Investigation would be required to:

• determine the number of customers impacted

• the type of data impacted

• how the data breach occurred (e.g. human error or cyber-attack).

• when the attack occurred.

As there was a delay in reporting to ASIC, it is assumed that the risk / compliance function either lacked skills / knowledge or capacity to thoroughly identify and report. It could be assumed those who first discovered the breach did not report it a timely manner to the risk / compliance function.

The compliance risks impacted include, but not limited to:

Australian Privacy Principals

ASIC Act

CPS234

CPS220

CPSC230 (or CPS231 / CPS232)

CPS510

• Risk Management policy / procedure

• Incident management policy / procedure

• Risk assessment policy / procedure

• Control testing procedures

• 3 lines of defense, with line 2 independent of line 1. Line 3 (audit) independent of the business

Reporting mechanisms could include:

• Monthly risk reporting forums that are presented to escalating levels of leadership, including senior and board

• Enterprise Risk Management system

• Dashboards

• Reporting would include trends / observations and outcomes of incident management / internal audit actions.

The standard requires the bank to comply with social / ethical values - given the type of breach (data) and delay in reporting, it appears that this is not adequately addressed or embedded in the business and requires uplift.

The amendment requires the bank to integrate climate- related obligations and would expect that reporting produced to support compliance with the plan would include commentary and consideration of climate risks.

Classroom / virtual training

Leadership forums / Ask me anything

Incident review / calibration sessions

Tone from the top

The compliance framework should be aligned with AS ISO 37301:2023 (Amendment 1:2024) by embedding compliance into leadership, policies, and culture—using the Plan-Do-Check-Act cycle, regular internal audits, and continuous improvement. Training must be tailored, interactive, and ongoing, focusing on privacy, breach reporting, and ethical conduct, with strong whistleblower protections and visible leadership commitment to foster a culture of accountability and openness.

Additionally, they should:

• Use a compliance risk register and scenario planning for future risks.

• Ensure board-level oversight and independent compliance reporting.

• Integrate compliance into strategy, operations, and culture per AS ISO 37301:2023.

• Deliver targeted, scenario-based training and promote a “speak up” culture.

• Regularly review and improve compliance systems in response to incidents and regulatory changes.

Southern Horizon Bank should assess and manage the breach of customer data and delayed breach reporting to ASIC by:

The breach has been assessed but reported late to ASIC, therefore this delay should have a breach assessment conducted on it, senior managers accountable and board should be notified in writing and this escalation documented and records, this notification should include details of the breach and remediation plan / management actions that should be tracked to closure.  The Management actions / remediation may include enhancing information security policies and tightening controls, assurance over controls.

• What governance structures and reporting mechanisms should be implemented.

IT, Risk, operational and compliance management frameworks, Privacy policies, data security policies. Incident management and breach reporting, management information reporting escalated up to board. APRA’s prudential standards, particularly CPS 220 (Risk Management) and CPS 510 (Governance). 

• How the bank can align its compliance framework with AS ISO 37301:2023 incorporating Amendment 1:2024.

ISO 37301:2021 is compliance management systems and amendment 1:2024 relates to provides a comprehensive set of requirements and guidelines for creating a compliance management system and is the leading international Standard organisations follow to construct and maintain effective compliance management systems.

Southern Horizon Bank should maintain good governance and transparency, ethical values, regularly assessing risks, screen contractors and suppliers, and effective communication on the policy to relevant stakeholders.

• What training and cultural initiatives should be introduced to prevent future breaches.

Training should be enhanced on containing, data breaches and the assessment and reporting requirements for these as per the defined company policy and compliance framework. Training on how to monitor and assure compliance with data management.

• Conduct detailed root cause analysis.

• Ensure transparent reporting consistent with ASIC RG 78 and ethical standards.

• Identify regulatory, privacy, operational, reputational, and cultural risks arising from the breach.

• Implement dashboards for breach and compliance metrics.

Governance & Reporting

• Activate the Risk  and Compliance Committee.

• Clarify roles for Board, Executive, and Compliance teams.

• Strengthen delegations of authority for rapid breach escalation and reporting.

• Conduct independent reviews, audits, and scenario testing.

Aligning to compliance framework with AS ISO 37301

• Update policies, implement technical controls, and conduct mandatory training.

• Strengthen monitoring, audits, and continuous improvement processes.

• Proactively notify and cooperate with ASIC, APRA, and OAIC.

Ethical Leadership & Culture

• Reinforce a culture of transparency, early reporting, and accountability.

• Leadership to communicate clear expectations and model ethical behaviour.

• Embed ethical principles into decision-making and digital transformation activities.

The Bank can align the compliance framework with AS ISO 37301:2023 incorporating Amendment 1:2024 by utilising the PDCA lifecycle.

Uplift of risk and compliance frameworks, including incident and issue management processes, risk and compliance reporting, supervision and monitoring.

Training should include the revised risk and compliance frameworks, how to raise issues and incidents, risk and compliance assessments and ongoing supervision and monitoring.