Use this list to score whether your current AI outputs can survive an audit committee, an external auditor, or a regulator’s working session. Print it, share it, or bring it to a briefing.
Score0/12resolved
Can you point to the specific cell, row, or paragraph each figure was drawn from?
WHYDocument-level citations are not enough to satisfy APRA CPG 235 data-lineage expectations or AUASB ASA 230 working-paper standards. Auditors need to trace each figure to its origin row, not just the source file.
Is the captured-at state of each source recorded with the figure?
WHYWithout a tamper-evident snapshot, you cannot prove the figure still reconciles to the data that produced it. Cryptographic hashing is the working standard control, in line with APRA CPG 235 expectations on data integrity.
Is the exact calculation method captured alongside each derived figure?
WHYAUASB ASA 230 §8 requires audit documentation sufficient for an experienced auditor with no prior connection to understand the procedures performed. Method storage is what makes that possible.
Can you regenerate the same audit pack from the same inputs years later?
WHYASA 230 and APRA CPG 235 both require that the same procedures applied to the same data produce the same conclusions. If you cannot reproduce the audit pack, you cannot defend the original number.
When two systems claim the same fact, is the variance calculated and gated?
WHYASIC REP 799 (2023-24 audit oversight) flagged inadequate testing of model inputs and assumptions as a leading deficiency. Silent cross-system disagreements are a recurring audit finding.
Is every figure two-eyes signed by named humans from your control library?
WHYAPRA CPS 234 §14 and CPS 230 §16 require named accountability for information security and operational risk. AUASB ASA 220 requires named engagement-partner sign-off on audit work.
Is the sign-off timestamp written to tamper-evident storage?
WHYAPRA CPG 235 requires record integrity and protection from unauthorised modification. Append-only object storage, hash-chained logs, or equivalent immutable controls are the working standard.
Are records retained for the regulator's prescribed period?
WHYCorporations Act 2001 §286 requires seven years for financial records. The AUSTRAC AML/CTF Act requires seven years for transaction records. APRA prudential standards generally align with the seven-year horizon.
Does each figure carry the regulator clause it answers?
WHYMapping each figure to the clause it answers turns an audit pack from narrative into an auditable record. Unmapped figures invite examiner scrutiny and re-work.
Can the lodgement export in the structured format the regulator expects?
WHYAPRA Connect uses XBRL with the SBR taxonomy for prudential returns. ASIC accepts XBRL or iXBRL for financial reports. AUSTRAC uses the AUSTRAC Online portal. Structured-data lodgements do not accept generic PDFs.
Is customer data stored within Australia, with explicit authorisation required to leave?
WHYAPRA CPS 230 (effective 1 July 2025) requires material offshoring arrangements to be notified and consulted on with APRA before signing. AU residency is the default for regulated entities precisely because cross-border data invites that scrutiny.
Are the AI systems involved disclosed under the Privacy Act ADM transparency provisions?
WHYFrom 10 December 2026, APP 1.7 requires APP entities to disclose in their privacy policy the kinds of personal information used in automated decision-making with a substantial effect on individuals. Non-disclosure is a separate contravention of APP 1.
If you scored 12 out of 12, you already have what Fydis produces. If you scored below 12, those are the gaps to close before the pilot. It runs thirty minutes, direct, with no sales team in between.