Risk Management

The Australian Cyber Security Centre's procurement and AI supply-chain guidance shows why vendor assurance must be refreshed when services change. OAIC guidance adds a clear requirement for organisations to conduct privacy due diligence on commercially available AI products.

This piece looks at the questions Australian business and risk leaders should be asking before their own AI model drifts

The OAIC has updated its facial recognition guidance for APP entities using biometric technology in high-volume, publicly accessible retail spaces. The update reflects the ART’s March 2026 Bunnings decision and reinforces that each deployment needs…

Two recent ASIC matters provide a useful opportunity to think differently about risk management. They can be read as stories about compensation, penalties and compliance shortcomings. But the more valuable question is not simply what...

Many organisations have AI policies, but these often fail to guide day-to-day decision making. To manage AI risks effectively, policies need clear guardrails that business teams can apply consistently. This article explains how to translate high-level AI principles into practical standards and controls that enable confident, accountable AI use.

Organisations that value the customer and evaluate themselves on their effective response to events will prepare incident response plans prior to events through analysis of their business processes and identification of potential failure points.

Click the title to read more.

Origin Energy is investigating a potential data breach affecting up to 4.8 million customer accounts, after a hacker calling themselves “John Doe” claimed to hold records for two million Australians and issued a 14-day extortion deadline. Here's what the response so far reveals about incident response governance under Australia's Notifiable Data Breaches scheme.

Way too many risk managers are glass half-empty people.  Of course the role of risk management is to focus on  the potential things that can go wrong, but that does not mean that the risk manager has to be negatively focused.  In actual fact, it is that negative focus that has made risk managers the type of person that businesses wish to avoid rather than engage.