Home › Frameworks
Framework library
Industry-standard risk frameworks, policies and terminology for Australian financial services, so business and risk professionals all speak the same language. Aligned to current market and industry best practices. Read online or download in Word and PDF. Free, with no membership or sign-up.
FrameworkRisk Management FrameworkThe parent framework that sets how an organisation governs, assesses, rates, controls, monitors and reports risk, with one common rating scale and language. Ready to adapt for your organisation.
Word · PDF 35 pp · v1.0
StatementRisk Appetite StatementA ready-to-adopt Risk Appetite Statement the Board can approve: how much risk the organisation will accept, the measurable tolerances that put it into practice, and what happens when a tolerance is breached.
Word · PDF 32 pp · v1.0
PolicyAI Risk Management PolicyHow to govern, assess, approve, test, monitor and retire AI systems, from traditional machine-learning models to generative and agentic AI, built in-house or bought. Ready to adapt for your organisation.
Word · PDF 32 pp · v1.0
PolicyCyber Security PolicyThe information security policy that sets how an organisation governs, protects, tests and reports on its information assets, aligned to current Australian regulation and ASD guidance. Ready to adapt for your organisation.
Word · PDF 39 pp · v1.0
StandardIncident & Issues Management StandardHow to identify, record, rate, escalate, notify, investigate, remediate and close incidents and issues, aligned to current Australian regulation and industry best practice. Ready to adapt for your organisation.
Word · PDF 23 pp · v1.0
StandardQuantum Risk and Post-Quantum Cryptography StandardHow to find, assess, prioritise and replace quantum-vulnerable public-key cryptography, in line with ASD's recommendation to cease traditional asymmetric cryptography by the end of 2030 and APRA's expectations. Ready to adapt for your organisation.
Word · PDF 34 pp · v1.0
PlanCyber Incident Response PlanHow to prepare for, detect, contain, eradicate, recover from and learn from cyber security incidents, with playbooks, decision rights, notification deadlines and ready-to-use templates. Ready to adapt for your organisation.
Word · PDF 38 pp · v1.0
PlanData Breach Response PlanHow to contain, assess, notify and review a data breach involving personal information, aligned to the Privacy Act Notifiable Data Breaches scheme and OAIC guidance. Ready to adapt for your organisation.
Word · PDF 35 pp · v1.0
More frameworks, policies and terminology are being prepared and will be added here.