How do you evidence process and AI controls to a regulator?
Keep the controls in the same model as the work they govern. In financial services the evidence exists, but proving a control operates means assembling it by hand each time somebody asks. When controls, owners and approvals sit with the processes, the answer is a query with a source attached.
The work we would model first
Examples, not a fixed list. Bring the process you already argue about and we will start there.
- Customer onboarding, KYC and due diligence
- Credit assessment and approval delegations
- Complaints handling and remediation
- AI and model use, with owners and approvals recorded
What financial services gets out of it
- Controls connected to the processes they actually govern
- AI use documented and governed as it enters workflows
- Evidence opened rather than reconstructed before a review
- Change designed with the control impact visible up front
Background reading
What does CPS 230 require you to document about your critical operations?
Written for risk, operations and compliance leaders in APRA-regulated entities, and the people they will ask to do the mapping.
Read thisWhat must an Australian business disclose about its automated decisions?
Written for privacy, risk and compliance leaders in Australian organisations, and the operations people they will ask.
Read this
Bring one process you already argue about.
We will run it through Omni with you on your own material. You keep the model either way.