For Australian financial advice practices
Could your advice practice prove how it manages cyber risk?
If an insurer, ASIC or a client asked today, could you produce the training records, the policy acknowledgements, the named responsibilities, the review dates and the evidence behind your answer?
Your IT provider secures the systems. Cleverer is the layer that shows the business managed its people, policies, governance and oversight, and it builds the record while you work.
Five minutes, no email required to see your result. Built for advice practices with staff, not for enterprise security teams.
An advice file holds more about a client than their bank does.
Banks see transactions. You see the whole picture, and you keep it for years because the advice relationship requires it.
- Verified identity documents Licences and passports collected at onboarding, then kept on file.
- Full financial position Income, assets, liabilities, cash flow and tax position, updated at every review.
- Superannuation and investment holdings Fund details, member numbers, balances, rollovers and platform logins discussed by email.
- Insurance and underwriting detail Risk advice files can carry health disclosures, which are sensitive information under the Privacy Act.
- Family and estate arrangements Beneficiaries, dependants, relationship breakdowns, powers of attorney and vulnerability notes.
- Years of correspondence SOAs, ROAs, file notes and email threads with accountants, lawyers and product providers.
Support staff, client service managers, paraplanners and external paraplanning providers usually touch most of this. The obligation to handle it properly sits with the business, not just with the adviser whose name is on the file.
Your MSP secures the systems. It cannot answer for your people.
Most advice practices already have the technical side covered. That is not where these conversations go wrong.
What your IT provider handles
- Endpoint protection and patching
- Multi-factor authentication on Microsoft 365
- Email filtering and backup
- Device management and encryption
- Network and firewall configuration
Cleverer does not replace any of this, and does not claim to.
What nobody in the practice owns
- Which cyber and privacy obligations each role carries
- Dated proof that each person completed their training
- Dated acknowledgement of the current version of each policy
- A recurring management review that leaves a record
- A log of concerns raised, and what was done about them
This is the half that gets tested when something goes wrong.
The OAIC's own guidance on APP 11 treats reasonable steps as both technical and organisational measures, and lists governance, culture and training first among the areas an entity should consider. Read our plain-English take on APP 11 reasonable steps.
If someone asked today, what could your practice actually prove?
Answer these the way you would have to answer them in writing, with a document attached.
- Can you name the person accountable for cyber and privacy in the practice, and show it in writing? Not who would probably deal with it. Who holds it as a defined responsibility.
- Can you produce a dated training record for every person who touches client files? Including client services, reception, bookkeepers and any external paraplanner with system access.
- Can you show who acknowledged the current version of each policy? An old acknowledgement of a superseded policy is worth very little.
- Can you show a management review of cyber and privacy that happened in the last 12 months? With a date, a participant list and what was decided.
- Can you show what happened to the last issue somebody raised? A misdirected email, a suspicious payment request, a lost device, a departing staff member's access.
- Can you show that access to client files was reviewed after someone left? Advice practices turn over support staff. Permissions rarely turn over with them.
- Could you assemble all of the above in an afternoon, without asking three people to search their inbox? Evidence you cannot retrieve under pressure is not evidence.
Ten questions, and an honest read on where the practice stands.
Short version of the full check. No email needed to see the result.
Cyber risk management has already been treated as a licence obligation.
In ASIC v RI Advice Group Pty Ltd [2022] FCA 496, the Federal Court found that an AFS licensee had contravened its general obligations under section 912A of the Corporations Act by failing to have and implement documentation and controls that adequately managed cyber security risk across its authorised representatives. It was the first time an Australian financial services business was found to have breached the Act over cyber conduct. The failure was not a missing product. It was missing policies, plans, procedures, standards and controls.
If your practice operates under an AFS licence more broadly, see how Cleverer maps safeguards to AFSL Cyber & Technology Risk obligations.
Privacy enforcement has moved in the same direction. In March 2026 the Privacy Commissioner described an intentional shift toward a greater focus on enforcement over the preceding 12 months, pointing to a $5.8 million civil penalty against Australian Clinical Labs, civil penalty proceedings against Optus and Medibank, and a $50 million settlement with Meta. The OAIC also ran its first targeted compliance sweep in January 2026, checking privacy policies against the Act rather than waiting for a complaint.
None of that sweep was aimed at advice practices. The useful signal is the direction of travel: Australian privacy regulation is moving from passive guidance to active monitoring, and what gets examined is what a business can show it actually did.
Cleverer turns the people side of compliance into something you can hand over.
It runs alongside your IT provider and your licensee's requirements. It does not touch your systems.
- Responsibility Every role in the practice carries a named set of cyber obligations. Advisers, client services, paraplanning and practice management each see what is theirs, so nothing sits with "the business" in general.
- Training Produce a dated training record without searching inboxes or spreadsheets. Assigned by role, completed by person, timestamped, and retained as an evidence trail.
- Policies Know exactly who has acknowledged each current policy, and when. When a policy is revised, the previous acknowledgements no longer count as current and the practice can see it.
- Oversight See overdue responsibilities and gaps before someone else finds them. Practice principals get a view of what is complete, what has lapsed and who is holding things up.
- Review cycles Recurring reviews that happen on schedule and leave a record behind. Reminders escalate rather than expire quietly, so the review is a dated event and not an intention.
- Issues Log a concern, show what was done about it, and close it out. The misdirected email that was handled well becomes part of your position instead of a gap in it.
What the practice can put in front of someone who asks.
Reasonable steps are judged on what was in place at the time, not on what the business meant to do. This is the record that builds while the practice operates normally.
- A dated register of who holds which cyber and privacy responsibility Including changes over time, so you can show what was true last financial year and not only what is true today.
- Completion records and certificates per person, per role Retrievable as a report rather than assembled by hand the week an insurer asks.
- Policy acknowledgement history against each policy version Who accepted what, on what date, against which version of the document.
- A management review trail Evidence that oversight is recurring and active, which is the distinction APP 1 draws between having a policy and running a practice.
- An issues and escalation log Concerns raised, actions taken, dates closed. This is often the most persuasive thing a small practice has.
Cleverer maintains organisational evidence. It does not provide technical security controls, it does not prevent breaches, and nothing here is legal advice.
Next step
Find the gaps before an insurer, a licensee or a client does.
The Compliance Check scores two things separately: whether the controls exist, and whether you could produce the evidence. Under scrutiny it is the second score that decides how defensible your practice looks.
Sources
- ASIC, Court finds RI Advice failed to adequately manage cybersecurity risks (22-104MR), and the Federal Court orders and reasons.
- OAIC, Handling privacy complaints, a new approach for a new era (2 March 2026).
- OAIC, Privacy compliance sweep to put privacy policies under the spotlight (9 December 2025).
- OAIC, APP guidelines, Chapter 11: security of personal information, and Chapter 1: APP 1.
