Building corporate resilience

The AICD looks forward to constructive engagement with the new government, writes Louise Petschler GAICD. Plus cyber governance updates and resources.

New government

The AICD has congratulated Australia’s 31st Prime Minister Anthony Albanese and welcomed the swearing-in of the new cabinet and ministry. The AICD has appreciated constructive and consultative engagement with the ALP front bench over the past parliamentary term and we look forward to working with the Albanese government on issues of relevance to governance and directors.

There is substantial continuity for key portfolios in the new ministry. This includes Jim Chalmers as Treasurer, Mark Dreyfus QC as Attorney- General, Stephen Jones as Assistant Treasurer and Minister for Financial Services, and Dr Andrew Leigh as Assistant Minister for Competition, Charities and Treasury. Clare O’Neil has been appointed Minister for Home Affairs and Minister for Cyber Security, a key area for AICD engagement given extensive cyber developments and director concerns (see below).

With inflationary pressures, a global and domestic energy crisis and ongoing supply chain and skills shortages across many sectors, the incoming government has many pressing issues to consider. The election of the Albanese government also presents renewed opportunities to work alongside government to help build a more resilient and inclusive corporate landscape.

The new government has committed to action and certainty on climate policy — a key issue for Australian directors in our most recent Director Sentiment Index. It also has a focus on better economic opportunities for women and the full implementation of the Respect@ Work recommendations — measures the AICD has strongly backed.

National reconciliation — and progressing the Uluru Statement from the Heart’s call for Voice, Treaty and Truth-telling — also features highly on the new government’s agenda. The AICD considers reconciliation to be a national governance issue, and we look forward to engaging with our members on this important topic.

The AICD has also acknowledged the substantial contribution of former Prime Minister Scott Morrison and Treasurer Josh Frydenberg, and thanked them for their constructive engagement with the AICD.

This contribution includes leading our nation through the worst of the COVID-19 pandemic with vital, responsive and targeted measures, and lasting reforms to modernise corporations law settings.

Cyber governance updates

Australian directors have rated cybersecurity as the most pressing concern “keeping them awake at night” in our recent Director Sentiment Index surveys. This is a critical area of AICD focus and we update on some of the key policy and practice issues across cyber governance below.

ASIC legal action on cybersecurity

Last month, the Federal Court handed down its judgment in proceedings brought by the Australian Securities and Investments Commission (ASIC) against RI Advice Group Pty Ltd (RI Advice).

ASIC claimed that RI Advice had inadequate cyber security controls in place, which the company failed to remedy despite being allegedly aware of the issues. This resulted in sensitive client information being compromised in a series of cyber attacks. In its judgment, the court found RI Advice had contravened its Australian Financial Services Licence obligations under the Corporations Act 2001 (Cth). While the case did not provide commentary on the board’s role, it demonstrates that organisational cybersecurity is a priority for ASIC and within its investigatory remit. We anticipate more cyber-related actions will be brought before the courts.

Director cyber survey

The AICD has been working with the Australian Information Security Association (AISA) on a study into board preparedness for cybersecurity incidents, to benchmark current practice and guide further education initiatives.

The survey results show thats even in 10 boards see cybersecurity as an issue of “high priority” and over the past 12 months, more than 75 per cent of director respondents report increasing investment in cyber resilience.

Some of the key findings from the research include:

• Relatively low levels of cyber training among directors
• Difficulties in obtaining appropriate cyber insurance cover the current market
• NFP boards face barriers to lifting cyber practices, despite high risks for the sector
• Limited board reporting on cybermetrics creates heightened risks for organisations.

The full report is available on the AICD website.

Practice resources — supporting good governance

The AICD regularly releases and updates its guides and research on contemporary governance practice.

We have updated our AICD whistleblowing tool (with Clayton Utz) Whistleblower director duties and responsibilities: bit.ly/3M1s3u1

Key updates include:

• Learnings/insights from ASIC’s 2021 review of sample whistleblower policies and the poor compliance trends identified — particularly with detailing what available legal protections there are for whistleblowers making reports
• Commentary on how best to navigate personal work-related grievance that may not qualify for a protected disclosure.

We also recently updated our guidance with the Governance Institute of Australia, the Law Council of Australia and the Australasian Investor Relations Association regarding virtual AGMs, electronic communications and electronic signatures (bit.ly/3lVoQl9).

New cyber governance principle

The AICD is partnering with the Cyber Security Cooperative Research Centre (CSCRC) to jointly develop new cyber governance principles as a resource for Australian directors, to:

• Provide a practical and principles-based framework for director oversight of cybersecurity risk
• Be“technology neutral”and reflect domestic and international better practice
• Contribute constructively to regulatory developments and options on cyber governance.

To inform our work on this important practice resource, the AICD and CSCRC will be consulting with directors and key stakeholders in Australia to gather a wide range of perspectives. To contribute, please contact us at policy@aicd.com.au