Outsourcing IT Operations
We recently attended a very interesting seminar organised by the Global Association of Risk Professionals (GARP). The topic was to help finance companies address APRA’s CPS 230 standard that has come into force on 1 July 2025. The standard addresses the need for finance companies to develop business continuity plans and to prudently manage their operational risks. In light of the common approach to outsource IT operations to third parties, the standard focuses heavily on this trend.
Speakers were from UniSuper, NAB and Deloitte and they spoke generally about their experience in preparing for the introduction of the new standard.
The speaker from UniSuper focused on the company’s experience of having Google inadvertently delete the entire UniSuper Google Cloud subscription, impacting over 600,000 customers. This occurred even though UniSuper had duplicate infrastructure and data in two geographies.
The conversation settled primarily on the challenge of maintaining the resilience of IT applications and data, in light of the small number of vendors in Australia.
See below for a diagram that depicts the major vendors of IT infrastructure and applications in Australia.
By way of example, before cloud and SaaS, the four banks in Australia would own and operate their own data centres, IT systems, networks and purchase the application software licences to run their businesses. If one of the banks suffered a power outage, a fire in their data centre or an IT malfunction, only its customers were impacted.
Today, it is likely that all four banks subscribe to the services of AWS, Microsoft and Google. So, if one of these providers suffers and outage, many more bank customers could be impacted.
The dominance of Microsoft is particularly concerning because it operates cloud services and three dominant SaaS services – O365, Teams and SharePoint. For a large proportion of Australian organisations, employees working from home are especially reliant on Teams.
The other aggregation of risks results from the concentration of data centres in Melbourne. There are currently four large data centres located in close proximity to each other in Port Melbourne, with NextDC planning another very large data centre nearby. Port Melbourne is about 2-3 metres above the Yarra River, which is open to the sea.
Uncertainty in the US
Finally, Jeff Bezos and Mark Zuckerberg have recently substantially changed their policies governing The Washington Post and Facebook. It’s plausible that given the major changes occuring in the US, that other companies mentioned above in the diagram, could also initiate substantial changes to the way they operate, possibly impacting Australian companies.
What we used to take for granted is no longer!
We left the seminar believing that more Australian organisations should seriously consider APRA’s approach to managing their reliance on IT systems and data.
The introduction of the Standard on 1 July 2025 adds urgency for Australia’s regulated entities!
PS: The incredibly impactful electrical sub-station fire at Heathrow Airport recently apparently also supplied a number of the UK’s data centres!
The Security Leadership Series | TrustedImpact and AISA
The very rapid adoption of cloud is exposing organisations to increased risks as they generally exercise an overabundance of trust and a scarcity of caution.
Read this very informative paper by TrustedImpact and AISA on how you can better manage your information that is held by your cloud provider.
Pandemic also a reckoning for climate change: Turnbull | Policy Exchange and The Age
"The COVID virus has been a case of biology confronting and really shaking the complacency of day-to-day politics with a physical reality of sickness and death on a scale we haven't seen for a very long time," Turnbull told the Policy Exchange audience. "And so the question really is: why do so many people in government and so many people in politics - particularly in the Anglo sphere - not take the scientific evidence on climate change just as seriously?
Think of coronavirus as a test run: Australian military leaders warn we must prepare for worse | ABC News
As Australia was swept by panic buying and medical shortages this year, the scenes were eerily familiar for one of the country's most senior military planners.
In a secret meeting only a year earlier, the Defence Department's director of preparedness Cheryl Durrant and a group of Australian industry leaders had predicted a strikingly similar scenario.
"We predicted the unpredictable," says Ms Durrant, who left the department in January.
Saudi's crude oil price cut may set off price war in Middle East | SP Global
Singapore — Saudi Arabia's decision to cut its crude oil prices sharply over the weekend has added pressure on other Middle East producers to follow suit or risk losing market share, setting the stage for a price war in the region, market participants said Monday.
Saudi Arabia, over the weekend, announced deep cuts in the price of its oil for customers globally after falling out with Russia on further production cuts to support prices. The price cuts were deepest for Europe -- a move that's widely seen as a direct challenge to Russia -- one of the region's biggest oil supplier.
Coronavirus COVID-19 and corporate governance | DLA Piper Global Law Firm
The coronavirus COVID-19 outbreak and ensuing government restrictions raise corporate governance concerns and create areas of risk across the ESG spectrum that should be considered by companies and their directors and officers.
Coronavirus outbreak exposes a weak link in the U.S. drug supply | STAT
In October 2019, Dr. Janet Woodcock, the director of the FDA’s Center for Drug Evaluation and Research, testified before Congress that the United States “has become a world leader in drug discovery and development, but is no longer in the forefront of drug manufacturing.” 72% of API manufacturing takes place outside the U.S., and the use of foreign-sourced materials “creates vulnerabilities in the U.S. supply chain,” Woodcock concluded.
Coronavirus disrupts the heart of electronics manufacturing in China | CNBC
“The ripple effect coming from one region in China is completely unprecedented,” Kamal said. “We’ve never seen anything like this”
The ripple effect coming from one region in China is completely unprecedented,” Kamal said. “We’ve never seen anything like this.
Australia solar module stockpiles could be exhausted soon, due to coronavirus | One Step Off The Grid
Australia’s rooftop solar market is being warned to brace for a months-long impact from the devastating coronavirus outbreak in China, as disrupted panel production and supply takes its toll on the local market.
Going viral: the legal impact of coronavirus on force majeure events | DLA Piper
Similarly, some businesses are partaking in voluntary closures and have implemented travel bans (not only in and out of China but more generally) for their employees. These restrictive measures have resulted in affected parties considering whether coronavirus, as a global health emergency, could be considered a force majeure event so as to delay or absolve a contracting party of its contractual obligations.
Deaths in China Rise, With No Sign of Slowdown | NY Times
Here are the highlights: As deaths approach 500, no sign of a slowdown. A second evacuation of Americans from China has begun. Britain and France urged their citizens to leave China. Hyundai suspended production at South Korea car factories. The oil industry is already in the doldrums.
3 Key Risk Management Responses to the Coronavirus | Risk Management Monitor
The novel coronavirus 2019-nCoV continues to spread throughout China and other countries, seriously impacting business operations around the world. As governments and companies act to protect their citizens, operations and employees at home and abroad, these actions threaten to produce business interruptions, travel risks and other effects that could be detrimental to business continuity.
The novel coronavirus 2019-nCoV continues to spread throughout China and other countries, seriously impacting business operations around the world. As governments and companies act to protect their citizens, operations and employees at home and abroad, these actions threaten to produce business interruptions, travel risks and other effects that could be detrimental to business continuity.
Here are three approaches to limit risk from the coronavirus:
- Take Travel Precautions
- Develop a Response Plan
- Consult Reputable Information Sources
CDC coronavirus situation summary
Outbreaks of novel virus infections among people are always of public health concern. The risk from these outbreaks depends on characteristics of the virus, including whether and how well it spreads between people, the severity of resulting illness, and the medical or other measures available to control the impact of the virus (for example, vaccine or treatment medications).
Outbreaks of novel virus infections among people are always of public health concern. The risk from these outbreaks depends on characteristics of the virus, including whether and how well it spreads between people, the severity of resulting illness, and the medical or other measures available to control the impact of the virus (for example, vaccine or treatment medications).
Coronavirus Map: Tracking the Spread of the Outbreak | New York Times
The Wuhan coronavirus has sickened more than 14,500 people in Asia, according to statements from health officials. Many other cases are suspected but not confirmed. As of Sunday afternoon, at least 305 people have died, all but one in China.
Australia to deny entry to travellers from mainland China unless they’re Australian citizens | SBS | 1 Feb 2020
Australia will deny entry to all travellers from mainland China unless they’re Australian citizens, amid growing fear surrounding the deadly coronavirus, Prime Minister Scott Morrison has announced. While citizens, permanent residents and their immediate family, legal guardians and spouses will be excepted from the strict measures, Mr Morrison said anyone arriving from China will be required to self-isolate, as part of the stricter border approach.