# data[].attributes.body
Assess and manage compliance risks arising from the breach via compliance assessment to determine impact, root cause and rectification/remediation required.

The Bank can align the compliance framework with AS ISO 37301:2023 incorporating Amendment 1:2024 by utilising the PDCA lifecycle.

Uplift of risk and compliance frameworks, including incident and issue management processes, risk and compliance reporting, supervision and monitoring.

Training should include the revised risk and compliance frameworks, how to raise issues and incidents, risk and compliance assessments and ongoing supervision and monitoring.

# data[].attributes.headline
Compliance response plan for Southern Horizon Bank

# data[].attributes.subject
Compliance response plan for Southern Horizon Bank

# data[].attributes.body
Compliance Risk Assessment & Management

Conduct detailed root cause analysis.

Ensure transparent reporting consistent with ASIC RG 78 and ethical standards.

Identify regulatory, privacy, operational, reputational, and cultural risks arising from the breach.

Implement dashboards for breach and compliance metrics.

Governance & Reporting

Activate the Risk  and Compliance Committee.

Clarify roles for Board, Executive, and Compliance teams.

Strengthen delegations of authority for rapid breach escalation and reporting.

Conduct independent reviews, audits, and scenario testing.

Aligning to compliance framework with AS ISO 37301

Update policies, implement technical controls, and conduct mandatory training.

Strengthen monitoring, audits, and continuous improvement processes.

Proactively notify and cooperate with ASIC, APRA, and OAIC.

Ethical Leadership & Culture

Reinforce a culture of transparency, early reporting, and accountability.

Leadership to communicate clear expectations and model ethical behaviour.

Embed ethical principles into decision-making and digital transformation activities.

# data[].attributes.body
How the bank should assess and manage the compliance risks arising from the breach

Southern Horizon Bank should assess and manage the breach of customer data and delayed breach reporting to ASIC by:

The breach has been assessed but reported late to ASIC, therefore this delay should have a breach assessment conducted on it, senior managers accountable and board should be notified in writing and this escalation documented and records, this notification should include details of the breach and remediation plan / management actions that should be tracked to closure.  The Management actions / remediation may include enhancing information security policies and tightening controls, assurance over controls.

What governance structures and reporting mechanisms should be implemented.

IT, Risk, operational and compliance management frameworks, Privacy policies, data security policies. Incident management and breach reporting, management information reporting escalated up to board. APRA’s prudential standards, particularly CPS 220 (Risk Management) and CPS 510 (Governance).

How the bank can align its compliance framework with AS ISO 37301:2023 incorporating Amendment 1:2024.

ISO 37301:2021 is compliance management systems and amendment 1:2024 relates to provides a comprehensive set of requirements and guidelines for creating a compliance management system and is the leading international Standard organisations follow to construct and maintain effective compliance management systems.

Southern Horizon Bank should maintain good governance and transparency, ethical values, regularly assessing risks, screen contractors and suppliers, and effective communication on the policy to relevant stakeholders.

What training and cultural initiatives should be introduced to prevent future breaches.

Training should be enhanced on containing, data breaches and the assessment and reporting requirements for these as per the defined company policy and compliance framework. Training on how to monitor and assure compliance with data management.

# data[].attributes.body
Southern Horizon Bank should begin by mapping all relevant regulatory obligations (especially under the Privacy Act and ASIC rules), using a compliance risk register to identify and prioritise gaps in controls and processes exposed by the breach and delayed reporting. The board should establish a dedicated compliance committee and appoint an independent Chief Compliance Officer, ensuring direct reporting lines to the board and regular, transparent updates on compliance risks, breaches, and remediation actions.

The compliance framework should be aligned with AS ISO 37301:2023 (Amendment 1:2024) by embedding compliance into leadership, policies, and culture—using the Plan-Do-Check-Act cycle, regular internal audits, and continuous improvement. Training must be tailored, interactive, and ongoing, focusing on privacy, breach reporting, and ethical conduct, with strong whistleblower protections and visible leadership commitment to foster a culture of accountability and openness.

Additionally, they should:

Use a compliance risk register and scenario planning for future risks.

Ensure board-level oversight and independent compliance reporting.

Integrate compliance into strategy, operations, and culture per AS ISO 37301:2023.

Deliver targeted, scenario-based training and promote a “speak up” culture.

Regularly review and improve compliance systems in response to incidents and regulatory changes.

# data[].attributes.headline
What training and cultural initiatives should be introduced to prevent future breaches.

# data[].attributes.subject
What training and cultural initiatives should be introduced to prevent future breaches.

# data[].attributes.body
Elearning modules

Classroom / virtual training

Leadership forums / Ask me anything

Incident review / calibration sessions

Tone from the top

# data[].attributes.headline
How the bank can align its compliance framework with AS ISO 37301:2023 incorporating Amendment 1:2024.

# data[].attributes.subject
How the bank can align its compliance framework with AS ISO 37301:2023 incorporating Amendment 1:2024.

# data[].attributes.body
Whilst the bank is responsible for determining the needs of its compliance management approach, the standard provides recommend practices and would encourage the bank to develop in line with the recommendations following the PDCA (Plan Do Check Act) lifecycle. The lifecycle ensures that compliance is ongoing and not a once off activity. The uplifted framework would expect to see annual revision and approval of policies that support compliance.

The standard requires the bank to comply with social / ethical values - given the type of breach (data) and delay in reporting, it appears that this is not adequately addressed or embedded in the business and requires uplift.

The amendment requires the bank to integrate climate- related obligations and would expect that reporting produced to support compliance with the plan would include commentary and consideration of climate risks.

# data[].attributes.headline
What governance structures and reporting mechanisms should be implemented

# data[].attributes.subject
What governance structures and reporting mechanisms should be implemented

# data[].attributes.body
The bank requires the introduction of uplift of its compliance framework. The framework would comprise of policies / procedures including, but limited to:

Risk Management policy / procedure

Incident management policy / procedure

Risk assessment policy / procedure

Control testing procedures

3 lines of defense, with line 2 independent of line 1. Line 3 (audit) independent of the business

Reporting mechanisms could include:

Monthly risk reporting forums that are presented to escalating levels of leadership, including senior and board

Enterprise Risk Management system

Dashboards

Reporting would include trends / observations and outcomes of incident management / internal audit actions.

# data[].attributes.headline
How the bank should assess and manage the compliance risk arising from the breach

# data[].attributes.subject
How the bank should assess and manage the compliance risk arising from the breach

# data[].attributes.body
In order to adequately assess the risk, the bank requires a combination of suitability skilled risk and compliance professionals. The professionals require skills inclusive of technology / data / privacy risk given the breach of customer information.

Investigation would be required to:

determine the number of customers impacted

the type of data impacted

how the data breach occurred (e.g. human error or cyber-attack).

when the attack occurred.

As there was a delay in reporting to ASIC, it is assumed that the risk / compliance function either lacked skills / knowledge or capacity to thoroughly identify and report. It could be assumed those who first discovered the breach did not report it a timely manner to the risk / compliance function.

The compliance risks impacted include, but not limited to:

Australian Privacy Principals

ASIC Act

CPS234

CPS220

CPSC230 (or CPS231 / CPS232)

CPS510