Chapter 8 — Independent review and defense
Lesson map
Lesson 08 published. Map, example, EX045.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Independent review"]
N2["8.2 The defense"]
N3["8.3 Outcome and dissemination"]
N4["8.4 What comes next"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX045"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Independent review"]
N2["8.2 The defense"]
N3["8.3 Outcome and dissemination"]
N4["8.4 What comes next"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX045"]
[Learning outcomes]
|
v
[8.1 Independent review]
|
v
[8.2 The defense]
|
v
[8.3 Outcome and dissemination]
|
v
[8.4 What comes next]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX045]
Learning outcomes
You will (1) obtain and respond to independent review; (2) defend design choices; (3) plan dissemination and next steps.
8.1 Independent review
Before submission, Lucas asks a researcher from another university to rerun his scripts from the archive. She reproduces every table and the bootstrap interval exactly, thanks to fixed seeds. She also questions whether the four missing accounts could change the result. Lucas runs a worst-case check, assuming all four missing accounts belonged to the quarterly group and had excess access; the difference falls slightly but the interval still excludes zero. He adds this sensitivity check to the results chapter and thanks the reviewer in his acknowledgements.
8.2 The defense
At the defense, examiners ask why Lucas did not randomise frequency. He explains that Tessaly could not change review schedules for research, and that he addressed this through confounder checks and candour about diligence. Another examiner asks whether excess access is the right outcome. Lucas argues it is closer to risk than counting completed reviews, but admits it does not measure whether excess access was ever misused. A third asks about generalisability; he answers that the method generalises more readily than the specific result.
8.3 Outcome and dissemination
The examiners pass the dissertation with minor revisions: clearer labels on two figures and a short discussion of review fatigue. Lucas plans a short paper for a practitioner journal and a talk at a regional security forum. Tessaly decides to pilot quarterly reviews for its warehouse management and finance systems, the highest-risk applications, and to measure excess access again after a year. Lucas offers his scripts and codebook so that the follow-up measurement uses exactly the same method. Both outputs cite the archive.
8.4 What comes next
Dr. Solberg suggests that a randomised follow-up would be the natural next study: if several companies agreed to assign review frequency by lottery to comparable units, frequency could be tested directly. Lucas notes the practical and ethical issues, such as ensuring no unit is left with unacceptable risk. He reflects that his master's work taught him to value modest, well-checked findings over striking claims, and that governance research is most useful when it measures outcomes that matter to risk. He records this reflection.
Worked example
Lucas survives independent reproduction, adds a worst-case missing-data check, defends his design and plans dissemination.
Synthetic case. Review, defense and follow-up are synthetic.
Errors and limits
Reproduction checks code, not truth. Follow-up results may differ.
Exercises
- EX045 — Reproduction result. Did the independent reviewer reproduce the tables? Rubric: 3 = yes, exactly, due to fixed seeds;; 2 = yes;; 1 = no;; 0 = none.
- EX046 — Worst-case check. What did the worst-case missing-data check show? Rubric: 3 = the difference fell slightly but the interval still excluded zero;; 2 = robust;; 1 = reversed;; 0 = none.
- EX047 — No randomisation. Why was frequency not randomised? Rubric: 3 = Tessaly could not change schedules for research;; 2 = practical;; 1 = vague;; 0 = none.
- EX048 — Outcome limit. What does excess access not measure? Rubric: 3 = whether access was misused;; 2 = misuse;; 1 = vague;; 0 = none.
- EX049 — Tessaly decision. Which systems will Tessaly pilot quarterly reviews on? Rubric: 3 = warehouse management and finance;; 2 = high-risk;; 1 = all;; 0 = none.
- EX050 — Next study. What follow-up does Dr. Solberg suggest? Rubric: 3 = a randomised multi-company study;; 2 = randomise;; 1 = vague;; 0 = none.
Synthesis
Independent reproduction, candid defense and planned follow-up complete a master's study.
Continue studying — chapter 08 of 08
← Chapter 07 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →