CPS 230 across four strategic platforms

Architecture leadership for CPS 230, where critical operations, business continuity, third-party risk and operational risk each sat in a different system, and each of those systems was strategic in its own right.

Consolidating into a single platform would have displaced four systems the organisation had already committed to, and coupled four domains that change at different rates and sit with different owners.

The design instead integrated those systems with the GRC platform and kept the integration deliberately light. Enough to make key information available in the system where each team already works, and enough to support reporting across the domains later, without binding the domains to one another.

The same engagement covered ASIC breach reporting enablement, a redesign of control testing, a rework of incident management, and proof-of-concept and design documentation for internal audit reporting and BEAR accountability statements. It also produced the first model risk capability in the platform, covering AI models, and included training the BAU support team so that the organisation could hold the capability in-house rather than depending on project-based support.

More than ten distinct solutions have been designed within this engagement since 2021, together with several proofs of concept that were designed and validated but not taken forward as funding and priorities moved.