Compliance, GRC & HR Blog

Quick Answer: HR risk management is the practice of identifying, assessing and controlling the risks that arise from your workforce and your workplace practices, then being able to evidence that you did. It differs from other risk work in one important way: most HR risks are governed by a specific legal duty, and most of […]

Quick Answer: ESG reporting in Australia is no longer voluntary for entities above the Corporations Act thresholds. Group 1 began reporting for financial years starting 1 January 2025, Group 2 from 1 July 2026 and Group 3 from 1 July 2027. The reports are subject to assurance, and ASIC has already secured $34.7 million in […]

Quick Answer: A risk-aware culture is one where people at every level notice risk, say something about it, and are answered. It is culture working as a control for every other risk you carry. It is not the same as a risk-averse culture, which avoids risk rather than understanding it, and it is not the […]

Quick Answer: Cultural risk management is the practice of treating culture as a source of risk in its own right, rather than only as a means of managing other risks. It covers conduct, misconduct, the normalisation of poor practice, incentives that quietly reward risk-taking, and silence. It is a board and leadership discipline, because the […]

Quick Answer: A risk assessment framework is the organisational scaffolding that makes risk assessments consistent, comparable and repeatable. It is not the assessment itself. ISO 31000 draws this line explicitly: the framework covers leadership, integration, design, implementation, evaluation and improvement, while the process covers identifying, analysing, evaluating and treating a specific risk. Most organisations have […]

Quick Answer: Integrated risk management connects operational data, such as incidents, hazards and near misses, to the enterprise risk register so that a single event changes a control rather than closing a ticket. It differs from enterprise risk management, which describes the governance structure, and from governance, risk and compliance, which describes the operating disciplines. […]

Quick Answer: Most of the regulatory compliance changes Australian businesses were told to prepare for have already commenced. Mandatory climate reporting began for the largest entities on 1 January 2025 and extended to mid-sized entities on 1 July 2026. Intentional wage underpayment became a criminal offence on 1 January 2025. The right to disconnect reached […]

Quick Answer: Audit-ready risk management means you can produce evidence, not just documents. Regulators and auditors look for seven things: a documented assessment process, a current risk register with named owners, controls mapped to risks, policies staff have actually acknowledged, training records with dates, an incident framework that feeds back into the register, and third-party […]

Quick Answer: Risk management maturity describes how deeply risk management is embedded in how an organisation actually operates, rather than how much documentation it holds. There are five levels: reactive, compliance-focused, structured, integrated, and optimised. Most Australian organisations of 50 to 500 staff sit at level 2, doing the work because a regulator or an […]

Quick Answer: A 5×5 risk matrix is a grid that rates each risk on two axes, likelihood and consequence, each scored 1 to 5. Multiply the two and you get a risk score from 1 to 25, which maps to four bands: low (1 to 4), medium (5 to 9), high (10 to 15) and […]