Risk Management

APRA and ASIC both issued 2026 letters to industry warning that AI governance hasn't kept pace with adoption, flagging vendor concentration risk and director accountability gaps. ASIC's enforcement action against FIIG shows what inadequate controls cost in practice. This post sets out what to ask your organisation before a regulator asks first.

The better question is whether the organisation can show how conflicts are identified, declared, challenged, escalated and evidenced before an external inquiry, regulator or media story exposes the gap.

Shadow AI is no longer hypothetical: a NSW government contractor uploaded flood victims' personal and health data to ChatGPT, while APRA and ASIC have both issued 2026 letters demanding stronger AI governance and cyber resilience. This post sets out what boards and risk leaders should be asking right now.

Without a clear AI use-case lifecycle—from identification through retirement—organisations risk fragmented governance, hidden risks, and missed control opportunities. Executives and risk managers must demand disciplined visibility and stage-gate controls to keep AI aligned with strategy and risk appetite.

APRA has written to banks, insurers and superannuation trustees setting out minimum expectations for readiness to geopolitical shocks, including sanctions, trade restrictions and armed conflict. The letter highlights practical gaps in scenario planning, business strategy,…

The OAIC found an organisation breached APP 11.1 after an employee accessed customer personal information without authorisation. With the Medibank civil penalty case before the Federal Court, OAIC enforcement on internal access controls is active and escalating.

AI is already moving through most organisations. Sometimes it is visible. Sometimes it is hidden inside software, vendor tools, workflows or staff experimentation.

Coles, Woolworths and IAG each faced regulatory action over pricing for the same reason: a gap between what customers were told and what the pricing system actually did. This post uses those cases to ask whether your organisation can show how pricing decisions are owned, challenged and tested for customer outcomes — before a regulator does it for you.