Writing
Resources
Plain explanations of the obligations Australian organisations are actually held to, and what evidencing them involves.
- Financial services
CPS 230 does not apply to you. Your investors will apply it anyway.
A private credit manager is not APRA-regulated, yet it is signing CPS 230 terms anyway, because a super fund trustee cannot lawfully retain a material service provider without them.
· 3 min read
- Cyber security
What Essential Eight Maturity Level Two actually requires
Maturity Level Two is the practical expectation for most Australian organisations handling sensitive data. Here is what each strategy asks for, and where self-assessments overstate.
· 2 min read
- Aged care
The strengthened Aged Care Quality Standards: what actually changed
The seven strengthened Standards took effect on 1 November 2025 under the Aged Care Act 2024. The substantive change is evidentiary, and it falls on systems never designed to produce evidence.
· 2 min read
- Child care
What assessment and rating actually asks you to evidence
Seven quality areas, fifteen standards, forty elements. Services doing the work still lose ground at rating on the documentary half, Quality Area 7 especially.
· 2 min read
- SOC 2
Why SOC 2 preparation is painful, and what actually fixes it
The controls are usually in place. What tends to be missing is contemporaneous evidence that they operated across the observation window, and that cannot be reconstructed after the window closes.
· 2 min read
- Privacy
You cannot protect personal data you cannot locate
The hardest question in a privacy programme is where the personal data is, right now, and who can reach it. Writing the policy is easy by comparison. And the hard question has a real answer.
· 2 min read
- GRC practice
Compliance theatre and the evidence gap
Most organisations are unevidenced rather than non-compliant, which looks identical from the outside and gets treated identically by regulators, auditors and boards.
· 2 min read
See where you actually stand.
Reading about the standards is one thing. Knowing your position against them is another.