Governance ARA-261031-D7361A

Library / ARA-261031-D7361A / governance

Worked example: Autonomous loan approval (Australia)

Versions of this assessment, reviewer sign-off, suggested framework mapping, and every linked deliverable.

Sign-off

Sign off version 1 (the latest run). 15 of 15 items are not yet reviewed; the sign-off will record this.

Versions (1)

Version	Saved (UTC)	Model	SHA-256
1	2026-10-31 06:37:15	Worked example: prepared in advance, not generated live	f7b8898d2b6b3ed0

Client

Item-by-item review

Confirm each AI-drafted risk, threat, regulatory finding and control. 0 of 15 reviewed (0 changed, 0 rejected). "Accepted with changes" needs a note describing the change. The counts are sealed into the sign-off.

Type	ID	Item
risk	R-01	Unfair or discriminatory credit outcomes (High)
risk	R-02	Unsuitable loans approved (High)
risk	R-03	Automated decisions without required transparency (High)
risk	R-04	Foundation model change or outage (Medium)
risk	R-05	Drift after deployment (High)
threat	T-01	Adversarial manipulation of application data (High)
threat	T-02	Credential compromise of the model API (Medium)
regulation	REG-01	National Consumer Credit Protection Act 2009 (responsible lending): applicable
regulation	REG-02	Privacy Act 1988 (APPs, including APP 1.7 to 1.9): applicable
regulation	REG-03	APRA CPS 230 Operational Risk Management: applicable
regulation	REG-04	Anti-discrimination legislation (Commonwealth and state): potentially_applicable
control	C-01	Human review of declines and loans above AUD 30,000
control	C-02	Fairness and affordability testing before release and monthly
control	C-03	Automated-decision transparency
control	C-04	Model change control and fallback

Deliverables

Board pack (Word)Risk register (Excel) Printable report

Failure simulations	none
Operating envelopes	none
ADM inventory entries	none (add)
Vendor reviews	none (start)

Framework mapping (suggested)

Suggested by keyword rules at heading level; verify each mapping against the licensed standard before using it in a statement of applicability or audit.

Control	ISO/IEC 42001 Annex A	NIST AI RMF	ISO/IEC 27001:2022	OWASP LLM 2025
C-01 Human review of declines and loans above AUD 30,000	A.9 Use of AI systems	MANAGE	-	LLM06 Excessive Agency
C-02 Fairness and affordability testing before release and monthly	A.5 Assessing impacts of AI systems; A.6 AI system life cycle	MEASURE	-	-
C-03 Automated-decision transparency	A.2 Policies related to AI; A.8 Information for interested parties of AI systems	GOVERN	5 Organizational	-
C-04 Model change control and fallback	A.6 AI system life cycle	MEASURE	-	-

Headings with no mapped control

ISO/IEC 42001 Annex A: A.3 Internal organization; A.4 Resources for AI systems; A.7 Data for AI systems; A.10 Third-party and customer relationships

NIST AI RMF: MAP

An uncovered heading is a prompt to check whether a control is needed, not proof of a gap.

Decision support only, not legal or regulatory advice. AI-generated ratings and citations must be reviewed by a qualified person before they are relied on.