Businesses have leveraged Artificial Intelligence (AI) into many of their operational activities such as marketing, sales, and finance for its speed and cost-effectiveness. Lately, AI has also found applications in organizational recruitment processes. Unlike the conventional rule-based systems, present-day AI systems learn from data patterns—supported by the growing volumes of (big) data and increasing computing capacity—and make decisions independently without any human interventions. Thus, the perception that AI is fact-oriented and unbiased has led to this change in organizational recruitment practices. Though recent studies have shown that AI decisions could be unfair, scientific research on the fairness of AI recruitment systems is limited. This research fills this gap by designing a conceptual model to assist top-level HR managers in assessing the fairness of AI recruitment tools while drawing from information systems and responsible innovation literature. Guided by Design Science Research (DSR), the development of the model entailed three cycles of research, i.e., relevance cycle (which focused on design environment), rigor cycle (which focused on the existing knowledge base), and design cycle (which focused on development and evaluation). The design environment was explored by reviewing the literature on fairness in recruitment and algorithmic biases. Understanding both the recruitment fairness and potential causes of unfairness in AI helped to define the goal of the conceptual model. The design cycle was informed by the design principles for responsible AI, namely Accountability, Responsibility, and Transparency (ART), and General Data Protection Regulation (GDPR). The model presents seven dimensions which translate the principles to design requirements to assess the fairness of AI recruitment system. They are: (1)Justification; (2)Explanation; (3)Anticipation; (4)Reflexiveness; (5)Inclusion; (6)Responsiveness; and (7)Auditablity. The model also ties these concepts with specific criteria of conventional recruitment fairness such as consistency, interpersonal fairness, job-relatedness, and statistical parity. Finally, the completeness of the model was evaluated by discussing its alignment with other frameworks that had similar objective and utility of the model was validated by collecting feedback from the intended users. This thesis project makes several scientific and practical contributions. The research discusses the potential risks of using AI in the context of HR recruitment systems thereby contributes to the limited literature available in this respect. By using the DSR methodology for building the assessment model, this research serves as a case for DSR methodology in designing a non-IS artifact. Furthermore, the thesis has unified scattered studies in recruitment justice to provide a comprehensive overview of the characteristics of a fair recruitment system. Building on the theoretical contributions, the study has developed an assessment model to assist top-level HR managers in assessing the fairness of an AI recruitment tool. Employing this assessment tool can have positive effects on a business organization and society by eradicating the unfairness or bias that AI recruitment tools can bring into the organization. It would also raise awareness regarding the risks of AI. Given that the GDPR (article 35) mandate organizations to take responsibility in assessing the impact while introducing automated processing in new contexts or purposes, the assessment model designed in this study supports these regulations.

The Internet of Things (IoT) will soon impact the lives of thousands of people as numerous IoT devices are emerging in the consumer market. Consumers goods consist of products designed for the consumption of final consumers. Even though IoT applications are expected to improve people's lives, security is often lacking in current IoT devices. Vulnerabilities in these type of products pose serious risks to the security and privacy of consumers. Compared to traditional electronics, IoT devices are endowed with internet connectivity that can be exploited by hackers in remote attacks. Several attacks on IoT products that can threaten the security of a large of number actors have already been observed. To minimize the risk of attacks, developers and vendors need to identify vulnerabilities in time before any malevolent individual can exploit them. In recent years, as part of vulnerability management practices, many organizations have started to implement crowdsourced security methods such as Bug Bounty Programs (BBPs) and Responsible Disclosure Policies (RDPs). BBPs and RDPs are programs that involve the participation of ethical hackers in the security processes of organizations, reporting vulnerabilities to companies in exchange for monetary rewards or recognition. These methods present the benefit that thousands of hackers can work together with companies to identify and patch vulnerabilities. Empirical research suggests that BBPs and RDPs effectively augment existing vulnerability management practices by companies. However, the application of these programs in the field of IoT has never been studied. There are many questions open regarding the potential and future adoption of Bug Bounty Programs and Responsible Disclosure Policies. The research aim is to study and expand the literature on security practices for IoT, focusing on the application of BBPs and RDPs, and to conduct an interview-based investigation with experts in order to provide practical recommendations for companies to enhance vulnerability management practices for IoT consumer goods. For this research, the literature on IoT security and security practices is confronted with empirical data from expert interviews. The empirical data was gathered during an internship at Deloitte in the Netherlands. In total, 19 interviews with cybersecurity experts from different companies in the field were collected for this thesis. The results are employed to generate recommendations for companies to improve their vulnerability management practices with the use of BBPs and RDPs. The recommendations are directed to companies developing, manufacturing, and commercializing consumer IoT devices that want to enhance the security of their products. The main contributions of this research consist of practical and tangible security recommendations for companies to tackle IoT vulnerabilities in consumer goods, which will help enhance the overall IoT security practices. Moreover, our findings raise attention on the societal risks derived from the unsafe deployment of vulnerable IoT products into the consumer market. We create awareness on the IoT security challenge, and present a call for further actions from companies, consumers, and regulators in the IoT domain.