The Australian Prudential Regulation Authority (APRA) is working with Medi bank to outline the scope for assessing the organisations risk management

← Back to Blog

The Australian Prudential Regulation Authority (APRA) is working with Medi bank to outline the scope for assessing the organisations risk management practices, to be conducted by the external auditor Deloitte.

The APRA has regulator tools in the form of CPS 234 and CPG 234 that set out the expectations of regulated entities management of information security risks. Tested recently with the RI finance Advice case. So one may expect there to be questions raised as to the risk management practices adopted, and their assessment of risk and risk mitigation.

The APRA is also looking to restrict board pay in the event of cyber attacks. With the board of Medi Bank taking 7 figure bonus payments a member of APRA is quoted as saying appropriate consequence management ” – including the potential for “impacts to executive remuneration where appropriate” in the wake of major data breaches that are allowed to happen under their watch.”

Ted Dziekanowski

#cybersecurity #cyberriskmanagement #cyberlegal

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7003626421721915392