Unreviewed LLM used in customer complaints triage

CTRL-MDL-014/APRA CPS 230 Operational Risk Management, APRA CPS 220 Risk Management Framework, ASIC RG 271 Internal Dispute Resolution, and internal Model Risk Management Policy MRM-2025-04.

Control statement

Any AI or machine-learning model used in customer-facing decisioning for regulated processes — including complaints triage, hardship assessment, and dispute resolution — must be registered in the Model Risk inventory, sign-off by the Model Risk Committee before production release, operate behind a documented human-review gate, and emit decision evidence to the audit log for every regulated decision.

What the evidence shows

The release notes confirm the LLM-backed triage service went live on 2026-03-18 with vendor-hosted endpoints and prompt templates authored outside the Model Risk process. The MRM inventory has no entry for this model and no approval record from the Model Risk Committee. The governance memo documents that outbound responses are sent to customers without human review, and no decision evidence is retained beyond the vendor-side prompt logs, leaving ASIC RG 271 timelines and APRA CPS 230 audit expectations without an internal audit trail.

Evidence artefacts

complaints-service-release-notes-2026-03.md
mrm-inventory-export-2026-q1.xlsx
complaints-triage-prompt-governance-memo.docx

Affected assets

1 customer complaints triage microservice, 2 LLM vendor endpoints, ~4,200 monthly customer-facing responses

PressRto run·1–5for stages

Remediation Memory

2 similar past remediations found

46%Similarity
CTRL-CHG-024·closed on 28 Oct 2025
Emergency change retrospective audit coverage
Closed the gap on emergency change waivers by mandating a 24-hour retrospective review, wiring the change advisory board register to the ITSM platform, and generating audit-ready evidence packages for each emergency release.
- Same control domain: Change Management
- Keyword overlap: audit, release
71 min · closed by Sophia3 reusable artefacts
46%Similarity
CTRL-CHG-018·closed on 29 Jan 2026
Branch protection enforcement and deployment approval gate restoration
Restored required reviewer count on release branches, removed the automation account exemption, and wired the deployment pipeline to block merges that lack a second-engineer approval.
- Same control domain: Change Management
- Keyword overlap: approval, release
28 min · closed by Olivia4 reusable artefacts

Agent workspace

Click "Run remediation agent" to begin. The agent will diagnose the gap, plan the remediation, and ship the work in real time.