Aussie

Aussie

INCIDENT and ISSUE MANAGEMENT POLICY

Version Number: 2.0

Last Updated: September 2016

INTERNAL USE ONLY – This policy is intended for internal use only and should not be used outside Aussie Home Loans and its subsidiaries without first obtaining the consent of Risk and Compliance. The matters reflected in this policy are applicable as at the date shown and may be updated from time to time.

AHL.0008.0014.3772

1 | P a g e

Document control

Version number

Approved by Effective date Amendment description

1 Board February 2014

2 Executive Risk Committee

September 2016 Policy refreshed

AHL.0008.0014.3773

2 | P a g e

TABLE OF CONTENTS

1. PURPOSE AND CONTEXT ............................................................................................................ 3

2. SCOPE ........................................................................................................................................ 3

3. DEFINITIONS AND KEY TERMS .................................................................................................... 3

4. REQUIREMENTS OF THE POLICY ................................................................................................. 5

Identify, notify and escalate ............................................................................................................... 6

Assess and manage ............................................................................................................................. 6

Reporting ............................................................................................................................................ 7

Analyse and close ................................................................................................................................ 8

5. ROLES AND RESPONSIBILITIES .................................................................................................... 9

APPENDIX 1 – AUSSIE INCIDENT REPORTING FORM ......................................................................... 11

APPENDIX 2 - INCIDENT ESCALATION AND REPORTING TABLE .......................................................... 13

APPENDIX 3 – IMPACT ASSESSMENT TABLE ...................................................................................... 14

AHL.0008.0014.3774

3 | P a g e

1. PURPOSE AND CONTEXT

The purpose of the Aussie Incident and Issue Management Policy (“the Policy”) is to establish a consistently applied process to identify, assess and manage incidents, issues and near misses (as defined) when they occur and to ensure that they are:

- appropriately escalated to management and/or reported to regulators (where required)

within appropriate timeframes;

- dealt with appropriately and consistently;

- analysed to identify control weaknesses to be addressed to prevent recurrence; and

- recorded to enable reporting to management and the Board, and where required to

regulators.

This Policy is aligned with the CBA Group Compliance Incident Management Policy. NOTE: Reporting of incidents and issues by Aussie to the CBA Group must be guided, at all times, by the Aussie and CBA Exchange of Information Protocol (Refer to Appendix A in Aussie’s Managing Conflicts of Interest Policy).

2. SCOPE

2.1 This Policy applies to Aussie and its controlled entities (to the extent practicable in relation to the size, business mix and complexity of each controlled entity).

2.2 This policy covers both the management of incidents and issues. However, for the purposes of this policy, the term ‘incidents’ is used in most text and is interchangeable with the term ‘issues’ unless otherwise specifically stated.

2.3 In the unlikely event of specific circumstances where there may be regulatory requirements or contractual obligations that conflict with requirements of this policy, an exemption should be sought in writing from the Head of Risk & Compliance.

3. DEFINITIONS AND KEY TERMS

3.1 Incidents occur when the outcome of a business process differs from the expected outcome due to inadequate or failed processes, people, systems or as a result of external events. Aussie incidents covered under this Policy include those reported to Aussie by outsourced and/or business partners and Aussie staff retain responsibility for management of such incidents.

3.2 Issues are identified control weaknesses or gaps relating to the mitigation of key risks.

3.3 A regulatory compliance incident is an actual, suspected, likely or imminent breach of an applicable law, regulation, industry standard or code. A compliance incident may also result from a material breach of an internal policy / procedure or from non-compliance with contractual obligations.

3.4 Near misses are incidents where the potential impact does not eventuate and/or the full recovery of any loss is made within 48 hours / 2 business days.

3.5 The impacts of incidents may include (refer Appendix 3 ‘Impact Assessment Table’):

regulatory non-compliance (e.g. concern/warning; breach penalty; public notice)

financial loss or gain

AHL.0008.0014.3775

4 | P a g e

reputational damage/customer dissatisfaction (e.g. media or customer complaint)

legal/contractual breach

people issues

increased management effort.

3.6 The causes of incidents may include:

Operational incidents (i.e. failure of people, processes, systems, internal fraud, external fraud)

External events that are outside the control of Aussie.

3.7 Corrective actions are taken to address the impact of incidents.

3.8 Preventative actions are taken to address the underlying cause of the incident to prevent future recurrence of the same or similar incidents.

3.9 Incident Register refers to the document where Risk & Compliance (Line 2) record all incidents, issues and near misses reported to Line 2 by management (Line 1), identified by Line 2 or raised by another party, e.g. internal or external audit.

3.10 Incident Owner refers to the person responsible for ensuring that the incident has been recorded correctly, remediated appropriately including completion of preventative and corrective actions, and closed in a timely manner.

3.11 Action Owner refers to the person responsible for the prioritisation and completion of corrective and/or preventative actions associated to the incident. The action owner and incident owner may be the same person.

3.12 Regulator refers to those governing bodies to whom Aussie has some obligation. For example, Australian Securities and Investments Commission (ASIC), Australian Communications and Media Authority (ACMA), and Office of Australian Information Commissioner.

AHL.0008.0014.3776

5 | P a g e

4. REQUIREMENTS OF THE POLICY

4.1 The capture, assessment and management of incidents and issues across Aussie is achieved through the following process:

4.2 IT/system incidents will be recorded and escalated through the IT incident management process (refer to IT Security Framework).

4.3 Broker and customer incidents and issues should also be managed under this Policy. Note that customer complaints are managed in accordance with the Customer Complaints Handling Policy. A customer complaint may, however, also result in the need to report an incident as customer complaints may be a source of incident detection. Where it is determined that an investigation of broker conduct may be required, the Sales Compliance Senior Manager should be notified.

•Incident occurs

•Incident detected or issue identified

•Notification to Risk & Compliance within 1 business day of detection (and to GM/Head of Business Unit as appropriate)

•Escalation by Risk & Compliance per Escalation Matrix (refer Appendix 2)

Identify , Notify & Escalate

•Incident or issue assessed and managed including agreed corrective and preventative actions and timelines.Assess & Manage

•Incident/issue report provided to Risk & Compliance within 5 daysof detection

•Risk & Compliance provide Incident report to CBA if required as per Escalation Matrix (and permitted per Informaton Sharing Ptrotocol)

•Incident/issue reported to Executive Risk Committee (ERC) and / or Board as required

Report

•Incident owner and action owners provide update every 30 days until all actions to manage the incident have been completed satisfactorily

•Risk & Compliance close incident once all requirements are met.

Analyse & Close

AHL.0008.0014.3777

6 | P a g e

Identify, notify and escalate

4.3 Incidents and issues can be identified via a number of different channels, for example:

Internal (self-identified) – risk and control self-assessments, controls testing and other process breakdowns.

Line 2 and Line 3 – Line 2 oversight of the business, internal/external audits and reviews.

External (suppliers) – service disruptions, regulators, customer complaints.

4.4 Where a staff member identifies a potential incident or issue it is their responsibility to escalate the matter to their relevant line manager or senior management on the day of identification.

4.5 All incidents, including near misses, that have been detected also must be notified within one day to Risk & Compliance in person or by phone or email. Even if the full details of impacts, causes or required corrective and preventative actions have not been determined, the notification is required. Notification will enable Risk & Compliance to review the causes and appropriate actions to address the impacts and underlying control weaknesses that led to the incident occurring. In addition, Risk & Compliance will confirm whether the matter has a regulatory impact and will take responsibility for managing any required communication with the relevant regulator in accordance with the ‘Contact with the Regulator Policy’. Risk & Compliance are also able to provide subject matter expertise to assist Line 1 in management of the incident or issue.

4.6 Risk & Compliance will escalate a summary of the incident to the Executive Management Team in accordance with the escalation matrix provided in Appendix 2.

Assess and manage

4.7 Incidents must be assessed by the business and, once reported, Risk & Compliance will review the:

Impacts – regulatory, financial (actual or estimate), reputational, legal.

Impact rating – in line with the Impact Assessment Matrix (Appendix 3).

Causes – operational, external, fraud.

Actions (corrective and preventative) - action owners, appropriate due dates.

These details, including the impact rating, actions and timeframes, must be recorded in the Incident/Issue Reporting & Management Form (Appendix 1) and presented to Risk and Compliance within 5 days of detection. The form must be reviewed by and agreed with Risk & Compliance. Any subsequent changes to these forms must be appropriately re-approved (levels of approval also determined by Escalation Matrix in Appendix 2) with the updated forms provided to Risk & Compliance.

4.8 Regulatory compliance incidents are subject to additional requirements. An assessment of each regulatory compliance incident must be undertaken by the business in conjunction with Risk & Compliance without delay to determine if the incident is reportable. NOTE: there are strict reporting deadlines for certain regulatory breaches so reporting breaches immediately is essential. This requirement applies even in circumstances where not all information is currently available, legal advice is in progress and/or reporting to the Board has not occurred. Records supporting the determination must be maintained by the respective Line 1 Business Unit.

AHL.0008.0014.3778

7 | P a g e

Reporting

4.9 Reporting to Risk & Compliance – Having notified Risk & Compliance within one day, the business must also submit a formal incident report within 5 days of detection per Incident/Issue Reporting & Management Form (Appendix 1). The business is responsible for providing Risk & Compliance with a status update on incidents with open actions at least every 30 days or as requested. Up-to-date incident information provides the business with an accurate snapshot of the status and transparency regarding exposure to underlying control weaknesses that have not been addressed.

4.10 Reporting to Executive Risk Committee (ERC) - The details of new incidents, the status of open actions for previously reported incidents and incidents proposed for closure will be reported to Executive Risk Committee meetings. In addition, meaningful metrics (e.g. trend analysis reporting) to monitor compliance with and the effectiveness of this Policy will be provided to the ERC.

4.11 Reporting to the Board - Incidents that are rated ‘High’ or ‘Very High’ as per the Aussie Impact Matrix or have a regulatory impact will be reported to the Board at their next meeting, or sooner if required.

4.12 Reporting to Regulators – Reporting may be subject to prescribed timeframes which are critical and may vary. The Head of Risk & Compliance is responsible for ensuring that the timeframes are met and for ensuring that the regulator is updated as required on remedial action and when the incident has been resolved.

4.13 Any communication with regulators must be in accordance with the ‘Contact with Regulators Policy’.

4.14 Where Risk & Compliance determines that a compliance incident is reportable to a regulator, Legal must be consulted in relation to notification prior to it being sent to the regulator.

4.15 Reporting to CBA (Operational Risk & Compliance Only) – For ‘Very High’ and ‘High’ rated incidents (except if prohibited under the Aussie and CBA Exchange of Information Protocol), Incident/Issue Reporting & Management Forms must be provided to CBA within five business days of Risk and Compliance receiving the completed Form from the respective Line 1 Business Unit. Additional information may be provided on a progressive basis rather than delay reporting of the incident. Any delays in reporting must be accompanied by a valid explanation.

Logging of incidents (Risk & Compliance only)

4.16 Incidents must be recorded in the Incident Register by Risk & Compliance within five business days of receiving completed Incident/Issue Reporting & Management Form from the respective Line 1 Business Unit.

4.17 The financial impact of an incident must be allocated to the business unit where the control weakness / operational risk failure occurred to enable internal and external reporting. The business (Line 1) is accountable for informing Finance of any financial impacts as the result of incidents and ensuring that these impacts are posted to, or accrued in, the General Ledger (GL).

AHL.0008.0014.3779

8 | P a g e

Analyse and close

4.18 Incidents should be closed when all remedial actions are complete and approval has been sought per the following approval matrix:

*Except if prohibited under the Aussie and CBA Exchange of Information Protocol

4.19 Line 1 Business Unit approval must be sought prior to being endorsed for closure by Line 2 (Risk & Compliance).

4.20 Line 1 are required to review and maintain evidence of completion of actions prior to closing an incident. This should be retained for future inspection and/or audit.

Incident rating

Line 1 Approval

Line 2 Approval Additional Escalation/ Approval

Very High Executive Team Head of Risk & Compliance - Executive Risk Committee

- Aussie Board

- CBA*

High Executive Team Head of Risk & Compliance - Executive Risk Committee

- Aussie Board

- CBA*

Medium

Head of Senior Manager, Risk or Senior Manager Compliance No additional approvals required.

However, ‘Medium’ and ‘Low’ rated incidents will be captured as part of the ERC reporting.

Low Head of Senior Manager, Risk or Senior Manager Compliance

AHL.0008.0014.3780

9 | P a g e

5. ROLES AND RESPONSIBILITIES The table below articulates roles and responsibilities in relation to the incident and issue management process:

Business area Responsibilities

All staff (Line 1)

Identify and escalate (as appropriate) any incident resulting from

inadequate or failed internal processes, people and systems or from

external events that could have customer/ staff, financial, regulatory or

reputational impacts and take immediate action to contain any related

exposure.

Notify relevant business management (Head of and/or GM – refer to

Incident Escalation Matrix in Appendix 2) and Risk and Compliance

within one day of the incident being detected.

Analyse each incident to determine the impacts and appropriate

corrective actions, the underlying cause of the incident and identify

preventative actions.

Manage suitable remedial actions (both corrective and preventative)

within agreed timeframes.

Ensure that material changes to the remediation action plan or control

rectification of an incident are approved by business management and

immediately notified to Risk & Compliance.

Provide formal incident reporting within 5 days of detecting an incident

to Risk & Compliance using reporting template contained in this Policy.

Ensure that Finance are notified of any financial impact that is required

to be posted to or accrued in the General Ledger.

Update Risk & Compliance on the status of incidents and actions at

least every 30 days to enable accurate reporting to management, the

Executive Risk Committee (ERC) and the Board.

Risk & Compliance (Line 2)

Ensure that management and staff are aware of their responsibilities

under this Policy and provide necessary guidance, support and training.

Ensure incidents continue to be communicated and escalated per the

Incident Escalation Matrix.

Review the incident to confirm causes and impacts including

management actions to ensure:

o Corrective actions are appropriate and timely in addressing the

impact of the incident.

o Preventative actions are appropriate in addressing underlying

control weaknesses to ensure incidents do not reoccur.

Ensure that incidents are captured completely and accurately in the

Incident Register.

Ensure that any changes made to agreed actions are reviewed and

recorded in the Incident Register.

Monitor progress of actions.

Perform verification of preventative and corrective actions prior to

closure of Incidents.

Provide periodic incident reporting to management, the Executive Risk

Committee (ERC) and the Board.

Perform periodic review of incidents to identify systemic issues,

emerging themes or trends.

AHL.0008.0014.3781

10 | P a g e

Review compliance with this Policy as part of the controls assurance

program.

Review this Policy at least annually and present to the Executive Risk

Committee (ERC) for approval.

AHL.0008.0014.3782

11 | P a g e

APPENDIX 1 – Incident/Issue Reporting & Management Form

Please complete all fields and return this form via email to riskmanagement@aussie.com.au within 5 days of Incident / Issue detection. Complete the form to the best of your ability on identification of an incident / issue (you will be able to submit additional forms for any subsequent updates). NOTE: The initial notification of all incidents / issues (including near misses) MUST be made within 1 business day of initial identification. REFER TO THE INCIDENT and ISSUES MANAGEMENT POLICY FOR FURTHER GUIDANCE

Purpose of this form

Report new incident / issue Update open incident / issue (i.e. Update Actions)

Request closure of open incident / issue (signed closure request required)

Incident Identification

Incident / Issue Name (brief title to explain incident)

Incident Ref. No. (Risk & Compliance Use Only)

Incident / Issue Date Date Incident / Issue Identified

Incident / Issue Report Date Identified by (Line 1 / Line 2)

Incident / Issue Owner (Responsible for next steps)

Business Unit

Sensitive Incident / Issue? (Risk & Compliance Use Only)

Incident / Issue Details

Details (e.g. Who/What/Why When/Where/How. Please provide a succinct and clear description of the incident that can be understood by a person outside of the business area)

How was the Incident / Issue Identified?

Root Cause(s) (Why did the incident / issue occur)

Is there any control weakness or process failure? If yes, which control / process has failed?

Impact Details

Is a dollar loss or gain expected? If so, what is the estimated loss / gain value? Include estimate of internal staff efforts, remediation costs etc.

Is a recovery/refund expected (e.g. recoup from or refund to external parties)? If so, what is the estimated recovery amount?

AHL.0008.0014.3783

12 | P a g e

Is Non-Financial Impact expected (describe and/or quantify the potential or actual impact)

Customers

Customer Service

Reputation / Brand

Legal / Regulatory Compliance

People / Employee

Impact Assessment

Impact Rating (Very High/ High/Medium/Low)

Rationale (refer to Impact Assessment Matrix below)

Corrective Action Plan

What corrective action(s) have been or will be taken to remediate the incident / issue?

Target completion date of corrective action(s)

Corrective Action Owner

Preventative Action Plan What preventative action(s) have been / or will be taken to prevent a similar incident / issue from recurring?

Target implementation date of preventative actions / control enhancement

Preventative Action Owner

Closure Request I (General Manager or Head Of) confirm that all the above corrective and preventative action(s) to satisfactorily remediate this incident have been completed and implemented and that the incident / issue may be closed. I confirm that evidence has been retained to support completion of corrective and preventative actions and this will be provided, on request, for audit or follow up of the incident / issue closure.

(Attach: Email Approval)

Name Date

Attach any document to support the closure:

AHL.0008.0014.3784

13 | P a g e

APPENDIX 2 - INCIDENT / ISSUE ESCALATION AND REPORTING TABLE All incidents / issues are to be notified to Risk and Compliance within one day of detection. The following table provides the additional escalation paths that should be taken:

Incident rating (see table below)

Escalate to Timing & (by whom) Format Reporting

Very High Executive Team, Executive Risk Committee (ERC) and Risk & Compliance

Within 1 business day of detection (by person identifying potential incident/issue).

Email/Phone/In Person/Incident Reporting and Management Form

A report on all incidents / issues will be prepared for and presented at every Executive Risk Committee meeting. Very High and High

rated issues will also be reported to CBA (except if prohibited under the Aussie and CBA Exchange of Information Protocol) and to the

Aussie Board.

CBA (except if prohibited under the Aussie and CBA Exchange of Information Protocol)

Within 5 days of receiving completed Incident/Issue Reporting & Management Form from Line 1 (by Risk & Compliance)

Incident Reporting and Management Form

High Executive Team, Executive Risk Committee (ERC) and Risk & Compliance

Within 1 business day of detection (by person identifying potential incident/issue).

Email/Phone/In Person/Incident Reporting and Management Form

CBA (except if prohibited under the Aussie and CBA Exchange of Information Protocol)

Within 5 days of receiving

completed Incident/Issue Reporting & Management Form from Line 1 (by Risk & Compliance)

Incident Reporting and Management Form

Medium

Head of impacted Business Unit; relevant GM/Exec Team member and Risk & Compliance

Within 1 business day of detection (by person identifying potential incident/issue).

Email/Phone/In Person/Incident Reporting and Management Form

Low Head of impacted Business Unit and Risk & Compliance

Within 1 business day of detection (by person identifying potential incident/issue).

Email/Phone/In Person/Incident and Management Reporting Form

AHL.0008.0014.3785

14 | P a g e

APPENDIX 3 – Impact Assessment Table

FINANCIAL (BUSINESS)

CUSTOMER SERVICE AND OPERATIONS REPUTATION/ BRAND /CUSTOMERS LEGAL/REGULATORY COMPLIANCE PEOPLE PROJECT DELIVERY MANGEMENT EFFORT GUIDANCE*

Assessment based on:

Loss of existing customers/market share

Cost of remediation/recovery Loss of new business /market share

Damage to reputation by actions of both individual staff and the Group as a whole

Actual or potential impact on customers

Regulatory action

Customer/third party legal actions

Workplace health & safety

Workplace relations

-Staff morale/loyalty

Inability to deliver on project plan

and/or meet project budget

Drain on Executive resources

Opportunity cost

Very High

5

>$2.5m

Significant loss of market share and customer numbers because of extensive interruption to service capability.

Group wide data availability or integrity issues or information security is compromised

Widespread and prolonged inability to service all or the majority of our customer base irrespective of geographic location, channel or product

Major failure of systems impacting customers

Serious financial or reputational impact to all or most customers

Prolonged media and / or political attention as a result of inappropriate decision or operational incident

Actual or potential loss of license and/or penalties on directors

Severe impact on regulator relationships

Imposition of significant regulatory restrictions, e.g. enforceable undertakings, conditions or directions

Death or severe injury to employees whilst on Group business, or customers on Group property

Widespread loss of morale among management and staff resulting in high staff turnover

Industrial dispute/action – Group wide impact.

Project not delivered

>15% financial variance

Potential to lead to the significant damage to the business

Sustained ExCo/ Senior Management effort

High 4

$650k-$2.5m

Some loss of market share and customer numbers because of major interruption to service capability.

Extensive management involvement and significant costs incurred to restore critical processes

Significant data availability or integrity issues or compromise of info security

Widespread inability to service a significant proportion of customers

Short term media and / or political attention as a result of inappropriate decision or operational incident

Medium but widespread disruption of the system and/or Group’s systems lasting several days

Serious or reputational impact to a significant number of customers

Moderate financial or reputational impact to all Customers

Major fines and sanctions

Multiple legal actions

Focused regulatory surveillance/ significant increased regulatory oversight

Major systemic, recurring or significant breaches

Major impact on regulator relationships

Severe injury to employees whilst on Group business, or customers on Group property

Serious but localised loss of morale among management and staff resulting in high staff turnover

Industrial dispute/action – State or BU based impact

10% - 15% financial variance

Multiple mandatory scope item(s) cannot be delivered.

Majority of tangible / intangible benefits in business case will not be achieved

A significant event requiring major Group Executive/ Senior Management effort to absorb the impact

Medium

3

$200k<$650k

Minimal loss of market share and customer numbers because of minor interruption to service capability.

Some costs incurred to restore critical processes Localised data availability or integrity issues, or

compromise of info security Inability to satisfactorily service a material

proportion of customers irrespective of geographic location, channel or product

Reduced market share or temporary damage to Group brands resulting from limited negative national publicity or detrimental local publicity

Minor but widespread disruption of systems lasting several days

Moderate financial or reputational impact to a limited number of customers

Minor financial or reputational impact to a significant number of customers

Fines

Multiple agreements with customers at risk

Systemic complaints or compliance incidents

Significant breaches

Potential impact on regulator relationships

Increased regulatory oversight

Injuries to employees whilst on Group business, or customers on Group property

Some loss of morale among management and staff

Industrial dispute/action – localised department level impact

5% - 10% financial variance

All mandatory scope items can be delivered but a Highly Desirable scope item or multiple Desirable scope items cannot be delivered.

Moderate risk to delivery of tangible/intangible benefits

Moderate EGM/Senior Management effort is required to absorb the event impact

Low 2

$100k<$200k

Service standards not achieved but no impact on market share or customer numbers

Minimal time, effort and cost required to correct critical processes

Minimal disruption to satisfactorily servicing some customers irrespective of geographic location, channel or product

Limited adverse publicity = 1-2 days as a result of isolated customer complaint impacting little or no other customers

Limited disruption of systems impacting some geographical areas

Minor financial or reputational impact to a limited number of customers

Multiple customer complaints or compliance incidents which are not systemic or significant

Individual legal actions Low range fines

Injury to an employee whilst on Group business, or a customer on Group property

Short term and localised loss of morale among management and staff

Industrial dispute/action – localised at team level impact

1%-5% financial variance Slippage impacts one or more low criticality project(s).

Desirable scope item cannot be delivered.

Little or low risk to delivery of tangible/intangible benefits

Impact can be absorbed through normal activity with minor effort required from Senior Management

Very low 1

<$100k

No measurable operational impact on business

Limited operational impact on business; ability to service individual customers impacted but no systemic issues

Intra-day disruption of systems

No measurable loss of market share resulting from limited negative local publicity.

Insignificant financial or reputational impact to a limited number of customers

One off complaints or compliance incidents

No impact on staff morale <1% financial variance All Mandatory, Highly Desirable,

and Desirable scope items can be delivered but a mass of nice to have cannot.

Impact can be absorbed through normal activity

AHL.0008.0014.3786

15 | P a g e

Likelihood assessment

Level Rating Likelihood Description

5 Almost Certain ≥80% or greater probability of the risk/event occurring within the next 12 months

4 Likely <80% probability of the risk/event occurring within the next 12 months

3 Possible <50% probability of the risk/event occurring within the next 12 months

2 Unlikely <20% probability of the risk/event occurring within the next12 months

1 Rare <5% probability of the risk/event occurring within the next 12 months

Overall risk rating matrix

Likelihood

5 L M M H VH

4 L L M H VH

3 I L M H VH

2 I L M H VH

1 I I L M H

≤$100k <$200k <$650k <$2.5m >$2.5m

Impact

AHL.0008.0014.3787