[{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"risk_analyst","finding_id":"R-01","finding_type":"risk","title":"Unfair or discriminatory credit outcomes","description":"The model disadvantages groups of applicants.","severity":"High","likelihood":"Possible","impact":"Major","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"risk_analyst","finding_id":"R-02","finding_type":"risk","title":"Unsuitable loans approved","description":"Approvals that fail responsible-lending expectations.","severity":"High","likelihood":"Possible","impact":"Major","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"risk_analyst","finding_id":"R-03","finding_type":"risk","title":"Automated decisions without required transparency","description":"Applicants are not told how automated decisions are made.","severity":"High","likelihood":"Likely","impact":"Moderate","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"risk_analyst","finding_id":"R-04","finding_type":"risk","title":"Foundation model change or outage","description":"The provider changes or withdraws the model.","severity":"Medium","likelihood":"Possible","impact":"Moderate","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"risk_analyst","finding_id":"R-05","finding_type":"risk","title":"Drift after deployment","description":"Performance degrades as conditions change.","severity":"High","likelihood":"Likely","impact":"Moderate","confidence":"ai_inferred","regulations_cited":[]},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"compliance_analyst","finding_id":"CMP-01","finding_type":"gap","title":"National Consumer Credit Protection Act 2009 (responsible lending) (Australia) - applicable","description":"Personal loans to consumers are regulated credit.","severity":"High","confidence":"ai_inferred","regulations_cited":["National Consumer Credit Protection Act 2009 (responsible lending)"],"policy_questions":["What does National Consumer Credit Protection Act 2009 (responsible lending) require for this scenario?"],"source_url":null},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"compliance_analyst","finding_id":"CMP-02","finding_type":"gap","title":"Privacy Act 1988 (APPs, including APP 1.7 to 1.9) (Australia) - applicable","description":"Personal and credit information drives automated decisions.","severity":"High","confidence":"ai_inferred","regulations_cited":["Privacy Act 1988 (APPs, including APP 1.7 to 1.9)"],"policy_questions":["What does Privacy Act 1988 (APPs, including APP 1.7 to 1.9) require for this scenario?"],"source_url":"https://www.oaic.gov.au/privacy/the-privacy-act"},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"compliance_analyst","finding_id":"CMP-03","finding_type":"gap","title":"APRA CPS 230 Operational Risk Management (Australia) - applicable","description":"The bank is APRA-regulated and relies on a third-party model provider.","severity":"High","confidence":"ai_inferred","regulations_cited":["APRA CPS 230 Operational Risk Management"],"policy_questions":["What does APRA CPS 230 Operational Risk Management require for this scenario?"],"source_url":"https://www.apra.gov.au/operational-risk-management"},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"compliance_analyst","finding_id":"CMP-04","finding_type":"gap","title":"Anti-discrimination legislation (Commonwealth and state) (Australia) - potentially_applicable","description":"Credit decisions must not discriminate on protected attributes.","severity":"Medium","confidence":"ai_inferred","regulations_cited":["Anti-discrimination legislation (Commonwealth and state)"],"policy_questions":["What does Anti-discrimination legislation (Commonwealth and state) require for this scenario?"],"source_url":null},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"security_analyst","finding_id":"T-01","finding_type":"risk","title":"Adversarial manipulation of application data","description":"Applicants game features to gain approval.","severity":"High","likelihood":"Possible","impact":"Major","confidence":"ai_inferred"},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"security_analyst","finding_id":"T-02","finding_type":"risk","title":"Credential compromise of the model API","description":"Attacker uses the bank's API key.","severity":"Medium","likelihood":"Unlikely","impact":"Major","confidence":"ai_inferred"},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"control_analyst","finding_id":"C-01","finding_type":"control","title":"Human review of declines and loans above AUD 30,000","description":"A credit officer reviews every decline and every approval above the threshold.","severity":"High","confidence":"ai_inferred","controls_addressing":["R-01","R-02"]},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"control_analyst","finding_id":"C-02","finding_type":"control","title":"Fairness and affordability testing before release and monthly","description":"Test outcomes across groups and against affordability rules.","severity":"High","confidence":"ai_inferred","controls_addressing":["R-01","R-02","R-05"]},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"control_analyst","finding_id":"C-03","finding_type":"control","title":"Automated-decision transparency","description":"Update the privacy policy and give applicants reasons for declines.","severity":"Medium","confidence":"ai_inferred","controls_addressing":["R-03"]},{"initiative_id":"ARA-261031-D7361A","source_app":"ara","capability":"control_analyst","finding_id":"C-04","finding_type":"control","title":"Model change control and fallback","description":"Pin the model version, test before changes, keep a manual fallback.","severity":"Medium","confidence":"ai_inferred","controls_addressing":["R-04","R-05"]}]