Essential 8

Essential 8

• Business continuity management – Real-time review

  • Unique opportunity to identify real-time lessons learned from the pandemic as stakeholders have enacted the Plans recently so issues/insights/lessons learnt are top of mind.

  • A good time to refresh key risks and dependencies including suppliers and vendors.

  • Important to remember that additional disruptions are possible during the pandemic.

• Cyber security

  • The rise in scam and phishing activities where attackers use COVID-19 as bait to impersonate authorities and brands (misleading employees and customers into giving up confidential information).

  • Higher demands on remote access technologies creates pressure on security that may result in external frauds, especially when employees use unsecure personal devices to perform official duties.

  • Challenging to enforce, detect and respond to security issues in a remote working environment.

  • Rapid changes in systems and access levels place greater emphasis on strict controls around remote security management.

  Read more

• Payroll compliance

  • A hot topic before the pandemic outbreak and may be even more difficult to assess and manage in the current environment.

  • In addition, many organisations are making large volumes of changes and agreeing to non-standard working arrangements during the pandemic.

  • Added difficultly to oversee/control dispersed workforce.

  • Increased pressure may also result in internal frauds.

  Read more

• Procure to pay

  • A key risk for organisations pre-COVID-19 with the process of facilitating significant expenditure. With remote work practice key controls such as segregation can be difficult at this time. It is more important than ever to have strong oversight including both preventative and reactive controls in place to mitigate the risk of human error or fraudulent transactions.

  • Emergency procurement and payments in response to the pandemic expose the organisation to internal and external fraud where limited controls exist.

  • Mismanagement of contract variations occurring as organisations re-negotiate terms of businesses (including variation approvals and reporting).

• Remote working

  • The need to move the majority of the workforce to operate remotely has occurred rapidly. As outlined above, increased cyber risks are associated with this, however, there is also a significant risk to your organisation’s number one asset – your people.

  • It is more important than ever for Management and Boards to have oversight and understanding of how the organisation is mitigating the key risk of the remote workforce which includes (but not limited to):

  • Poor workspaces impacting productivity or potential WHS issues.

  • Isolation/lack of human interaction impacting mental wellbeing.

  • Disengaged team members resulting in decreased productivity/loss of key talent.

  • Systems and hardware failure/outages impacting ability to operate as BAU.

  • Lack of oversight of teams increases the risk of fraudulent activities.

• Modern slavery

  • Another hot topic before the pandemic outbreak which may have increased risks in the current environment. COVID-19 should not take away the importance of this matter.

  • Many organisations will be required to report on their modern slavery program as soon as 31 December 2020.

  • Increased job insecurity in the pandemic environment can result in the vulnerable population being taken advantage of and coerced into forced labour and related practices.

• Program management

  • Perceived benefits of a business case may have changed in light of COVID-19 impacts, as well as the viability of effective project execution.

  • Organisations may look to revise expenditures and focus on projects with lower cash outlays or stronger potential for near term returns. 

• Vendor/Outsourcing management

  • Operational and revenue impacts from potential disruptions to key suppliers and vendors require ongoing monitoring.

  • Business case and risk profiles for suppliers may have shifted due to changing business priorities.