An AI risk management framework built to satisfy APRA, ASIC, and your board.
We design the standing framework your organisation runs every AI system through: an AI risk taxonomy, a board-approved risk appetite, a tiered assessment method, 50+ controls, three lines of defence, and KRIs. It plugs into the enterprise risk management you already have, satisfies APRA CPS 230, and aligns to NIST AI RMF, ISO/IEC 23894, and ISO 31000.
Built for
What the framework contains.
AI risk taxonomy
Comprehensive classification covering technical, operational, legal, and strategic risks. Distinct categories for predictive ML, generative AI, and decision-automation.
Assessment methodology
Tiered assessment models with materiality thresholds. Templates for quantitative and qualitative review across the full AI lifecycle.
50+ controls library
Preventive, detective, corrective, and governance controls mapped to NIST AI RMF functions (Govern, Map, Measure, Manage).
Three lines of defence
Roles, responsibilities, and operating model across first, second, and third lines, with KRIs and a board reporting pack ready to use.
Why generic risk frameworks miss AI exposure.
AI introduces novel risks that do not map onto traditional risk categories. Most Australian organisations are deploying AI faster than their governance can adapt, and catching up after a regulator surfaces a gap takes far more work than building the framework first.
- 01
Missing AI risk taxonomy.
Generic enterprise risk categories do not capture model drift, training data bias, hallucinations in generative AI systems, or third-party AI vendor dependencies. Without a purpose-built taxonomy, businesses cannot systematically identify and assess their machine learning and AI risk exposure.
- 02
Static assessments miss dynamic behaviour.
Traditional assessment methods do not account for dynamic AI behaviour. A machine learning model performing well today may degrade silently over time without proper monitoring. Generative AI adds emergent behaviours that static review cannot capture.
- 03
Existing IT controls leave gaps.
Existing IT controls were not designed for AI. Organisations lack controls for bias testing, explainability validation, model performance monitoring, and data governance throughout the AI lifecycle. The gaps create regulatory, reputational, and operational risk.
"The maturity of governance and risk management did not always align with the nature and scale of licensees' AI use. Nearly half of the licensees we reviewed do not have a policy on fairness and bias for their AI use."
ASIC, on its review of 23 AFS and credit licensees.
How new the AI at Australian licensees is.
ASIC REP 798
57%
of AI use cases at the licensees ASIC reviewed were less than two years old or still in development.
GenAI
92%
of generative AI use cases at those licensees were deployed in 2022 to 2023.
How we build the framework.
Engagements typically run 10 to 16 weeks. The ISO 31000 process your risk team already runs is the spine. NIST AI RMF and ISO/IEC 23894 supply the AI-specific content. AI risk sits inside the enterprise risk management your organisation already runs.
- 012 to 3 weeks
Discovery and AI landscape assessment.
Every AI and machine learning system in production, in development, or planned. Mapped against your existing risk framework to identify gaps in coverage, governance maturity, and regulatory alignment.
- 02
AI risk taxonomy development.
A classification system covering technical risks (model performance, drift, bias), operational risks (availability, integrity, continuity), legal risks (liability, privacy, IP), and strategic risks. Mapped to your enterprise risk categories and aligned to NIST AI RMF and the MIT AI Risk Repository.
- 03
Assessment methodology design.
Structured assessment approaches for credit risk models, fraud detection, customer service automation, generative AI content creation, and operational decision support. Tiered so low-risk solutions receive proportionate oversight while high-impact systems undergo rigorous evaluation.
- 04
Controls library creation.
50+ AI-specific controls mapped to NIST AI RMF functions: preventive (data validation, access management, bias prevention), detective (performance monitoring, drift detection), corrective (retraining triggers, model rollback), and governance (approval workflows, audit trails). Each control includes implementation guidance, testing procedures, and effectiveness metrics.
- 05
Three lines of defence integration.
Clear responsibilities across the three lines for AI governance: first line (development standards, testing, ongoing monitoring), second line (independent validation, compliance oversight, risk reporting), and third line (internal audit). Critical for APRA-regulated entities where CPS 230 requires clear accountability for operational risk management.
- 06
Risk appetite, board reporting, and KRIs.
A board-approved AI risk appetite statement with measurable tolerances per taxonomy category, then the Key Risk Indicators and dashboards that report against it. Template reporting packs, quarterly risk summaries, and incident escalation protocols designed to show APRA and ASIC that governance kept pace with adoption.
Practical governance artefacts.
Every deliverable is designed for operationalisation, not just documentation. Your risk, compliance, and technology teams can put each artefact into practice from day one. To assess a single system before deployment rather than build the structure around every system, see AI risk assessment.
Related AI consulting services.
Further reading
CPS 230 for AI: the operational playbook APRA expects you to have.
Tolerance levels that hold up on probabilistic systems, an exit strategy for foundation-model lock-in, and a board pack APRA will recognise.
Read the insight
NIST AI RMF explained
The four functions and 72 subcategories, and where Australian regulators point to them.
Read the guideFramework crosswalk
ISO 42001, NIST AI RMF, the NAIC essential practices and APP 1.7 to 1.9 in one control set.
Read the crosswalkAI risk assessment template
The method and workbook the framework runs each system through, with the ASIC consumer-harm column.
Get the workbookBuild a risk framework that integrates with what you already have.
Schedule a consultation to discuss your risk management requirements. We help Australian businesses build governance solutions that satisfy APRA and ASIC, protect your organisation, and enable responsible AI adoption.