Controls
Frameworks in a versioned registry, mapped to operational controls.
Northwind Mutual ⌄Console › Controls › Control portfolioSearch ⌘KProductionModelPolling
Control portfolio
81 controls across 3 frameworks, mapped to 148 AI assets.
Map controlAssign owners
Frameworks
3- CPS 230 Operational Risk ManagementAPRA, 41 controls
- CPS 234 Information SecurityAPRA, 24 controls
- FAR, Insurance Key FunctionsAPRA and ASIC, 16 controls
EvidencedImplementedIn progressNot started
31 of 41 CPS 230 controls implemented or evidenced. 4 not started.
CPS 230 Operational Risk Management
F2026L00475Available| ID | Control | Owner | Assets | Implementation | Evidence |
|---|---|---|---|---|---|
| OR-01 | Critical operations and AI dependencies mapped | Chief Risk Officer | 12 | Evidenced | 3 |
| OR-07 | Third-party AI provider due diligence | Procurement | 9 | In progress | 1 |
| OR-12 | Change control for AI models in production | Head of Platform | 31 | Evidenced | 2 |
| OR-15 | Human approval above payment thresholds | Claims Ops Lead | 4 | Evidenced | 2 |
| OR-21 | AI incident escalation to operational risk | Operational Risk | 148 | Implemented | 1 |
| OR-26 | Tolerance levels for AI-supported critical operations | Chief Risk Officer | 0 | Not started | 0 |
| OR-28 | Business continuity for AI-dependent services | Head of Resilience | 6 | Implemented | 1 |
| OR-31 | Service provider register includes AI vendors | Procurement | 14 | Evidenced | 2 |
| OR-34 | Board reporting on AI operational risk | Company Secretary | 0 | In progress | 1 |
Frameworks, obligations and controls
| Object | What it is | Example |
|---|---|---|
| Framework | A regulation or standard, with its source instrument, regulator and version | APRA CPS 230 |
| Obligation | A requirement inside a framework, with its effective date | Manage material service providers |
| Control | A specific measure that satisfies one or more obligations | OR-07 Third-party AI provider due diligence |
| Policy | A runtime rule derived from a control, enforced at the gate | payments.threshold |
Implementation levels
Each control shows how far it is implemented: not started, in progress, implemented or evidenced. Evidenced means dated records show it operating; see Assurance and evidence.
Versioning
Published controls are versioned, not overwritten. A change creates a new version with an approval trail, and systems linked to the control show which version applies.
Last reviewed October 2026Suggest a change