Geopolitical Risk: Australian Prudential Regulation Authority

/ Article / By

The Australian Prudential Regulation Authority (APRA) is warning Australian financial institutions about geopolitical risk, and telling them they need to act.  In an open letter dated 17 June 2026, entitled Strengthening readiness for geopolitical shocks, APRA wrote:

“As Australia’s prudential regulator for banks, insurers and superannuation trustees, APRA is setting clear expectations on how entities should integrate geopolitical risk into governance, risk management and crisis preparedness practices to strengthen readiness for geopolitical shocks. These expectations are intended to inform how entities apply existing prudential requirements to the current operating environment.”

APRA’s warning is best contextualised with the warnings Australians have heard over the last five years from the Federal Government, Defence, Home Affairs and think tanks.  The message has been, and remains, that Australia is now immersed in the most dangerous and unpredictable geopolitical risk environment it has faced since World War II. Further, there is a likelihood that the geostrategic environment will deteriorate, and could do so with little warning.

APRA, through collaborative research, identified that while many entities are alert to geopolitical risk, there are differing levels of maturity amongst the entities in how this awareness is translated into risk management practices and crisis preparedness.  APRA cites that common gaps across enterprise risk management, emerging risks and crisis preparedness include:

  • Limited consideration of geopolitical risk as an amplifier of existing material risks.
  • Risk management practices are not keeping pace with rapidly emerging threats.  These include personnel-related security risks, such as foreign interference, and risks associated with disinformation campaigns.
  • Entities make insufficient use of periodic crisis exercises to build confidence that they are ready to respond to severe but plausible geopolitical shocks.

Based on APRA’s assessment of the significance of these gaps, APRA has identified a set of minimum expectations it has for entities it regulates, to strengthen their readiness for geopolitical shocks.  The letter describes these gaps in detail under the following headlines:

  • Enterprise risk
  • Operational resilience
  • Personnel (calling out insider threat and foreign interference)
  • Political
  • Financial resilience
  • Crisis preparedness.

I will focus now on the Personnel expectations.  APRA describes this expectation with two elements to understand and mitigate:

  • Security and integrity policiesand practices are in place to identify, manage and respond to insider threats and foreign interference.
  • Contingency arrangements are in place to support continuity of staffing and resourcing for critical operations during geopolitical disruption.

In these two elements, we see alignment with many other recent Commonwealth efforts to make clear to the public and to industry the threats posed by human-based sources of harm and the need to mitigate those threats.

In various forms of legislation and policy, as listed below, the Commonwealth has made clear the increasing threat posed by human-based sources of harm.

The Commonwealth has also provided guidance and, in some cases, legal obligations on the capability that industry needs to build and maintain in order to deter, detect and respond to human-based sources of harm.  This includes the merits of, or an obligation to have, an insider threat program.

In addition to the drivers embodied in this sample listing of legislation and policy, the Australian Security Intelligence Organisation (ASIO) has made numerous public presentations of its assessment of a steady increase in the intensity and consequence of threats posed by human-based sources of harm.  That is, increasing threats posed by the people who are your entity’s employees, contractors and suppliers.

The SOCI Act includes the Financial Markets and Services sector and so for many APRA entities this advice should not be new, but it does serve to highlight again the Commonwealth’s efforts to advertise personnel security, that is the treatment of human-based sources of harm, as a risk domain that requires urgent attention.

APRA identifies the threats posed by insider threat and foreign interference.  The task for entities is to identify, manage, and respond to these threats.

So, what practical steps should APRA-regulated entities take to address the personnel security risks APRA identifies?  Pentagram Advisory offers the following suggestions based on our knowledge of the SOCI Act and our work with critical infrastructure entities.

  • The basis of achieving risk mitigation is to have a contemporary enterprise risk assessment to inform the risk mitigation capabilities, activities and related investment.
  • From that foundation the entity can then choose the most appropriate personnel security capability and operation required based on the entity’s unique operating context, relevant threats, and resources available for mitigation.
  • One form of risk mitigation is Pentagram’s Trusted Workforce Program which enables the design, build, and ongoing maintenance of a security-enabled and effective workforce (employees and contractors, and in some cases suppliers) to mitigate the risks posed by insider threat and foreign interference.
  • Another form of mitigation is Pentagram’s Insider Threat Program which can be established in one of two forms: developed in concert with the Trusted Workforce Program as an integrated assurance capability to monitor that the trusted workforce is behaving as required, or as a stand-alone activity that adapts to the entity’s current workplace personnel security program.
  • To meet the Contingency arrangements requirement, entities could adopt the SOCI Act model of ‘critical worker’.  Critical workers have a higher standard of personnel security measures applied to them.  This will entail identification of critical assets, components and operations that these critical workers are integral to.

APRA, as a regulator, is quite right to be telling the entities it regulates about foreseeable risk and affirm that boards should be focused on the threats, and acting to mitigate them.  The Australian Securities and Investment Commission (ASIC) has also been making this point strongly in recent years.

Pentagram believes the personnel security risks identified by APRA remain a significant blind spot for many boards and executives.  However, the good news is that most organisations already have elements of a Trusted Workforce Program or an Insider Threat Program in place and so addressing APRA’s expectation to mitigate insider threat and foreign interference may not be as difficult and expensive as might first appear, given the right advice.

More important than simply meeting APRA’s regulatory expectations is the actual security effect that entities can achieve. 

Entities that understand and mitigate human-based sources of harm, in all its forms including insider threat and foreign interference, will better  protect their critical assets and operations from a broad array of threats, including cyber threats, that can be enabled by people.  That is a good outcome for the entity, and good for Australians who depend on the financial services they provide.

0
0
Your Cart
Your cart is emptyReturn to Shop
Continue Shopping