Compliance, GRC & HR Blog

Quick Answer: Occupational violence and aggression covers any incident where a worker is abused, threatened or assaulted in circumstances arising from their work, including from clients, patients, customers and members of the public. It is a psychosocial hazard, which means it carries the same duty as a physical one and the hierarchy of control applies. […]

Quick Answer: Continuous risk monitoring means watching your risks and controls between formal reviews, so that a change is detected when it happens rather than at the next assessment. It is not the same as continuous risk assessment, which re-rates the risk. Monitoring watches for the trigger. For Australian organisations it is also a legal […]

Quick Answer: Workplace harassment creates four separate exposures for an Australian employer, and most organisations only manage one of them. There is the positive duty under the Sex Discrimination Act, which requires proactive measures rather than a response to complaints. There is the work health and safety duty, because harassment is a psychosocial hazard. There […]

Quick Answer: An effective risk management strategy is the set of decisions that governs how your organisation handles risk: what you are protecting, what level of risk you will accept, who owns what, and which treatment you apply when something is rated. It is not the same as the risk management process, which is the […]

Quick Answer: The five governance risk and compliance challenges that persist in Australian organisations are unclear ownership of the GRC process, no single framework, keeping pace with regulatory change, manual processes that cannot produce evidence, and a gap between stated culture and actual behaviour. None is a technology problem at root. Each is a decision […]

Quick Answer: HR risk management is the practice of identifying, assessing and controlling the risks that arise from your workforce and your workplace practices, then being able to evidence that you did. It differs from other risk work in one important way: most HR risks are governed by a specific legal duty, and most of […]

Quick Answer: ESG reporting in Australia is no longer voluntary for entities above the Corporations Act thresholds. Group 1 began reporting for financial years starting 1 January 2025, Group 2 from 1 July 2026 and Group 3 from 1 July 2027. The reports are subject to assurance, and ASIC has already secured $34.7 million in […]

Quick Answer: A risk-aware culture is one where people at every level notice risk, say something about it, and are answered. It is culture working as a control for every other risk you carry. It is not the same as a risk-averse culture, which avoids risk rather than understanding it, and it is not the […]

Quick Answer: Cultural risk management is the practice of treating culture as a source of risk in its own right, rather than only as a means of managing other risks. It covers conduct, misconduct, the normalisation of poor practice, incentives that quietly reward risk-taking, and silence. It is a board and leadership discipline, because the […]

Quick Answer: A risk assessment framework is the organisational scaffolding that makes risk assessments consistent, comparable and repeatable. It is not the assessment itself. ISO 31000 draws this line explicitly: the framework covers leadership, integration, design, implementation, evaluation and improvement, while the process covers identifying, analysing, evaluating and treating a specific risk. Most organisations have […]