations
Corvane should keep the change register, review exceptions quarterly, maintain the labelled set by adding each new confirmed incident and rerun recall checks after any major tuning. Other organisations can adopt the procedure, but must build their own labelled sets.
Recommendations follow from the evidence: adopt documented tuning with peer review, measure detection retention alongside volume, and review tuned rules periodically. Each is practical for a small team.
Each states its cost, owner and how success would be measured.
Priorities are stated.
7.4 Writing for practitioners
A two-page summary for Corvane leads with the outcome in operational terms: analysts now handle about 1,200 alerts a week instead of 4,200, with the same detections.
Practitioners need findings they can act on, so Amara also writes a short summary for Corvane's team. It explains in plain language what was done, what changed, what the risks were, and what to do next, with one table of key results. Technical detail stays in the dissertation, while the summary focuses on decisions and next steps that busy analysts and managers can apply directly.
Ethical reflection
Amara includes a short reflection on ethics. The study handled pseudonymised internal data and interviews, and its main risk was weakening detection. Governance, the labelled recall check and the investigation of the lost detection were her responses. She also reflects that tuning can conceal problems if exceptions are granted for convenience, and recommends that exception owners be accountable for their entries. Writing this down shows examiners that ethical thinking ran through the study rather than ending with the approval form, and it gives Corvane a clear principle for future tuning.
Threats to validity summary
She closes the limitations chapter with a table of threats grouped by type. Internal validity: coincident changes, partly addressed by the explanations table. Construct validity: labels from past incidents may not represent all relevant events. External validity: one logistics firm with two data centres. Statistical conclusion validity: eight weeks of data limit precision of estimates. Each threat lists what was done and what remains. A structured table helps readers compare this study with others and see quickly where its evidence is strongest and weakest.
Worked example
Dr Brandt's review asks Amara to move the base-rate explanation earlier, since it motivates the whole study.
Synthetic case. The dissertation is synthetic.
Errors and limits
Limitations written as a token paragraph do not help readers judge results.
Exercises
- EX039 — Appendix contents. List three appendices. Rubric: 3 = register, scripts, data;; 2 = two;; 1 = one;; 0 = none.
- EX040 — Label limit. How might labels bias recall? Rubric: 3 = unnoticed events missing;; 2 = incomplete;; 1 = vague;; 0 = none.
- EX041 — Labelled set upkeep. How should Corvane maintain the labelled set? Rubric: 3 = add confirmed incidents;; 2 = update;; 1 = vague;; 0 = none.
- EX042 — Practitioner lead. Write the summary's first sentence. Rubric: 3 = operational outcome;; 2 = partial;; 1 = vague;; 0 = none.
- EX043 — Structure change. Why move the base-rate explanation earlier? Rubric: 3 = motivates study;; 2 = clarity;; 1 = vague;; 0 = none.
- EX044 — Transferability. What must other organisations do to adopt the procedure? Rubric: 3 = build their own labelled sets;; 2 = adapt;; 1 = vague;; 0 = none.
Synthesis
Clear structure and honest limits make the dissertation useful to examiners and practitioners.
Continue studying — chapter 07 of 08
← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →