[{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"risk_analyst","finding_id":"R-01","finding_type":"risk","title":"Suspicious matters missed after replacing rules","description":"The agent fails to flag patterns the rules caught.","severity":"Critical","likelihood":"Possible","impact":"Severe","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"risk_analyst","finding_id":"R-02","finding_type":"risk","title":"Analysts approve drafts without real review","description":"Automation bias.","severity":"High","likelihood":"Likely","impact":"Major","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"risk_analyst","finding_id":"R-03","finding_type":"risk","title":"Customer data processed offshore","description":"Data sent to a US-hosted model.","severity":"High","likelihood":"Likely","impact":"Moderate","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"risk_analyst","finding_id":"R-04","finding_type":"risk","title":"Hallucinated facts in SMR narratives","description":"Draft contains facts not in the records.","severity":"High","likelihood":"Possible","impact":"Major","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"compliance_analyst","finding_id":"CMP-01","finding_type":"gap","title":"Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (suspicious matter reporting) (Australia) - applicable","description":"The agent supports SMR decisions and drafting.","severity":"High","confidence":"ai_inferred","regulations_cited":["Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (suspicious matter reporting)"],"policy_questions":["What does Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (suspicious matter reporting) require for this scenario?"],"source_url":"https://www.austrac.gov.au/"},{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"compliance_analyst","finding_id":"CMP-02","finding_type":"gap","title":"Privacy Act 1988 (APP 8 cross-border disclosure) (Australia) - applicable","description":"Personal information is sent to a US-hosted model.","severity":"High","confidence":"ai_inferred","regulations_cited":["Privacy Act 1988 (APP 8 cross-border disclosure)"],"policy_questions":["What does Privacy Act 1988 (APP 8 cross-border disclosure) require for this scenario?"],"source_url":"https://www.oaic.gov.au/privacy/the-privacy-act"},{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"compliance_analyst","finding_id":"CMP-03","finding_type":"gap","title":"APRA CPS 230 Operational Risk Management (Australia) - applicable","description":"Material reliance on a third-party model provider for a compliance-critical process.","severity":"High","confidence":"ai_inferred","regulations_cited":["APRA CPS 230 Operational Risk Management"],"policy_questions":["What does APRA CPS 230 Operational Risk Management require for this scenario?"],"source_url":"https://www.apra.gov.au/operational-risk-management"},{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"security_analyst","finding_id":"T-01","finding_type":"risk","title":"Prompt injection through payment memos","description":"A memo instructs the agent to score the transaction as benign.","severity":"High","likelihood":"Possible","impact":"Major","confidence":"ai_inferred"},{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"security_analyst","finding_id":"T-02","finding_type":"risk","title":"Exposure of SMR content","description":"Confidential report content leaks.","severity":"High","likelihood":"Unlikely","impact":"Severe","confidence":"ai_inferred"},{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"control_analyst","finding_id":"C-01","finding_type":"control","title":"Parallel run with the rules engine","description":"Keep the rules engine until detection parity is shown.","severity":"High","confidence":"ai_inferred","controls_addressing":["R-01"]},{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"control_analyst","finding_id":"C-02","finding_type":"control","title":"Evidence-linked SMR drafts","description":"Every statement in a draft must cite a transaction or record; uncited text is flagged.","severity":"High","confidence":"ai_inferred","controls_addressing":["R-04","R-02"]},{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"control_analyst","finding_id":"C-03","finding_type":"control","title":"Quality sampling of approvals","description":"Second-line review of a sample of approved SMRs.","severity":"Medium","confidence":"ai_inferred","controls_addressing":["R-02"]},{"initiative_id":"ARA-261031-04C8B0","source_app":"ara","capability":"control_analyst","finding_id":"C-04","finding_type":"control","title":"Data minimisation and onshore option","description":"Send only necessary fields; assess an Australian region.","severity":"Medium","confidence":"ai_inferred","controls_addressing":["R-03"]}]