Two recent ASIC matters provide a useful opportunity to think differently about risk management.
They can be read as stories about compensation, penalties and compliance shortcomings. But the more valuable question is not simply what went wrong.
It is:
What could a mature risk and governance environment have done differently—and how can other organisations apply those lessons before problems arise?
ASIC’s review of mortgage offset accounts and the Federal Court penalties imposed on Harvey Norman and Latitude Finance involve very different products and industries.
Yet both demonstrate why mature risk management must connect what an organisation promises to customers with what its systems, processes, people and partners actually deliver.
That connection is where risk maturity becomes valuable.
It is also where risk management moves beyond preventing regulatory breaches and begins supporting better products, more reliable services, stronger decision-making and greater customer trust.
Two ASIC matters, one opportunity
On 29 July 2026, ASIC released the results of its review of mortgage offset account practices at eight banks representing more than 70% of Australia’s $2.5 trillion home loan market.
Banks had paid more than $55 million in compensation for offset account failures reported between September 2023 and August 2025, with further compensation expected. ASIC identified weaknesses across the banks in how offset accounts were established, monitored and managed.
The previous day, ASIC announced that the Federal Court had imposed penalties of $35 million on Harvey Norman and $20 million on Latitude Finance Australia.
The penalties related to a national advertising campaign promoting a 60-month interest-free and no-deposit payment method. ASIC said the advertisements did not give customers a sufficiently clear picture that the arrangement involved entering an ongoing credit card facility carrying fees and other obligations.
These matters should not only prompt organisations to review mortgage processing or advertising approvals.
They should encourage a broader examination of risk maturity.
In each case, there was an opportunity for stronger governance to connect:
The customer promise → the operational process → the data → the controls → the actual customer outcome.
That chain is central to mature risk management.
Risk maturity begins with the promise
Most organisations describe their products and services through policies, procedures, product documents and technical specifications. Customers experience them differently.
They experience a promise.
For a mortgage offset account, the promise is straightforward: money held in the account will reduce the interest charged on the linked home loan. For an interest-free retail finance offer, the customer needs a clear understanding of the complete arrangement—including the nature of the credit product, its costs and its ongoing obligations.
A mature risk environment starts by identifying these promises explicitly.
It then asks:
- What must happen operationally for the promise to be fulfilled?
- What could prevent that from happening?
- How would we know whether it had happened?
- What evidence would demonstrate that customers received the intended outcome?
- Could customers be disadvantaged without realising it?
- Who is responsible for correcting the position when the outcome is not delivered?
These questions shift risk management away from abstract risk descriptions and towards the real experience of customers.
The mortgage offset opportunity: make outcomes visible
ASIC reviewed data relating to 204,000 home loans settled between March and August 2025. It found that some banks could not readily determine whether customers had requested an offset account. Others had to manually reconstruct information flows, and the quality of data varied significantly between banks.
Among the failures identified by banks:
- 55% involved an offset account being opened but not linked;
- 22% involved the account not being opened;
- 14% involved the account being linked later than the timeframe communicated to the customer; and
- 9% involved other issues.
The key risk maturity opportunity is to make the complete customer outcome observable.
What mature risk management should enable
A more mature approach should include:
Automation
Systems could regularly compare eligible home loans, recorded customer requests and linked offset accounts. Missing or inconsistent relationships could be flagged automatically.
Customer focus
Customers could receive clear confirmation when an offset account is established and linked, including the relevant loan and effective date.
Visibility
Online banking could clearly show that the account is linked and that the balance is contributing to reduced interest.
Escalation
Unlinked accounts, processing delays and failed requests could be visible through management reporting, with ownership and resolution timeframes assigned.
Self-assessment
Quality assurance could test whether the customer received the interest benefit—not merely whether the account-opening process was marked complete.
These controls would do more than reduce compliance risk.
They could improve service reliability, reduce remediation costs, simplify investigations and increase customer confidence in the product.
The retail finance opportunity: govern the complete proposition
The Harvey Norman and Latitude campaign appeared thousands of times across newspapers, radio and television between January 2020 and August 2021 and was likely seen by millions of Australians. The offer promoted 60 months interest free with no deposit. However, customers were required to enter a credit card arrangement and could incur account service fees and, during part of the campaign, establishment fees.
The risk maturity opportunity here is not limited to adding more legal review.
It is to govern the complete customer proposition across every participating organisation.
The Federal Court said the compliance processes of both Harvey Norman and Latitude were inadequate to prevent the conduct and found both organisations responsible for the advertisements.
That provides an important lesson for partnership governance.
Where organisations jointly design, market or distribute a product, mature governance should create stronger shared accountability—not fragmented responsibility.
What mature risk management should enable
A more mature approach should include:
Clear ownership
The retailer and finance provider could jointly define the complete customer proposition and document their respective responsibilities.
Process management
Approval could cover the complete advertisement and customer journey, rather than individual words, disclaimers or isolated product documents.
Automtion and Self-assessment
Customer enquiries, complaints, call-centre interactions and campaign data could be monitored for indications that customers misunderstand the offer.
Escalation
Material concerns could trigger an immediate review rather than waiting until the campaign concludes or a regulator becomes involved.
Again, the benefit extends beyond compliance.
Clearer communication can support informed customer decisions, reduce complaints, strengthen brand credibility and create a more sustainable distribution relationship.
Mature risk management changes the question
Less mature risk environments often ask:
- Was the procedure followed?
- Was the document approved?
- Did the system record the transaction?
- Was a disclosure included?
- Have many customers complained?
- Which organisation was contractually responsible?
More mature environments ask:
- Did the customer receive the outcome we promised?
- What evidence confirms that outcome?
- Could harm occur without being visible?
- Does the control test the actual outcome or merely completion of an internal step?
- What is the data telling us about exceptions and emerging patterns?
- Are customers interpreting the product as intended?
- Are responsibilities clear across the entire delivery chain?
- Can we intervene before a small weakness becomes widespread?
This is not simply stronger compliance.
It is better organisational management.
Six characteristics of risk maturity in action
1. Clear end-to-end accountability
Mature organisations assign accountability for complete customer outcomes.
The accountable owner is not responsible only for one system, department or procedural stage. They are responsible for understanding whether the overall product or service is operating as intended.
That accountability must remain clear when processes cross business units or involve external partners.
2. Controls linked to process outcomes
A control is valuable because of the outcome it protects—not because it appears in a control register.
Mature organisations continually test whether controls address the real risk.
For example:
- confirming that an account exists is not the same as confirming that it is linked correctly;
- confirming that a disclaimer exists is not the same as confirming that the customer understands the offer;
- confirming that a task was completed is not the same as confirming that the customer received the promised benefit.
3. Early detection
Mature risk management does not wait for customers, auditors or regulators to identify problems.
It uses reconciliations, exception reports, assurance activity, customer feedback and data analysis to identify emerging weaknesses early.
This is especially important where customer harm may be hidden.
Low complaint volumes do not necessarily indicate that a product is working correctly. Customers cannot complain about a problem they cannot see or understand.
4. Effective governance
Products and services increasingly cross legal entities, distribution partners, technology providers and business functions.
Mature governance makes these boundaries visible and manageable.
It establishes:
- clear responsibilities;
- shared standards;
- information requirements;
- approval authorities;
- escalation triggers;
- monitoring arrangements; and
- intervention rights.
A contract can allocate legal responsibility. It cannot, by itself, ensure an effective customer outcome.
5. Continuous learning
Risk maturity is not a fixed destination.
Mature organisations learn from complaints, incidents, control failures, remediation programs, regulatory reviews and near misses.
The objective is not merely to close an issue.
It is to understand what the issue reveals about product design, governance, data, incentives, culture and decision-making—and then improve the wider system.
What boards should expect to see
Boards do not need operational detail about every account or advertisement. They do need credible evidence that important customer promises are being delivered.
Useful reporting could include:
- the organisation’s most significant customer promises;
- the accountable owner for each promise;
- evidence that the intended outcomes are being achieved;
- volumes and ageing of operational exceptions;
- manual interventions and process workarounds;
- customer comprehension or outcome-testing results;
- recurring themes from incidents and remediation;
- issues crossing organisational or partner boundaries;
- trends that may indicate hidden customer harm; and
- actions being taken to strengthen the underlying environment.
This provides a much stronger basis for governance than relying solely on policy compliance, complaint numbers or the absence of reported incidents.
An opportunity to view risk differently
The two ASIC matters are timely reminders that risk management can create value long before an enforcement action, compensation program or court judgment.
Risk maturity enables organisations to:
- translate customer promises into measurable outcomes;
- design controls around what matters;
- make hidden weaknesses visible;
- clarify accountability across complex delivery chains;
- intervene earlier;
- improve products and services; and
- build customer trust.
That is the real opportunity.
The strongest risk functions are not those that produce the most policies, record the most risks or add the most approval steps.
They are the ones that help the organisation understand where its promises could break down—and then work with the business to make those promises more reliable.
The two ASIC matters provide practical examples of where stronger maturity could make a difference.
The wider lesson applies to every organisation:
Risk maturity turns promises into outcomes by connecting governance, accountability, data and controls with the real experience of the customer.
That is not only a way to prevent problems.
It is a way to build a better organisation.