LE QUESNE This is something we have recognised over the last few years as an increasing and quickly evolving risk to New Zealand’s regulated entities, and we put in place a threepronged plan to help ensure the resilience of these entities.

The first part was our cyber guidance for regulated entities, which was finalised and published in 2021. Second, we have undertaken a range of work with our peer regulators in Australia and New Zealand, as well as with other agencies, on readiness of protocols.

Finally, we recently concluded a consultation on cyber data collection within regulated entities, to survey and understand how these entities are managing cyber risk. The findings of the consultation have been well received. Entities are very engaged with this issue and it is clear that managing risks is important.

This is a risk we are very attuned to. We are working closely with our colleagues at the Council of Financial Regulators, recognising that it is an issue that cuts across borders and is tricky to manage given the pace at which it is evolving.

LE QUESNE We help entities to manage risk because we are thinking about the risks to the financial system as a whole. Operational interruption or risks to individual entities can very easily become systemic.

We are observing a desire from many parties to work collaboratively on this challenge to combine the – sometimes – limited expertise and resources. Particularly in a small country like New Zealand, even if it affects them in different ways many organisations are facing similar risks.

DODDRELL Cyber risk does not discriminate between the type of business or user function. A company’s approach to cyber security, including the measures it has put in place, has been raised repeatedly by investors on issuer roadshows in the last year.

SUTCLIFFE Many firms in Australia have been the victims of quite serious cyber incidents. It is a risk we think about when we are drafting documentation and setting up payments. Our clients are seeking advice on cyber issues, but this is often after a cyber attack when they are in crisis management mode.

BOYLE It is starting to be.

DODDRELL A number of cases have been very visible through the media. Within the debt capital market area at Westpac – and we are only a relatively small part of the business – general operations have changed to protect our information and data.

BOYLE It is becoming more of a focus for investors as well, as they analyse and monitor the potential cyber risks to businesses as part of their ongoing due diligence.

SUTCLIFFE The technology is incredibly sophisticated. What this means is that we understand the risk in a conceptual sense, but it is difficult for those who are not IT experts to be across all the nuts and bolts, or to fully appreciate the potential risks and consequences.

LE QUESNE This heightened awareness is good to see. It takes a village to manage what is a very complex and evolving risk.