Accountable AI:
Building Regulatory-Grade
Audit Trails for
APRA-Regulated Entities

The obligation is not
to have better AI.

It is to prove what the AI did — and who was in the loop when it did it.

Australian financial services organisations are deploying AI at scale across credit assessment, insurance claims, and fraud detection. These systems make thousands of consequential decisions every day — decisions that affect customers' access to finance, insurance outcomes, and financial security.

APRA and ASIC are intensifying their focus on how these decisions are governed. The regulatory question is no longer whether an organisation uses AI. It is whether the organisation can demonstrate that its AI decisions are auditable, subject to appropriate human oversight, and producing fair and consistent outcomes.

Most organisations cannot answer these questions today. Not because their AI is poor — but because the governance infrastructure to prove what it did does not exist.

APRA CPS 230 — Operational Risk Management

Effective 1 July 2025, CPS 230 requires APRA-regulated entities to identify, assess, and manage material operational risks — including risks arising from the use of third-party AI tools and internally developed models. Entities must maintain documented evidence of controls applied to material operational risk decisions.

Where an AI system makes or materially influences decisions classified as operational risk events — credit, claims, fraud, customer classification — the AI decision constitutes a controlled action that must be auditable, with defined human oversight thresholds and documented escalation paths.

APRA CPG 234 — Information Security

CPG 234 guidance extends to the integrity and auditability of AI models used in material decisions. Model version control, change management, and drift monitoring are not best-practice optionals — they are expected governance controls for AI systems operating in regulated environments.

ASIC RG 271 — Internal Dispute Resolution

RG 271 requires regulated entities to maintain complete records of AI-influenced decisions affecting customers, and to be able to reconstruct the basis of those decisions when a complaint is received. An entity that cannot retrieve the inputs and outputs of an AI decision within a complaint investigation period is in breach of its IDR obligations.

ASIC RG 274 — Product Design and Distribution

RG 274 imposes obligations on entities using AI in product suitability and customer segmentation decisions. Where AI influences which products are offered to which customers, entities must be able to demonstrate that outcomes are fair and not systematically disadvantageous to protected cohorts.

AI model logs — where they exist — are typically generated for operational monitoring purposes: latency, throughput, error rates. They are not designed to produce structured, queryable decision records at the level of granularity that regulatory compliance requires.

Reconstructing a single credit decision from raw model logs can take days. Reconstructing all auto-processed decisions above a materiality threshold across a quarter requires a significant data engineering effort — not a compliance query.

Human oversight records, where they exist, are typically stored in separate workflow systems. There is rarely a consolidated record that links the AI model's output to the human reviewer who acted on it and the outcome that resulted.

Model drift and outcome distribution analysis are generally the domain of data science teams, not compliance or risk functions. When regulators ask, the answer requires cross-team mobilisation rather than a dashboard query.

Example Decision Record

decision_id:    DEC-089142
timestamp:      2024-06-15T14:22:07Z
model:          CreditAI v2.3.1
inputs: {
  income:       94200
  loan_amount:  45000
  credit_score: 711
  employment:   38 // months
}
raw_output:     0.9412
threshold:      0.72
confidence:     94.1%
flag:           NONE
model_decision: APPROVE
reviewed:       YES
reviewer_id:    EMP-2291
reviewed_at:    2024-06-15T14:22:31Z
action:         CONFIRMED
override:       NO
final_outcome:  APPROVED
customer_id:    C-44821 // tokenised
product:        HOME_LOAN
regulatory:     MATERIAL

What the record enables

Model Drift Monitor

Every AI model integrated with Proofmarc establishes a deployment baseline — the output distribution of the model at the time it is put into production. Proofmarc continuously compares the current output distribution against that baseline and calculates a drift coefficient.

Configurable thresholds trigger warning flags and critical alerts at defined drift levels. Where drift exceeds the critical threshold, the governance dashboard flags the model for mandatory review — before a regulator or audit event surfaces the issue.

Oversight Posture Monitor

The dashboard tracks the rate at which high-consequence decisions — those above the entity's configured materiality thresholds — receive human review. Decisions processed below the required oversight rate generate automatic governance flags.

Outcome Distribution Monitor

Proofmarc continuously monitors AI decision outcomes across customer cohorts — analysing approval rates, decline rates, and value distributions across dimensions including customer age, product type, geographic region, and any protected characteristics defined in the entity's configuration.

Where the outcome distribution across a protected cohort diverges from the baseline by more than the configured threshold, a distributional anomaly flag is raised and included in the governance report. The entity's compliance team can then assess whether the disparity is explained by legitimate risk factors or represents potential model bias requiring investigation.

APRA Readiness Indicators

The dashboard provides a live readiness posture — a set of indicators that reflect the entity's compliance position against each key APRA and ASIC governance obligation, updated in real time as decisions are processed and reviewed.

What the report contains

The quarterly board report is a structured PDF generated automatically at period close — or on demand at any time. It is structured to answer regulatory questions, not to describe technical performance. A director can read it without a data science briefing.

The report contains:

• Total decisions logged for the period, by model and product line
• Human review rates against materiality thresholds — with specific identification of cohorts below threshold
• Model drift status for each integrated AI model, with comparison to deployment baseline
• Outcome distribution analysis — approval and decline rates across protected cohorts, with anomaly flags
• High-consequence decisions processed without human review — listed individually where above a defined threshold
• APRA and ASIC readiness indicator summary — a compliance posture statement the board can sign off on
• Recommended actions — governance flags that require board or executive attention in the next period

Who uses it

APRA-regulated entities are at an inflection point. AI capability has outpaced the governance infrastructure built to account for it. The regulatory framework — CPS 230, CPG 234, RG 271, RG 274 — is already in place. The examinations are coming.

The entities that navigate this period well will not necessarily be the ones with the best AI models. They will be the ones that can demonstrate, with documentary evidence, what their AI decided, who reviewed it, and that the outcomes were fair and consistent.

Proofmarc is designed to close the governance gap — not by replacing the AI systems that are already working, but by creating the accountability layer that those systems currently lack. A structured, queryable, board-ready audit trail that turns a regulatory obligation into a governance capability.