Financial Services

We assess your current security posture against CPS 234, then help close the gaps that matter most: identity and access controls, third-party security oversight, information asset classification, and incident response readiness, including APRA's 72-hour notification requirement. Combining a threat and risk assessment with practical remediation planning, we help funds demonstrate compliance to their board and APRA while genuinely reducing risk to member data, and align their approach with CPS 230 operational resilience obligations.

Banks depend on complex supplier ecosystems — core banking vendors, payments processors, cloud providers, fintechs. We assess and manage third-party risk (TPRM) across these relationships, mapping where sensitive data and critical functions sit with vendors, and building ongoing oversight that satisfies both APRA and the bank's own risk appetite.

Fund mergers and separations involve migrating member data, fund records and transaction history between platforms under tight timelines and strict accuracy requirements. We provide independent testing and data migration assurance across these programmes, including a merger-related engagement for a $95 billion AUM superannuation fund.

Yes. We've supported a leading Australian payments company on platform resilience and observability, helping keep real-time payments infrastructure available and monitored under regulatory scrutiny and high transaction volumes.

Banking and capital markets, superannuation and wealth management, and payments and fund administration — including clients such as BNP Paribas, a $95 billion AUM superannuation fund, and a leading Australian payments company.