Case Studies
AI Governance -Developing an AI Governance Framework for a Mid-Sized Financial Services Organisation
The Challenge
A mid-sized financial services firm had begun integrating AI tools across several business units, from credit decisioning to customer communications, without a formal governance structure in place. The board had limited visibility over how AI was being used, what decisions it was influencing, and what regulatory obligations were emerging. Leadership recognised they were moving fast without adequate oversight, and that the regulatory environment was catching up quickly.
Our Approach
Cipher Advisory was engaged to conduct an end-to-end AI governance review. We began by mapping all current and planned AI use across the organisation, assessing each application against emerging regulatory frameworks and best practice standards. We worked closely with the board and executive team to build a clear picture of accountability — who owned AI decisions, how outcomes were being monitored, and where the gaps were. From there, we developed a tailored AI governance framework covering risk classification, accountability structures, human oversight requirements, and board reporting protocols. We also delivered a focused board briefing to ensure leadership had the knowledge and confidence to fulfil their oversight responsibilities.
The Outcome
The organisation had a governance framework in place that was proportionate, practical and aligned with the direction of emerging regulation. The board moved from limited visibility to active, informed oversight. Leadership described the engagement as transformative — for the first time, they felt genuinely equipped to govern AI rather than simply approve it.
Privacy Governance -Privacy Obligations Review for a National Healthcare Provider Following Regulatory Change
The Challenge
A national healthcare provider was navigating a period of significant regulatory change, with reforms to privacy legislation creating new obligations around data handling, breach notification and patient consent. The organisation's existing privacy framework had not been substantively reviewed in several years, and leadership was uncertain whether current practices — across clinical, administrative and digital functions — met the new requirements. The consequences of getting it wrong were significant, both legally and reputationally.
Our Approach
Cipher Advisory undertook a comprehensive privacy governance review, beginning with a gap analysis of the organisation's existing framework against the updated legislative requirements. We mapped data flows across the organisation to identify where personal and sensitive information was collected, stored, shared and disposed of, and assessed each touchpoint against the new obligations. We worked with legal, clinical and operational leadership to develop a practical remediation roadmap — prioritising the areas of highest risk — and produced updated policies, staff guidance and board reporting templates. We also delivered targeted training for senior leaders on their obligations and accountability.
The Outcome
The organisation moved from uncertainty to confidence. Leadership had a clear, prioritised plan to achieve and maintain compliance, and the board had visibility over privacy risk for the first time in a structured, meaningful way. The engagement also identified several process improvements that reduced the organisation's broader data risk exposure beyond the immediate regulatory requirements.
Board Training - Bespoke Governance Training Program for a Newly Constituted Board
The Challenge
Following a significant restructure, a government-owned entity found itself with a newly constituted board — a mix of experienced directors and first-time appointees — responsible for overseeing an organisation navigating rapid change across AI adoption, data governance, cyber risk and evolving public sector ESG obligations. The board needed to build shared capability quickly, but generic director training wouldn't address the specific and complex governance landscape they were stepping into.
Our Approach
Cipher Advisory designed and delivered a bespoke training programme tailored to the board's specific context and obligations. The program ran across three half-day sessions covering AI governance and oversight responsibilities, cyber risk at the board level, privacy obligations in a public sector context, and ESG accountability and reporting. Each session combined structured content with facilitated discussion, scenario-based exercises and practical tools the board could apply immediately. Sessions were designed to be genuinely accessible — building confidence across the full director group regardless of prior technical knowledge — while maintaining the rigour appropriate to the governance responsibilities involved.
The Outcome
The board completed the program with a shared language, a shared understanding of their obligations, and — critically — the confidence to ask the right questions of management. The chair noted that the training had fundamentally changed the quality of board conversations on each of the four topic areas. A follow-up refresher session was commissioned six months later as the regulatory environment continued to evolve.
Cybersecurity Governance -Board Cyber Accountability Review for an ASX-Listed Corporation
The Challenge
Following a significant cyber incident at a peer organisation, the board of an ASX-listed corporation commissioned an independent review of its own cyber governance arrangements. While the company had invested heavily in operational cybersecurity, the board had growing concerns that its oversight structures, reporting mechanisms and accountability frameworks weren't keeping pace. Directors were aware of their legal exposure but uncertain whether their current governance arrangements were adequate.
Our Approach
Cipher Advisory conducted a structured review of the organisation's cyber governance from the board down. This included an assessment of existing board reporting on cyber risk, the clarity of accountability between the board, audit and risk committee, executive leadership and the CISO, and the organisation's incident response governance arrangements. We benchmarked the organisation's approach against current best practice and regulatory expectations, identified key gaps, and developed a prioritised set of recommendations. We then facilitated a half-day board session to walk directors through the findings and build shared understanding of their responsibilities.
The Outcome
The board implemented a revised cyber governance framework with clearer accountability lines, strengthened reporting mechanisms and a new board-level cyber risk appetite statement. Directors reported significantly greater confidence in their ability to oversee cyber risk — and in their ability to demonstrate that oversight to regulators, insurers and shareholders.
ESG Governance -ESG Governance Framework Development for a Private Infrastructure Company
The Challenge
A privately owned infrastructure company was facing growing pressure from institutional investors, financiers and major clients to demonstrate credible ESG governance. The organisation had strong values and had taken meaningful steps on sustainability and community engagement, but lacked the formal governance structures, reporting frameworks and board accountability mechanisms to evidence this credibly. Leadership was concerned that without a structured approach, their ESG commitments would be dismissed as superficial — and that they risked falling behind competitors in an increasingly ESG-sensitive market.
Our Approach
Cipher Advisory worked with the board and executive team to design an ESG governance framework built around the organisation's specific operating context and stakeholder expectations. We began by mapping current ESG activities and commitments against the standards and frameworks most relevant to their sector and investor base. We then developed a governance structure that embedded clear accountability at the board and executive level, established robust internal reporting mechanisms, and created a disclosure framework aligned with leading practice. We facilitated a board workshop to build literacy and shared ownership of the framework across the director group.
The Outcome
The organisation had a credible, defensible ESG governance framework that reflected genuine organisational commitment rather than box-ticking. Investor and financier conversations shifted — ESG moved from a risk in those discussions to a point of differentiation. The board also reported that the process had strengthened their collective understanding of ESG as a governance responsibility rather than a communications exercise.
