Resolve before reliance
Evidence-test the high-priority findings before continued or expanded use. Use the patterns above as the review order.
For APRA-regulated organisations
AI Prudential
Risk Scan.
Examine how one AI system or agent is governed, tested, constrained and recoverable. The questions adapt to what it does and the consequences of failure.
Assessment
- 01 System context
- 02 Control questions
- 03 Results
Allow about 10 to 15 minutes.
Interested in a deeper review? Contact Avowal.
Loading assessment...
Before you begin
How to use this scan.
This is a self-assessment of one AI use case. It applies fixed questions and rules informed by published APRA direction and relevant industry practice, using the sources identified in the report.
The result relies on your answers. Avowal does not inspect documents, test controls or verify outcomes through this tool. A selected control may still be ineffective in practice. The scan does not determine compliance or residual risk and is not legal advice or certification.
Your answers are processed in this browser. You can save a PDF and a small Avowal file to revise the assessment later. Nothing is uploaded unless you select “Contribute anonymous answers” after receiving a result; that contribution excludes the name, date, contact, organisation name, findings, evidence and PDF.
01 / System context
Describe the system.
Choose one real use case. “Your organisation” means the APRA-regulated organisation accountable for it; “provider” means an external supplier. Your answers determine which control questions apply.
Outside this scan
This scan is for APRA-regulated organisations.
It would be misleading to assess another organisation against this APRA-focused question set. No result has been generated.
02 / Control questions
What controls support this initiative?
Answer the groups that apply at its present stage. For an idea or design, use Partly, No or I do not know where a control is only planned. Select “Yes, with evidence” only when you can point to a current document or test.
03 / Your self-assessment
AI Prudential Risk Scan
Self-assessment. Avowal has not independently verified your answers.
To revise and rerun later, keep the Avowal assessment file with this PDF and open it at avowal.com.au/assessment.
Summary for decision-makers
What to examine first
Potential impact
Reported controls
These are fixed combinations of self-reported answers, not verified controls or a residual-risk rating.
Prepared with the Avowal AI Prudential Risk Scan. avowal.com.au | info@avowal.com.au
Potential impact if the system fails
This is based on the use case and possible consequences. It does not change when a control is reported as present.
Self-reported control position
What these answers describe together
What to examine first
These fixed combinations identify priorities for review. They are not a residual-risk rating or verified conclusion.
Why this impact level applies
Impact and control evidence
This 2×2 separates the consequence of the use case from the controls reported for it. It identifies the next governance action; it does not calculate residual risk because the controls have not been independently tested.
Potential AI impact
Sufficiency of reported controls
Gaps or uncertainty
All reported controls in place
High
Prove it
For a system in this quadrant, independently test reported controls, starting with those a supervisor would test first.
Medium or low
Close on a plan
Assign an owner and date to each gap or uncertainty. Re-run the scan when the evidence position changes.
Maintain
Record the current position and re-run the assessment after a material change or at least annually.
Impact changes only if the use case or its potential consequences change. The reported position changes when gaps and uncertainties are resolved and evidenced.
Changes since the previous run
No previous completed run is available for comparison.
Control areas to examine
These areas reflect your answers, not verified control effectiveness. The examples are possible responses, not prescribed APRA requirements.
Optional benchmark
How contributed assessments answered
Each figure is shown only after at least 30 applicable, voluntarily contributed pilot or production assessments. Idea and design contributions are kept in separate aggregate counters and do not affect these figures. The percentages describe a self-selected set of assessments, not the APRA-regulated population.
The benchmark has not been loaded. Loading it is optional and does not contribute your answers.
What is sent
The benchmark-series key, coded system context and applicable control-answer codes. The server validates the response and adds it to stage-separated combined counters. It does not receive the initiative name, date, contact, organisation name, findings, evidence or PDF, and it does not retain an individual response.
Evidence to have ready
All applicable self-reported answers are listed below, including those that did not trigger findings. The evidence prompts are starting points for checking the claims, not a completed review.
Method and limitations
The scan applies fixed rules to one system described by the respondent. “Direct” means a question maps to stated APRA or prudential text. “Derived” means Avowal has turned a regulatory concern into a system-level check. CPG 230 is guidance, not a prudential standard. ASD material is a separate technical reference.
No documents or operating controls were independently examined. A selected “Yes” does not establish that a control works. This scan is not a compliance opinion, certification or substitute for an evidence-based review.
Regulatory sources: APRA AI letter, APRA/ASIC frontier-AI paper, and CPS 230. Non-regulatory practice context: AICD director guide and Actuaries Institute paper. Check the current publications before relying on the result.
Publication links for PDF readers
- APRA AI letter: https://www.apra.gov.au/news-and-publications/apra-letter-industry-artificial-intelligence-ai
- APRA/ASIC paper: https://www.apra.gov.au/news-and-publications/insights-apra-asic-industry-roundtables
- CPS 230: https://www.apra.gov.au/standards/cps-230
- AICD guide: https://www.aicd.com.au/content/dam/aicd/pdf/news-media/research/2026/director-guide-to-ai-governance.pdf
- Actuaries Institute: https://www.actuaries.asn.au/research-analysis/thought-leadership/ai-risk-management-in-the-financial-services-sector
PDF: In the print dialog, choose A4 and Default margins.
Revise later: Keep the Avowal file with the PDF. Open it at avowal.com.au/assessment to revise and rerun.
Want these answers tested against evidence?
Avowal can review one system's documents, control operation and priority actions.
Email Avowal about a reviewOpens your email app. If that does not work, copy info@avowal.com.au. Include the initiative name and the quadrant you landed in. Nothing from this assessment is attached or sent automatically.
Method and privacy
Fixed rules.
Clear limits.
Context answers open relevant groups. No, partial and unknown responses lead to fixed, source-mapped findings. Read the full method.
Detailed answers stay in this browser unless you save an Avowal assessment file or deliberately select “Contribute anonymous answers”. There is no analytics or contact form. See our privacy notice.