Risk Management

The OAIC has updated its facial recognition guidance for APP entities using biometric technology in high-volume, publicly accessible retail spaces. The update reflects the ART’s March 2026 Bunnings decision and reinforces that each deployment needs…

Two recent ASIC matters provide a useful opportunity to think differently about risk management. They can be read as stories about compensation, penalties and compliance shortcomings. But the more valuable question is not simply what...

Many organisations have AI policies, but these often fail to guide day-to-day decision making. To manage AI risks effectively, policies need clear guardrails that business teams can apply consistently. This article explains how to translate high-level AI principles into practical standards and controls that enable confident, accountable AI use.

Organisations that value the customer and evaluate themselves on their effective response to events will prepare incident response plans prior to events through analysis of their business processes and identification of potential failure points.

Click the title to read more.

Origin Energy is investigating a potential data breach affecting up to 4.8 million customer accounts, after a hacker calling themselves “John Doe” claimed to hold records for two million Australians and issued a 14-day extortion deadline. Here's what the response so far reveals about incident response governance under Australia's Notifiable Data Breaches scheme.

Way too many risk managers are glass half-empty people.  Of course the role of risk management is to focus on  the potential things that can go wrong, but that does not mean that the risk manager has to be negatively focused.  In actual fact, it is that negative focus that has made risk managers the type of person that businesses wish to avoid rather than engage.

Treasurer Jim Chalmers's new Statement of Expectations tells APRA and ASIC to back growth, not just guard against risk. The UK gave its regulators the same mandate in 2023 — and a 2025 Lords inquiry found it hadn't shifted the culture at all. Here's what Australian boards should watch for.

A serious data breach does not automatically mean governance failed. The more important question is whether an organisation can demonstrate that it understood the risks, assessed the third party, monitored its controls and responded effectively...