Compliance Risk Management

Compliance risk is the chance that you breach a law, regulation, licence condition or contract, and the cost that follows. SSC helps organisations in Australia and New Zealand build compliance programs that know their obligations, test their controls and report clearly to the board, without running everything from spreadsheets.

What we do

• Obligations register. We identify the laws, prudential standards, codes and contracts that apply to you and record who owns each obligation.
• Compliance risk assessment. Each obligation is rated for the likelihood and impact of a breach, using the same scale as your enterprise risk framework so compliance and operational risks can be compared.
• Control mapping and testing. We link obligations to the controls that meet them and design a testing plan for the second line.
• Breach management. A clear process for identifying, escalating, recording and reporting breaches, including regulator notification deadlines.
• Board and committee reporting. Key risk indicators and dashboards that show compliance posture and trends, not just activity counts.
• Compliance management system design aligned to ISO 37301:2021, the certifiable international standard that replaced ISO 19600.

Obligations our clients manage

Typical obligations in scope include APRA CPS 220, which requires APRA-regulated institutions to have a designated compliance function, CPS 230 operational risk management, CPS 234 information security, the Privacy Act 1988 and its Notifiable Data Breaches scheme, and the SOCI Act for critical infrastructure. In New Zealand, clients work with the Privacy Act 2020 and, for financial institutions, the conduct regime overseen by the Financial Markets Authority.

Compliance risk, enterprise risk and security compliance

Compliance risk management focuses on legal and regulatory obligations. Enterprise risk management covers every risk to your strategy, including strategic, financial and operational risk. Security compliance covers specific frameworks such as SOC 2 and NIST. Many clients start with one and connect all three, so the board sees a single view of risk.

Keeping the program current

An obligations register is only useful if it stays up to date. SSC builds GRCLens, a GRC platform that holds obligations, controls, evidence and KRIs in one place, so the program we design keeps running after the engagement ends. We also work with your existing GRC tool if you have one.

Further reading: how to build a practical GRC framework in 90 days and cyber risk KRIs for quarterly board reporting.