What It Is

GRI Standards is a voluntary, modular framework for sustainability reporting. Its primary purpose is to enable organizations to disclose significant economic, environmental, and social impacts on stakeholders. The core approach is impact materiality, requiring identification of actual and potential impacts via a structured process in GRI 3: Material Topics.

Key Components

• Universal Standards (GRI 1 Foundation, GRI 2 General Disclosures, GRI 3 Material Topics) for baseline requirements.
• Sector Standards for high-impact industries like oil & gas, mining.
• Topic Standards (e.g., GRI 403 Occupational Health & Safety, GRI 308 Supplier Environmental Assessment) with specific disclosures.
• Built on principles like accuracy, balance, verifiability; compliance via GRI Content Index.

Why Organizations Use It

Drives accountability, regulatory alignment (e.g., CSRD), risk management for HES impacts, and stakeholder trust. Enhances comparability, benchmarking, and access to capital.

Implementation Overview

Phased: materiality assessment, data architecture, management disclosures, assurance. Applies globally to all sizes; no certification but external assurance recommended. Involves cross-functional teams, ESG platforms, supplier engagement.

What It Is

APRA Prudential Standard CPS 234 (Information Security) is a binding prudential regulation issued by the Australian Prudential Regulation Authority, effective 1 July 2019. It mandates APRA-regulated entities like banks, insurers, and super funds to maintain information security capabilities commensurate with threats to protect confidentiality, integrity, and availability of information assets, including those managed by third parties. The approach is risk-based, emphasizing proportionality to asset criticality and sensitivity.

Key Components

• Governance with Board ultimate accountability and defined roles.
• Asset identification, classification, and commensurate controls across lifecycle.
• Systematic testing, independent assurance, and incident response plans.
• 72-hour APRA notification for material incidents; 10-day for control weaknesses. No fixed control count; built on CIA triad principles with internal audit oversight.

Why Organizations Use It

• Mandatory compliance avoids penalties, enforcement, and license risks.
• Enhances operational resilience, customer trust, and third-party negotiations.
• Reduces incident impacts, supports market access, and builds competitive edge.

Implementation Overview

Phased: gap analysis, policy framework, controls, testing, monitoring. Applies to all sizes of APRA entities in Australia; requires evidence-based assurance, no formal certification but APRA supervision.