Some court cases are a gamechanger and force companies to rethink their positioning on major themes, such as cybersecurity and risk management.
The recent RI Advice case in Australia is one such example. The Australian Federal Court found that an Australian Financial Services licensee, RI Advice, breached its license obligations to act efficiently and fairly when it failed to have adequate risk management systems to manage its cybersecurity risks.
The first ruling of its kind
The ruling, the first of its kind in Australia, followed several cyber incidents that occurred at authorized representatives of RI Advice between June 2014 and May 2020.
In the case, Australian Securities and Investments Commission (AISC) deputy chair, Sarah Court, said the cyberattacks were significant events that allowed third parties to gain unauthorized access to sensitive personal information.
She suggested it was imperative for all entities, including licensees, to have adequate cybersecurity systems in place to protect against unauthorized access. She said, “ASIC strongly encourages all entities to follow the advice of the Australian Cyber Security Centre and adopt an enhanced cybersecurity position to improve cyber resilience in light of the heightened cyber-threat environment.”
The court ordered RI Advice to engage a cybersecurity expert to identify and implement what further measures might be necessary to adequately manage cybersecurity risks across RI Advice’s authorized representative network.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataIn his judgment, Justice Rofe said cybersecurity should be a key factor for all licensees, saying, “Cybersecurity risk forms a significant risk connected with the conduct of the business and provision of financial services. It is not possible to reduce cybersecurity risk to zero, but it is possible to materially reduce cybersecurity risk through adequate cybersecurity documentation and controls to an acceptable level.”
A clear message on cybersecurity obligations
The risks to corporate reputations of a cyber breach are, by now, well-known. This landmark ruling sends a clear message to the corporate world that cybersecurity regulators will now actively enforce minimum security expectations. That means organizations must take seriously the need to implement cybersecurity programs and keep them up to date.
Chief information officers (CIOs) and chief information security officers (CISOs) will already have had an email from their CEO in their inbox that pointedly asks: ‘What does this mean for us?’ The harsh reality, astutely spotted by one Australian advisory and investment firm, is that the case may provide a springboard for regulators to pursue similar cases.
The onus will now be on those running corporations to ensure that cybersecurity risks are addressed, rather than being ignored, regarded as too expensive to address, or merely tick-boxed. The consequences of such actions could be critically expensive. Or even reputation changing.
Cybercrime will keep company directors awake at night
Since the beginning of 2021, directors have told the Australian Institute of Company Directors (AICD) and the Australian Information Security Association (AISA) that cyber-crime and data security is the number one issue that keeps them ‘awake at night’.
Only around half (51%) of directors say that their board has sufficient oversight of cyber security threats. This is a worrying statistic, given that cyber security incidents cost Australian businesses $29 billion a year. The outcome of this landmark case will not help any directors—especially of financial services firms—sleep any easier over cybersecurity.
