Executive Decision Pack

SAMPLE-01 · Autonomous personal-loan approval (Australia)
Generated 2026-10-31 14:51 UTC · Owner: Priya Chen · Sponsor: Head of Retail Banking

DECISION
ESCALATE TO RISK COMMITTEE
Trust Score: 39/100 · ARA residual: High · CALIBRE band: Critical (GII 81.25) · Evidence coverage: 78%

Scenario

An Australian retail bank wants to deploy an autonomous AI agent that approves personal loans up to AUD 50,000 using customer transaction history, credit bureau data and open banking data. No human review is planned for approvals under AUD 30,000. The bank intends to use a third-party foundation model via API. Decisions delivered to customers in-app within 30 seconds.

Decision narrative

Initiative SAMPLE-01 (Autonomous personal-loan approval) is assessed at ARA overall-residual High, CALIBRE band Critical (GII 81.25/100). The proposed level of autonomy on financially consequential decisions crosses the enterprise risk appetite and triggers material APRA CPS 230 and Privacy Act obligations that are not yet in scope of the proposal.

The Risk Analyst identified 2 High and 0 Critical risks. CALIBRE prescribes 10 governance controls at Critical band. Secure-RAG evidence coverage against cited regulations is 78%.

This should not be automatically approved. Escalate to the AI Risk Committee for judgement on whether reduced autonomy (Option B: AI-assisted with human approval) delivers the business objective at acceptable residual risk.

Top risks driving the decision

  1. R-AI-01 Autonomous consequential decision without human oversight
  2. R-CR-02 Potential discriminatory outcomes (fair lending)
  3. R-CY-01 Prompt injection via customer-supplied data
  4. R-RG-01 APRA CPS 230 operational risk mapping incomplete

Conditions for approval

  1. Human approval gate for loans above AUD 5,000
  2. Independent model validation report signed off by CRO
  3. APRA CPS 230 vendor registration complete
  4. Continuous model monitoring live in production
  5. Customer appeals and explainability path operational

Evidence attached

None yet attached.

Remaining evidence gaps

None outstanding.

Actions and owners

IDActionOwner rolePriorityStatus
SAMPLE-01-A-01Prepare Risk Committee briefing pack from this Decision PackCRO OfficeCriticalOpen
SAMPLE-01-A-02Implement Human approval gate for consequential decisionsHead of RetailHighOpen
SAMPLE-01-A-03Complete Independent model validationHead of RiskHighOpen
SAMPLE-01-A-04Complete APRA CPS 230 vendor registrationCROHighOpen
SAMPLE-01-A-05Design specific control for R-AI-01: Autonomous consequential decisionAI Product OwnerHighOpen
SAMPLE-01-A-06Design specific control for R-CY-01: Prompt injection via customer-supplied dataCISOHighOpen
SAMPLE-01-A-07Index authoritative source for ASIC RG 271 into Secure-RAGComplianceMediumOpen
Approved by (name and role):

____________________________
Signature:

____________________________
Date:

____________________________

Audit trail: full machine-readable finding history, model IDs, timestamps, and evidence citations are stored in the Governance Fabric under initiative SAMPLE-01. Regenerate this pack at any time from the initiative page.