The Board Signed the Risk Declaration. Can It Trace the AI Evidence?

AI can reconcile hundreds of attestations, tests and actions before a prudential risk declaration. It cannot make the declaration true. Give every claim a traceable source, every exception a visible route and every required signatory the evidence needed for genuine enquiry.

A green dashboard is not evidence for a risk management declaration. The Board needs to see how each declaration claim connects to control evidence, independent assurance, known exceptions and unresolved remediation.

AI can assist by finding contradictions, matching artefacts and drafting questions. It must not decide that a declaration is accurate, determine materiality, clear a qualification or sign anything. Those judgements remain with the Board and required people.

Build a claim-to-source chain. This is a proposed internal control from TheAICommand, not an APRA-prescribed format. It turns each limb of the applicable declaration into a testable claim and gives the signatories a direct route to the evidence and exceptions behind it.

Which declaration are you actually supporting?

Start by separating the sectors. CPS 220 Risk Management is an enforceable standard in force from 1 July 2019 for banking, general insurance, life insurance and private health insurance entities within its application. CPS 220 expressly notes that an RSE licensee is not treated as an APRA-regulated institution for that standard. SPS 220 Risk Management is the separate enforceable standard, in force from 1 January 2020, for all RSE licensees.

Their annual declarations are not interchangeable.

CPG 220 says a Level 1 Board remains responsible for institution-level qualifications within group declaration documentation. Where a declaration is made on a group basis, CPS 220 itself requires any qualification to identify, where relevant, whether the material deviation occurred on an individual institution basis or a group basis.

The underlying claims also differ. CPS 220 Attachment A covers compliance systems, the appropriateness and effectiveness of risk and internal control systems, compliance with the risk management strategy, a general-insurer-specific reinsurance statement and processes producing financial information. CPG 220 Risk Management says financial information is read broadly and can include prudential returns and public disclosures.

SPS 220 Attachment A adds superannuation-specific claims about outsourcing risk, financial information for each RSE, reporting systems and controls supporting accurate information to APRA, and whether information provided to APRA represents transactions for the year and the year-end financial position. That claim set must be mapped as written. Do not paste a bank's declaration workflow over an RSE licensee.

The guidance is not enforceable. Current CPG 220, dated 1 April 2018, says a CPS 220 declaration need not be audited, but APRA expects the Board to obtain reasonable assurance and consider independent advice if necessary. It leaves the extent of enquiry to the Board's judgement. Current SPG 220 Risk Management, dated 1 July 2013, similarly says the SPS 220 declaration need not be audited and expects the two signing directors to obtain reasonable assurance and consider independent advice if necessary.

There is another SPS nuance. APRA's 1 October 2014 letter on SPS 220 declaration materiality allowed RSE licensees to adopt an “in all material respects” approach. APRA's 20 August 2020 letter says that position still applies. Record that source separately instead of pretending the phrase appears in the current SPS 220 Attachment A.

What does appropriate enquiry need from the evidence?

Appropriate enquiry is not a prescribed folder size. Under CPG 220, its extent is a matter for each Board's judgement. APRA also says directors may place reasonable reliance on advice and recommendations if they approach the task with an enquiring mind and make an independent assessment.

Under CPS 220, the Board is ultimately responsible for the framework and oversight of its operation by management. SPS 220 likewise makes the RSE licensee Board ultimately responsible. Management can assemble evidence. It cannot inherit the Board's declaration judgement.

That makes traceability more useful than volume. For each declaration limb, the signatories should be able to move through six links:

1. the exact claim and applicable entity or group scope;
2. the Board-approved framework, strategy, policy or control behind it;
3. evidence that the control operated during [DECLARATION_PERIOD], not merely that it was designed;
4. assurance coverage, test method, population, exclusions and findings;
5. incidents, breaches, deviations and open actions that may contradict the claim; and
6. the human conclusion, questions raised and treatment of any qualification candidate.

Do not let the chain end at a first-line attestation. CPG 220 describes first-line ownership, second-line objective review and challenge, and annual independent assurance on compliance with and effectiveness of the risk management framework. SPG 220 says internal audit may specifically consider key framework elements and that this information may support the SPS 220 declaration.

AI is useful where the evidence is dispersed. It can compare control-owner attestations with audit findings, detect different reporting periods, find actions marked closed without closure evidence and locate an incident that conflicts with a “no exceptions” response. Every result remains a lead until an authorised person verifies it against the source.

Create a negative-evidence lane. It should show material excluded from the positive assurance story: overdue actions, accepted risks, control failures, scope gaps, post-period fixes, unresolved audit findings and notifications already made to APRA. A declaration process that searches only for supporting evidence is designed to miss qualifications.

The annual cycle is not a substitute for notification. Under CPS 220, relevant significant breaches, material deviations or an inadequately addressed material risk must be notified as soon as practicable and no later than 10 business days after awareness. SPS 220 requires notification within 10 business days for its corresponding events. Do not hold a known issue for the declaration timetable.

How should the claim-to-source chain work?

Freeze an applicable-instrument record first. It should name the standard, current version, entity and group scope, declaration period, required signatories, due-date rule and approved qualification criteria. Legal or prudential specialists must verify that record before AI processes evidence against it.

Use this prompt to create a candidate chain from approved material. The declaration coordinator, evidence owners and second line must verify every mapping, while the Board and required signatories retain all conclusions.

Using only [CURRENT_STANDARD_TEXT], [BOARD_APPROVED_RMF], [CONTROL_ATTESTATIONS], [ASSURANCE_REPORTS], [INCIDENT_AND_BREACH_LOG] and [ACTION_REGISTER], build a candidate claim-to-source chain for [ENTITY_SCOPE] and [DECLARATION_PERIOD].

For each exact declaration limb return:
1. claim ID and applicable entity or group
2. policy, control and human owner
3. operating evidence, period and source reference
4. assurance scope, method, exclusions and finding
5. contradictory evidence, open actions and notifications
6. evidence status: DIRECT, PARTIAL, CONFLICTED or MISSING
7. questions for the required signatories

Do not determine compliance, materiality, qualification or whether the declaration can be signed. Mark every inference HUMAN REVIEW REQUIRED.

Then run a contradiction pass after the reporting cut-off. Compare source dates, populations and entity boundaries. Separate a control fixed after year end from evidence that it operated during the declaration period. Preserve source files and stable references so a reviewer can reconstruct the chain without the model.

Use this prompt to challenge the assembled pack. A human prudential specialist and the appropriate Board process must assess the output, decide whether further enquiry or independent advice is needed and determine any qualification.

Red-team [DRAFT_CLAIM_TO_SOURCE_CHAIN] against [APPLICABLE_DECLARATION_TEXT] and [APPROVED_QUALIFICATION_CRITERIA].

Identify circular attestations, stale evidence, missing populations, excluded entities, weak test methods, contradictory incidents, unresolved findings, post-period remediation and unsupported closure claims. For each issue, cite the source and draft a question for the required signatories.

Do not clear an issue, decide materiality, recommend an unqualified declaration or speak for the Board. Return OPEN, EVIDENCE NEEDED or HUMAN DECISION REQUIRED.

Fictional worked example: [RSE_LICENSEE] is preparing its declaration for [DECLARATION_PERIOD]. AI matches a control-owner attestation stating that privileged-access controls operated effectively to a completed action in [ACTION_REGISTER]. The negative-evidence lane also finds an assurance report that excluded [OUTSOURCED_PLATFORM] and an incident open at year end. The chain records the relevant SPS 220 limbs as CONFLICTED and drafts questions. The Board decides whether further evidence is needed and whether to qualify. The two directors decide whether they have reasonable assurance to sign. The AI makes neither decision.

Retain a signatory enquiry record. Capture the evidence version presented, questions asked, answers and additional sources supplied. It is not a script for directors. It is proof that the pack supported an actual enquiry rather than a ceremonial signature.

Do this Monday

1. Select the applicable declaration. Confirm the current CPS 220 or SPS 220 text, entity and group scope, signatories and due-date rule with the prudential owner.
2. Atomise the claims. Give each Attachment A limb a claim ID. Do not reuse a sector-neutral checklist where the standards differ.
3. Trace one difficult claim. Link it to operating evidence, assurance scope, incidents, deviations, notifications and open actions for the declaration period.
4. Open the negative-evidence lane. Ask internal audit, compliance, risk and control owners for evidence that could contradict the proposed conclusion.
5. Run the contradiction pass. Let AI assist with reconciliation, then require source owners and second line to verify every flag and missing item.
6. Put questions before signatures. Give the Board and required signatories the unresolved issues, source links and qualification candidates early enough for further enquiry and advice.

Bottom line

AI can reduce the labour of assembling a risk declaration pack, but it cannot supply the Board's knowledge or enquiry. CPS 220 and SPS 220 have different claim sets, signatories, timing and qualification wording, so one generic workflow is unsafe. Build a claim-to-source chain that exposes contradictory evidence as clearly as supporting evidence. The Board must decide whether the declaration is accurate and needs qualification; required signatories must decide whether they can sign it.

This article is general information and education only. It is not legal, compliance, financial or professional advice. Obligations vary by organisation and circumstance. Verify current requirements against the primary sources cited and seek advice specific to your situation.

References

1. Australian Prudential Regulation Authority, CPS 220 Risk Management, enforceable prudential standard in force from 1 July 2019. https://www.apra.gov.au/standards/cps-220
2. Australian Prudential Regulation Authority, CPG 220 Risk Management, current prudential practice guide dated 1 April 2018. https://www.apra.gov.au/practice-guides/cpg-220
3. Australian Prudential Regulation Authority, SPS 220 Risk Management, enforceable prudential standard in force from 1 January 2020. https://www.apra.gov.au/standards/sps-220
4. Australian Prudential Regulation Authority, SPG 220 Risk Management, current prudential practice guide dated 1 July 2013. https://www.apra.gov.au/practice-guides/spg-220
5. Australian Prudential Regulation Authority, Prudential Standard SPS 220 Risk Management (SPS 220): Risk Management Declaration, letter to all RSE licensees, 1 October 2014. https://www.apra.gov.au/sites/default/files/141001-RSE-licensees-SPS-220-RMD-Materiality.pdf
6. Australian Prudential Regulation Authority, Risk management declarations under SPS 220 risk management, letter published 20 August 2020. https://www.apra.gov.au/news-and-publications/risk-management-declarations-under-sps-220-risk-management