Melbourne GRC and Regulatory Technology Summit 2027

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

Most GRC functions are still running on a patchwork of spreadsheets, point solutions, and disconnected systems that were never designed to talk to each other, which is exactly what's making the current wave of regulatory change so hard to absorb.

This opening keynote frames the day: why fragmented GRC tooling has become the real bottleneck, and what a genuinely unified approach looks like in practice.

• Why disconnected GRC tools have become the limiting factor, not the regulations themselves.
• What "unified GRC" actually means in practice, beyond a vendor's marketing slide.
• The sequencing question: what to connect first for the fastest reduction in manual effort.

As AI becomes embedded in risk, compliance, and decision-making processes themselves, regulators are starting to ask GRC functions to govern the very technology many of them are now using to do their own jobs. This keynote covers what's actually expected of organisations deploying AI in and around compliance processes, and where the governance bar is heading next.

• What regulators expect when AI is used inside compliance and risk processes, not just the business they oversee.
• The particular governance risk of AI tools making or influencing compliance decisions.
• Building AI governance into GRC programs before it becomes a specific audit finding.

Periodic, point-in-time compliance checks are increasingly seen as inadequate for the pace of regulatory and operational change, pushing organisations toward continuous, AI-driven monitoring instead.

This panel debates how far continuous compliance has actually progressed, and what it takes to trust an AI-driven monitoring result enough to act on it.

• What's genuinely different about continuous monitoring versus faster periodic checks.
• How much organisations actually trust AI-generated compliance and risk signals today.
• What breaks first when moving from periodic to continuous compliance monitoring.

With CPS 230 requiring far more granular and ongoing management of operational risk and third-party dependencies than previous frameworks, many regulated entities found their existing processes couldn't keep up.

This case study covers how one organisation automated their operational resilience reporting to meet CPS 230 obligations without a permanent headcount increase.

• What their operational resilience reporting process looked like before automation, and why it couldn't scale.
• How they mapped critical operations and third-party dependencies in a way that stayed current.
• What automation actually reduced: reporting time, error rate, or both.

A hands-on, interactive session working through a real governance, risk, and compliance scenario as a room. Details announced soon.

The Financial Accountability Regime places direct personal accountability on individuals for their areas of responsibility, which has pushed organisations to build far more rigorous accountability mapping and evidence trails than they had under the previous regime.

This case study covers how one accountable entity operationalised FAR compliance in practice, not just on paper.

• How they mapped accountability obligations to individuals in a way that would hold up under scrutiny.
• What evidence and documentation processes they built to support accountable persons.
• Where their original compliance approach fell short before they fixed it.

With Tranche 2 bringing lawyers, accountants, real estate professionals, and other previously uncovered sectors into Australia's AML/CTF regime, many newly reporting entities are building compliance programs essentially from zero.

This case study follows one newly captured entity through building a compliance program from the ground up ahead of the deadline.

• What they had to build from nothing: risk assessment, customer due diligence, reporting obligations.
• Where they found the compliance burden heaviest as a newly reporting entity.
• What they'd tell another organisation just starting their Tranche 2 preparation.

Most control failures and third-party risk events are still identified after they've caused a problem, when predictive indicators were often sitting in the data all along.

This panel examines how organisations are using predictive analytics to catch control weaknesses and third-party risk before they turn into incidents.

• What leading indicators of control failure actually look like in practice.
• How predictive third-party risk monitoring differs from a periodic vendor questionnaire.
• Where predictive models have produced false confidence, and how to guard against it.

Small-group, discussion-based sessions where you'll work through real governance, risk, and compliance challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

AI agents are increasingly being used to triage alerts, conduct KYC investigations, and flag suspicious activity faster than human analyst teams can alone, but financial crime teams are still working out how much autonomy to actually give them.

This case study covers a real deployment of AI agents in financial crime compliance, including where human review stayed firmly in the loop.

• Where AI agents took over investigation and triage work, and the measurable time savings.
• What they deliberately kept human-reviewed, and why.
• How they validated the AI agents weren't missing or misclassifying genuine risk.

Mandatory climate-related financial disclosure is now in force and expanding to more organisations, and ASIC has already flagged early concerns about the quality of sustainability reporting it's seeing.

This closing keynote covers how technology is being used to make climate and ESG reporting accurate and defensible, not just compliant on paper.

• What ASIC's early observations reveal about where sustainability reporting is falling short.
• How technology is closing the gap between climate data collection and reportable, assured disclosure.
• What "audit-ready" ESG reporting actually requires operationally.

When a regulator asks for evidence, the organisations that struggle are usually the ones that treated evidence collection as an end-of-cycle scramble rather than a continuous by-product of how they work.

This closing session puts the room's real evidence-readiness to a live vote.

1. If a regulator asked for evidence right now, would you have it within hours, days, or weeks?
2. What's your biggest audit trail gap: manual processes, disconnected systems, or inconsistent evidence standards?
3. Has a compliance evidence gap ever caused a finding or delay in a regulatory review?
4. Is your compliance evidence a continuous by-product of your processes, or a separate exercise?
5. Where will your next GRC technology investment go: platform consolidation, continuous monitoring, or evidence and audit trail management?

Unwind with your peers for a couple of drinks on us!

Beat the rush and join us early for complimentary barista-made coffee and breakfast.

Most GRC functions are still running on a patchwork of spreadsheets, point solutions, and disconnected systems that were never designed to talk to each other, which is exactly what's making the current wave of regulatory change so hard to absorb.

This opening keynote frames the day: why fragmented GRC tooling has become the real bottleneck, and what a genuinely unified approach looks like in practice.

• Why disconnected GRC tools have become the limiting factor, not the regulations themselves.
• What "unified GRC" actually means in practice, beyond a vendor's marketing slide.
• The sequencing question: what to connect first for the fastest reduction in manual effort.

As AI becomes embedded in risk, compliance, and decision-making processes themselves, regulators are starting to ask GRC functions to govern the very technology many of them are now using to do their own jobs. This keynote covers what's actually expected of organisations deploying AI in and around compliance processes, and where the governance bar is heading next.

• What regulators expect when AI is used inside compliance and risk processes, not just the business they oversee.
• The particular governance risk of AI tools making or influencing compliance decisions.
• Building AI governance into GRC programs before it becomes a specific audit finding.

Periodic, point-in-time compliance checks are increasingly seen as inadequate for the pace of regulatory and operational change, pushing organisations toward continuous, AI-driven monitoring instead.

This panel debates how far continuous compliance has actually progressed, and what it takes to trust an AI-driven monitoring result enough to act on it.

• What's genuinely different about continuous monitoring versus faster periodic checks.
• How much organisations actually trust AI-generated compliance and risk signals today.
• What breaks first when moving from periodic to continuous compliance monitoring.

With CPS 230 requiring far more granular and ongoing management of operational risk and third-party dependencies than previous frameworks, many regulated entities found their existing processes couldn't keep up.

This case study covers how one organisation automated their operational resilience reporting to meet CPS 230 obligations without a permanent headcount increase.

• What their operational resilience reporting process looked like before automation, and why it couldn't scale.
• How they mapped critical operations and third-party dependencies in a way that stayed current.
• What automation actually reduced: reporting time, error rate, or both.

A hands-on, interactive session working through a real governance, risk, and compliance scenario as a room. Details announced soon.

The Financial Accountability Regime places direct personal accountability on individuals for their areas of responsibility, which has pushed organisations to build far more rigorous accountability mapping and evidence trails than they had under the previous regime.

This case study covers how one accountable entity operationalised FAR compliance in practice, not just on paper.

• How they mapped accountability obligations to individuals in a way that would hold up under scrutiny.
• What evidence and documentation processes they built to support accountable persons.
• Where their original compliance approach fell short before they fixed it.

With Tranche 2 bringing lawyers, accountants, real estate professionals, and other previously uncovered sectors into Australia's AML/CTF regime, many newly reporting entities are building compliance programs essentially from zero.

This case study follows one newly captured entity through building a compliance program from the ground up ahead of the deadline.

• What they had to build from nothing: risk assessment, customer due diligence, reporting obligations.
• Where they found the compliance burden heaviest as a newly reporting entity.
• What they'd tell another organisation just starting their Tranche 2 preparation.

Most control failures and third-party risk events are still identified after they've caused a problem, when predictive indicators were often sitting in the data all along.

This panel examines how organisations are using predictive analytics to catch control weaknesses and third-party risk before they turn into incidents.

• What leading indicators of control failure actually look like in practice.
• How predictive third-party risk monitoring differs from a periodic vendor questionnaire.
• Where predictive models have produced false confidence, and how to guard against it.

Small-group, discussion-based sessions where you'll work through real governance, risk, and compliance challenges with peers in similar roles. Roundtable topics will be announced soon.

Put your knowledge to the test in this fast-paced quiz covering real-world trivia, key concepts, and emerging trends. Compete for bragging rights — and a voucher — as the top scorer takes the crown.

AI agents are increasingly being used to triage alerts, conduct KYC investigations, and flag suspicious activity faster than human analyst teams can alone, but financial crime teams are still working out how much autonomy to actually give them.

This case study covers a real deployment of AI agents in financial crime compliance, including where human review stayed firmly in the loop.

• Where AI agents took over investigation and triage work, and the measurable time savings.
• What they deliberately kept human-reviewed, and why.
• How they validated the AI agents weren't missing or misclassifying genuine risk.

Mandatory climate-related financial disclosure is now in force and expanding to more organisations, and ASIC has already flagged early concerns about the quality of sustainability reporting it's seeing.

This closing keynote covers how technology is being used to make climate and ESG reporting accurate and defensible, not just compliant on paper.

• What ASIC's early observations reveal about where sustainability reporting is falling short.
• How technology is closing the gap between climate data collection and reportable, assured disclosure.
• What "audit-ready" ESG reporting actually requires operationally.

When a regulator asks for evidence, the organisations that struggle are usually the ones that treated evidence collection as an end-of-cycle scramble rather than a continuous by-product of how they work.

This closing session puts the room's real evidence-readiness to a live vote.

1. If a regulator asked for evidence right now, would you have it within hours, days, or weeks?
2. What's your biggest audit trail gap: manual processes, disconnected systems, or inconsistent evidence standards?
3. Has a compliance evidence gap ever caused a finding or delay in a regulatory review?
4. Is your compliance evidence a continuous by-product of your processes, or a separate exercise?
5. Where will your next GRC technology investment go: platform consolidation, continuous monitoring, or evidence and audit trail management?

Unwind with your peers for a couple of drinks on us!